KR102396236B1 - Apparatus for processing cyber threat information, method for processing cyber threat information, and medium for storing a program processing cyber threat information - Google Patents

Abstract

Disclosed are an apparatus for processing cyber threat information, a method for treating cyber threat information, and a storage medium storing a program for processing cyber threat information. As one embodiment of the present invention, there may be provided a method for processing cyber threat information including: disassemble an input execution file to obtain a disassembled code; reconstructing the disassembled code to obtain a reconstructed disassembled code; converting the reconstructed disassembled code into a data set having a predetermined format; and determining similarity based on the converted data set having the predetermined format and classifying a cyber threat attack technique included in the execution file into at least one standardized attack identifier according to the determination. According to the embodiment, it is possible to detect and respond to even malicious code that does not exactly match data learned through artificial intelligence, respond to variants of a malicious code, and identify, within a very short time, the malicious code, the attack technique, the attacker, and the attack prediction method even if the variants of the malicious code exist.

Description

A storage medium for storing a cyber threat information processing device, a cyber threat information processing method, and a program for processing cyber threat information

The disclosed embodiments relate to a cyber threat information processing apparatus, a cyber threat information processing method, and a storage medium storing a cyber threat information processing program.

The damage from cyber security threats, which are gradually becoming more sophisticated, centering on new or variant malicious codes, is increasing. In order to reduce such damage even a little and to respond at an early stage, we are advancing the countermeasure technology through multi-dimensional pattern composition and various complex analysis. However, recent cyber-attacks tend to increase day by day rather than being adequately countered within the control range. These cyber attacks threaten finance, transportation, environment, health, etc. that directly affect our lives beyond the existing ICT (Information and Communication Technology) infrastructure.

One of the basic technologies to detect and respond to most existing cyber security threats is to create a database of patterns for cyber attacks or malicious codes in advance and utilize appropriate monitoring technologies where data flow is required. Existing technologies have evolved based on identifying and responding to threats when data flows or codes matching monitored patterns are detected. Such conventional techniques have the advantage of being able to detect quickly and accurately if they match a previously secured pattern. There was a problem.

The prior art is focused on a method of advancing the technology to detect and analyze the malicious code itself, even if artificial intelligence analysis is used. However, fundamentally, there is no fundamental technology to counter cyber security threats, so there is a problem that it is difficult to respond to a new malicious code or a variant of the malicious code using this method alone, and there are limitations.

For example, there is a problem in that confusion occurs because only technology that detects and analyzes already discovered malicious code itself cannot respond to decoy information or fake information to deceive the detection or analysis system.

In the case of mass-produced malicious code that has enough data to learn, it is possible to distinguish whether it is malicious or the type of malicious code because it can secure enough characteristic information. However, in the case of APT (Advanced Persistent Threat) attacks, which are made in relatively small quantities and attack sophisticatedly, they often do not match the training data, and because the majority of targeted attacks make up the majority of attacks, there are limitations even if the existing technology is advanced. exist.

Also, conventionally, methods and expression techniques for explaining malicious codes, attack codes, or cyber threats differed depending on the analyst's position or analysis point of view. For example, the method of describing malicious codes and attack behaviors is not standard worldwide, so even when the same incident or the same malicious code is detected, there is a problem of confusion because the explanations of experts in the field are different. Even the name of the malicious code detection was not unified, so it was not possible to identify which attack was performed correctly even though it was the same malicious file, or it was organized differently. Therefore, there was a problem in that the identified attack technique could not be described in a normalized and standardized manner.

Conventional methods for detecting and analyzing malicious codes have a problem in that, in the case of malicious code that performs very similar malicious actions by focusing on the detection of the malicious code itself, the attackers cannot be identified when the attackers are different.

In connection with the above problems, the conventional method has a problem in that it is difficult to predict what kind of cyber threat attack there will be in the near future by this individual case-focused detection method.

The purpose of the embodiments disclosed below is to provide a cyber threat information processing device, a cyber threat information processing method, and a cyber threat capable of detecting and responding to malicious code that does not exactly match data learned by artificial intelligence and responding to a variant of malicious code It is to provide a storage medium for storing a program for processing information.

Another object of the embodiment is to store a cyber threat information processing device, a cyber threat information processing method, and a cyber threat information processing program that can identify malicious code, attack technique, attacker and attack prediction method in a very short time even if it is a variant of malicious code to provide a storage medium that

Another object of the embodiment is to provide a cyber threat information processing device, a cyber threat information processing method, and a cyber threat information processing device capable of providing malicious code information in which the malicious code detection name is not uniform or the cyber attack technique is not accurately described in a normalized and standardized manner. It is to provide a storage medium for storing a program for processing threat information.

Another object of the embodiment is to identify other attackers that generate malicious code performing very similar malicious behavior and predict what kind of cyber threat attack there will be in the future, a cyber threat information processing device, a cyber threat information processing method, and a cyber threat information processing method It is to provide a storage medium for storing the program.

An embodiment includes the steps of: disassembling an input executable to obtain a disassembled code, and reconstructing the disassembled code to obtain a reconstructed disassembled code; converting the reconstructed disassembled code into a data set of a specific format; and determining whether it is similar to a previously stored malicious code based on the converted data set of the specific format, and classifying the converted data set of the specific format into at least one standardized attack identifier according to the determination. A method for processing cyber security threat information is provided.

The disassembled code may include an OP-CODE corresponding to a function included in the executable file and an assembly code that is an operand of the function.

The step of converting the data set of the specific format includes; normalizing the reconstructed disassembled code to data of a predetermined length; and vectorizing the normalized data.

The classifying includes determining whether a malicious code is included in the data set of the specific format based on the similarity between the data set of the specific format and the malicious code of the previously identified pattern, and according to the determination result, the specific format The method may further include performing ensemble machine learning on a data set of , and classifying the included malicious code into at least one standardized attack identifier.

The one or more standardized attack identifiers may follow a classification method according to the classification of MITER ATT&CK.

From another point of view, an embodiment may include: a database for storing classified malicious codes; and a processor for processing an input executable file, wherein the processor disassembles the input executable file through an application programming interface (API) to obtain disassembled code, and the disassembled code performing a module for reconstructing to obtain a reconstructed disassembled code, and a code processing module for converting the reconstructed disassembled code into a data set of a specific format; determining whether it is similar to the stored malicious code based on the converted data set of the specific format, and performing a classification module for classifying the converted data set of the specific format into at least one standardized attack identifier according to the determination; A cyber security threat information processing device is provided.

In another aspect, an embodiment provides: disassembling an input executable to obtain disassembled code and reconstructing the disassembled code to obtain a reconstructed disassembled code; transform the reconstructed disassembled code into a data set of a specific format; and determining whether it is similar to a previously stored malicious code based on the converted data set of the specific format, and classifying the converted data set of the specific format into at least one standardized attack identifier according to the determination; A storage medium for storing a program for processing cyber security threat information is provided.

According to the embodiments disclosed below, it is possible to detect and respond to malicious code that does not exactly match data learned by machine learning, and to respond to a variant of the malicious code.

According to the embodiment, even a variant of the malicious code can identify the malicious code, attack technique, and attacker within a very short time, and furthermore predict the attack technique of a specific attacker in the future.

According to the embodiment, it is possible to accurately identify a cyber attack implementation method based on whether such malicious code exists, an attack technique, an attack identifier, and an attacker, and provide it as a standardized model. According to an embodiment, information on malicious codes in which the names of malicious code detection and the like are not unified or the cyber attack technique is not accurately described may be provided in a normalized and standardized manner.

In addition, it can predict the possibility of generating previously unknown malicious code and the attackers who can develop it, and provide a predictive means of what kind of cyber threat attack there will be in the future.

1 is a diagram illustrating an embodiment of a method for processing cyber threat information;
2 is a view showing an example of obtaining static analysis information in the process of generating analysis information according to the disclosed embodiment;
3 is a view showing an example of obtaining dynamic analysis information in a process of generating analysis information according to an embodiment disclosed herein;
4 is a view showing an example of obtaining in-depth analysis information in the process of generating analysis information according to the disclosed embodiment;
FIG. 5 is a diagram illustrating an example of disassembling a malicious code to determine a file containing a malicious behavior as an example of in-depth analysis; FIG.
6 is a diagram illustrating an example of calculating correlation analysis information in a process of generating analysis information according to the disclosed embodiment;
7 is a view showing an example of a process of obtaining correlation analysis information according to the disclosed embodiment;
8 is a diagram illustrating an example of generating prediction information of cyber threat information according to an embodiment;
9 is a diagram illustrating an example of malicious code queries for providing cyber threat information according to an embodiment;
10 is a diagram illustrating an embodiment of a cyber threat information processing device;
11 is a diagram illustrating an example for describing in detail a function of a static analysis module in an analysis framework according to the disclosed embodiment;
12 is a view showing an example for explaining in detail the function of the dynamic analysis module among the analysis framework according to the disclosed embodiment;
13 is a view showing an example for explaining in detail the function of the in-depth analysis module among the analysis framework according to the disclosed embodiment;
14 is a view showing an example for explaining in detail the function of the correlation analysis module in the analysis framework according to the disclosed embodiment;
15 is a diagram illustrating an example for describing in detail a function of a prediction information generation module of a prediction framework according to an embodiment of the present disclosure;
16 is a diagram illustrating an example of performing static analysis according to an embodiment of the present disclosure;
17 is a diagram illustrating an example of performing dynamic analysis according to the disclosed embodiment;
18 is a view showing an example of performing in-depth analysis according to the disclosed embodiment
19 is a diagram illustrating an example of matching an attack technique with codes extracted from binary codes according to the disclosed embodiment;
20 is a diagram illustrating an example of matching an attack technique with a code set including an OP-CODE according to an embodiment of the present disclosure;
21 is a diagram illustrating a flow of processing cyber threat information according to the disclosed embodiment;
22 is a diagram illustrating values obtained by converting OP-CODE and ASM-CODE into normalized codes according to the disclosed embodiment;
23 is a diagram illustrating vectorized values of OP-CODE and ASM-CODE according to the disclosed embodiment;
24 is a diagram illustrating an example of converting a block unit of a code into a hash value according to the disclosed embodiment;
25 is a diagram illustrating an example of an ensemble machine learning model according to the disclosed embodiment;
26 is a diagram illustrating a flow of learning and classifying data by machine learning according to an embodiment of the present disclosure;
27 is a diagram illustrating an example of performing labeling by identifying an attack identifier and an attacker with learning data according to an embodiment of the present disclosure;
28 is a view showing a result of identifying an attack identifier according to an embodiment;
29 is a diagram illustrating a gram data pattern according to an attack identifier according to an embodiment;
30 is a diagram illustrating the performance of an embodiment of processing the disclosed cyber threat information;
31 is a diagram showing an example of providing a detection name to detection engines of engines that detect cyber threat information
32 is a diagram illustrating an example of a new malicious code and attack method according to an embodiment;
33 is a diagram illustrating another embodiment of a method for processing cyber threat information;
34 is a diagram illustrating another embodiment of a cyber threat information processing device

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. In an embodiment, a framework, a module, an application program interface, etc. may be implemented as a device coupled with a physical device or may be implemented as software.

When the embodiment is implemented as software, it may be stored in a storage medium, installed in a computer, etc., and executed by a processor.

Examples of the cyber threat information processing apparatus and the cyber threat information processing method will be described in detail as follows.

1 is a diagram illustrating an embodiment of a method for processing cyber threat information. An embodiment of the cyber threat information processing method will be described as follows.

The cyber threat information processing device performs pre-processing of the input file (S1000).

Identification information that can identify the file can be obtained through pre-processing of the file. An example of performing pre-processing of a file is as follows.

Various types of meta information can be obtained from the received file, including source information of the file, collection information obtained from the file, and user information of the file. For example, if the file contains a uniform resource locator (URL) or is included in an e-mail, you can obtain information about the file collected. The user information may include user information that is created, uploaded, or finally saved in a file. In the pre-processing process, as meta information of the file, IP (internet protocol) information, country information based thereon, API (Application Programming Interface) key information, for example, API information of a user who requested analysis, etc. can be obtained.

It is also possible to extract the hash value of the file in the preprocessing process. If the hash value is already known to the cyber threat information processing device, the type of file or the degree of risk can be identified based on the hash value.

If the file is not already known, analysis information for identifying the file type can be obtained by inquiring the hash value and file information on pre-stored information or, if necessary, an external reference website. For example, as an external reference website, information according to file type can be obtained from sites such as C-TAS (Cyber Threats Analysis System) operated by Korea Internet & Security Agency, CTA (Cyber Threat Alliance) operating system, and VitusTotal.

For example, a file can be retrieved from the site by using the hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), and SHA 256 of the file. In addition, the file may be identified using the search result.

As an example of performing file analysis, when an input file is transmitted through a mobile network, a packet transmitted through network traffic uses a recombination technology of network transmission packets, etc. to detect if the input file is a mobile malicious code. can be saved The packet recombination technology reassembles a series of packets corresponding to one executable code in the collected network traffic, and if the file transmitted by the recombined packets is a mobile malicious code, this file is saved.

If the mobile malicious code is not extracted from the transmitted file in this step, you can directly access the download URL in the file to download and save the mobile malicious code.

Malicious activity analysis information related to the input file is generated (S2000).

The analysis information of malicious behavior related to the input file may include static analysis information for analyzing information about the file itself or dynamic analysis information for determining whether a malicious behavior is performed by executing information obtained from the input file.

The analysis information in this step may include in-depth analysis information that uses information processed from an executable file related to the input file or performs memory analysis related to the file.

Deep analysis may include artificial intelligence analysis to accurately identify malicious behavior.

The analysis information in this step may also include correlation analysis information capable of estimating a correlation for an attack action or an attacker by correlating the analysis information already stored in relation to the file or the generated analysis information with each other.

In this step, a plurality of analysis information may be aggregated to provide an overall analysis result.

For example, static analysis information, dynamic analysis information, in-depth analysis information, correlation analysis information, etc. for a single file may be integrated and analyzed for accurate attack technique and attacker identification. The integrated analysis removes the overlapping part between the analysis information, and the common information between the analysis information can be used to increase the accuracy.

For example, cyber threat compromise information (indicator of compromise, IoC) collected through multiple analyzes and pathways can be standardized through normalizing or enrichment among the information.

In an embodiment of acquiring analysis information, it is not necessary to calculate all of the analysis information described above in order. For example, either one of static analysis information acquisition and dynamic analysis information acquisition may be performed, and dynamic analysis information may be performed before static analysis information.

In-depth analysis information does not necessarily need to proceed after performing static analysis or dynamic analysis, and correlation analysis may also be performed without in-depth analysis information.

Accordingly, the processing order for obtaining the above analysis information may be changed or may be selectively performed. In addition, the process of acquiring the analysis information and the process of generating the prediction information described above may be performed in parallel based on the information acquired from the file. For example, even if dynamic analysis is not completed, correlation analysis information may be generated. Similarly, performing dynamic analysis or performing in-depth analysis may be performed simultaneously.

In this case, the pre-processing process (S1000) exemplified above is for obtaining or identifying the information of the file, so if static analysis, dynamic analysis, deep analysis, or association analysis is performed individually or in parallel, each analysis step will be performed as part of each. can

A detailed example of this step will be described below.

Prediction information of malicious behavior related to the input file may be generated (S3000).

In order to increase analysis accuracy, predictive information on whether malicious behavior occurs, attack techniques, and attacker groups can be generated using the data set of the various types of information analyzed above.

The generation of predictive information can be performed through artificial intelligence analysis on an already analyzed data set. The generation of predictive information is not an essential step, and when a properly analyzed data set is prepared for artificial intelligence analysis and the conditions are satisfied, predictive information about malicious attack behavior can be generated in the future.

The embodiment performs machine learning based on artificial intelligence based on various types of analysis information. An embodiment may generate prediction information based on a data set for the analyzed information. For example, additional analysis information is generated based on data learned by artificial intelligence, and the regenerated analysis information may be used as input data of artificial intelligence as new learning data.

Here, the prediction information may include malicious code creator information, malicious code attack method information, malicious code attack group prediction, malicious code similarity prediction information, and malicious code spread prediction information.

The generated prediction information may include first prediction information for predicting the risk of the malicious code itself and second prediction information for predicting the attacker, attack group, similarity, spread, etc. of the malicious code.

The prediction analysis information including the first prediction information and the second prediction information may be stored in a server or a database.

Detailed embodiments thereof will be described below.

After post-processing of the analysis information or prediction information, cyber threat information related to the input file is provided (S4000).

The embodiment determines the type of malicious code and the degree of risk of the malicious code based on the analysis information or the prediction information. And the embodiment creates profiling information for the malicious code. Therefore, it is possible to save the results of performing self-analysis on files or the results of performing additional and predictive analysis through file analysis. The generated profiling information includes an attack technique for malicious code or labeling for an attacker.

The cyber threat information may include information on which the above pre-processing has been performed, generated or identified analysis information, generated prediction information, aggregate information of these information, or information determined based on the information.

The provided cyber threat information may include information analyzed or predicted above by using analysis information stored in a database in relation to the input file.

According to an embodiment, when a user inquires not only a malicious action for an input file but also cyber threat information about a previously stored file or a malicious action, information on this may be provided.

Such integrated analysis information may be stored in a standardized format in a server or database corresponding to the corresponding file. Such integrated analysis information may be stored in a standardized format and used for searching or inquiring cyber threat information.

Additional examples against the user's inquiry of cyber threat information will be described in detail below.

2 illustrates an example of obtaining static analysis information in a process of generating analysis information according to the disclosed embodiment.

The step of obtaining the static analysis information according to the disclosed embodiment may include obtaining and analyzing the structure information of the input file (S2110).

The embodiment may analyze the basic structure information of the file identified first in an environment in which the file is not executed. In this step, for example, even if the file type is different from ELF (Executable and Linkable Format), PE (Portable Executable), APK (Android Application Package), etc., the above file structure of the file or information that can be extracted from the structure to acquire or analyze.

In the static analysis exemplified for reference, identification of a file may be performed in the disclosed pre-processing step. In this case, the analysis step in step S210 may be performed together with the pre-processing step.

Then, pattern analysis of the input file may be performed (S2120).

Here, in the case of analyzing a file pattern for an identified file, the file pattern can be obtained by checking several strings that can be extracted by opening the file itself without taking any action on the file.

Information related to the production of the input file may be obtained and analyzed (S2130).

In the embodiment, unique information or meta information of a file, for example, file creator information, and code signing information in the case of an executable file can be obtained.

And it is possible to analyze the environment information of the input file (S2140).

Here, information such as system environment component information that the target file should have can be obtained.

Then, various other information related to the input file is analyzed and stored (S2150). It is possible to store static information of the file itself in a specific file format, for example, in a data format such as JSON (JavaScript Object Notation), without performing such a file.

An example of static analysis is to analyze the file itself, and it is possible to obtain the existence of a weak item based on coding, a problem with the call structure of an interface or function, or the binary structure of a file.

An example of analyzing the static information disclosed above is shown as a flow chart for convenience, but the above steps are not necessarily performed in the order described above or shown in the drawings. In addition, it is not necessary to perform all the steps disclosed in this drawing according to the file, and some steps, for example, structural government analysis, production-related information analysis, and environmental information analysis, may be selectively performed to obtain static analysis information. That is, it may vary according to the selection of those skilled in the art in the order of implementation and the selection of implementation steps.

Examples of acquiring static analysis information according to the disclosed embodiment will be briefly described as follows.

As an example of performing static analysis, when a hash value of an input file is extracted in the pre-processing process, the hash value of the extracted file is compared with a hash value already stored for malicious code, and the input file is malicious. Code can be analyzed. Based on the analysis, it is possible to detect the presence of malicious code in the file.

If the input file is mobile data, code information of suspicious mobile malicious code is extracted from the input file. Here, the code information refers to information that can be extracted from the code itself without executing the mobile malicious code, for example, hash information, code size information, file header information, and identification included in the code. Possible string information and operating platform information may be included.

As described above, the static analysis information obtained in this way may be stored corresponding to the file.

3 shows an example of obtaining dynamic analysis information in a process of generating analysis information according to the disclosed embodiment.

Dynamic analysis information according to the result data executed in the execution environment of the identified file based on at least one of the identified file information and the static analysis information from the preprocessing may be obtained.

The step of acquiring dynamic analysis information according to the disclosed embodiment is a step of analyzing various input/output data in an environment in which the file is running or analyzing a change in interaction with the execution environment when the file is executed to detect a weak or dangerous anomaly. . In general, the file is directly executed in the virtualization environment and abnormality is analyzed.

In order to perform the dynamic analysis, the embodiment creates and prepares a dynamic analysis environment for executing the input file (S2210). When the type of the input file is identified, it is possible to know which execution environment is required according to the type of each file. For example, depending on the file, it can be identified whether the file is running on a Windows operating system, a Linux operating system, or a mobile device operating system.

In the prepared analysis environment, the obtained file is executed to determine whether it is a malicious code (S2220).

In order to obtain dynamic analysis information, an event occurring in the corresponding system may be collected by executing a file in such an execution environment (S2230). For example, you can collect events for the files themselves, processes, memory, registry, systems on the network, or events that change the settings of each system. Then, the collected events are analyzed individually or collectively.

After collecting the collected results, the environment for dynamic analysis is restored again (S2240).

The result obtained in this way may be stored as dynamic analysis information corresponding to the file.

Hereinafter, an example of collecting and analyzing dynamic analysis information according to an embodiment of acquiring such dynamic analysis information will be briefly described.

As an embodiment of the dynamic analysis, when an input file is identified as a file operating in a mobile device operating system, the file is directly executed in a mobile terminal or an emulator or virtualization environment configured to be the same as the mobile terminal environment. And after the mobile malicious code is executed in the file, all changes that occur in the terminal, that is, behavior information, are extracted and recorded. The behavior information is different depending on the operating system (OS) environment of the terminal, but may generally include event information such as process, file, memory, and network information.

As another example of dynamic analysis, even when the hash value of the input file is not extracted in the pre-processing process and the hash value is extracted from the user terminal, the hash value of the file extracted from the terminal can be received through the intelligence platform. there is.

If the hash value of the file is not already stored in the database, the received file is executed in a virtual or real operating system, actions that occur during execution are collected in real time, and the collected dynamic analysis information is compared with the information already stored in the database. can

As a result of the comparison, if the previously defined risk level is exceeded, it may be determined that the input file contains malicious code, and the hash value of the file may be stored in a database to be used for static analysis later.

Depending on the malicious code, the first process, which is the subject of the action, may generate a dangerous action in the system. However, in some cases, the action of the first process additionally creates a second process that is a child process, and the second process performs a malicious action on the system.

In this case, an embodiment of the dynamic analysis stores the events that the action of the first first process generates in the execution system, and additionally extracts or identifies a second process that is a child process of the first process to the second process It is also possible to store the event of the malicious behavior. As such, in this example, the dynamic analysis may determine whether the identified file contains malicious code by comprehensively analyzing event information of the first process and the second and third processes to be connected thereto.

Depending on the execution result of the input file, if there is no unknown malicious code characteristic, it may be difficult to detect even though it has the characteristic of malicious code. In this case, another embodiment of the dynamic analysis may detect malicious behavior of the running process by monitoring and analyzing a network process that communicates with the outside when the identified file is executed.

For example, you can monitor network events that communicate with the outside when the identified file is executed. Stores the Process IDentifier (PID) that created the local address object according to the file execution. In addition, when a network event related to the execution of the file occurs, local address object information may be extracted from IRP (Interior Router Protocol) information of the corresponding network event.

A dynamic analysis may be performed to determine malicious behavior by comparing the local address object generated by the process ID with the local address objects related to the network event. For example, it is possible to determine whether a malicious act is performed by checking a pattern of packets transmitted and received according to the network event or a control and command (C&C) server that triggers packet transmission.

As another embodiment of the dynamic analysis, ARP information may be monitored to prevent an Address Resolution Protocol (ARP) spoofing attack. In general, ARP or Neighbor Discovery Protocol (NDP) may be used for correspondence between an IP (internet protocol) address and a MAC (media access control) address of a device in a local area network.

ARP spoofing attack is achieved by sending an ARP message corresponding to the MAC address of the receiving network device, not the MAC address of the receiving network device, when an attacker sends an IP packet. The network device receiving the transmitted message sends the transmission packet to the attacker instead of the normal IP address.

The embodiment determines whether an ARP spoofing attack occurs by comparing ARP information directly collected from network devices to respond to such an attack and ARP information in SNMP (Simple Network Management Protocol) information of network devices included in a virtual network. can

That is, in one embodiment of the dynamic analysis, the host sends an ARP information request message to the devices connected to the network, and the first ARP information included in the returned ARP response message and the SNMP information of the devices connected to the virtual network are included. By comparing the second ARP information, if the first ARP information and the second ARP information are different, it can be determined that an ARP spoofing attack has occurred.

This embodiment can detect an ARP spoofing attack by using this dynamic analysis method and prevent leakage of confidential information to be stored in the host device.

Another implementation of the dynamic analysis method is a method capable of analyzing malicious code to avoid the virtual environment. Here, the terminal connected to the management server through the network may perform booting using the first operating system (OS) image stored in the management server. After the terminal boots and analyzes the malicious code based on the first OS, the terminal receives the second OS image from the management server, and performs initialization using the received second OS image. Then, the terminal transmits the signature on which the analysis of the malicious code has been completed to the management server. Therefore, even if there is a malicious action issued after analyzing the malicious code based on the first OS, the management server causes the terminal to delete the first OS from the terminal and allows the terminal to boot based on the second OS identical to the original OS image. It is possible to prevent the occurrence of malicious behavior in the terminal.

The malicious code communicates with an external server and can issue additional commands and receive files.

However, if the server capable of performing the dynamic analysis is stopped, the dynamic analysis may take a very long time, and there are cases where the dynamic analysis cannot be performed even if the corresponding behavior is blocked in advance.

In order to analyze network behavior through dynamic analysis, the command and control server (C&C server) used by malicious code, a download server to download additional malicious code, or communication packets that exchange information between malicious codes or exchange information with hackers, etc. information should be extracted and analyzed. However, such information cannot be extracted when the relevant server is not operating in this way.

Another embodiment of the dynamic analysis method disclosed herein may perform dynamic analysis even when the server is stopped.

For example, a dynamic analysis may be performed by allowing the network access inducing device to process the access request of the terminal between the client terminal infected with the malicious code and the management server. The network access inducing device may receive an access request from the terminal and transmit it to a C&C server that induces malicious code behavior. And, if the network access inducing apparatus does not receive a response packet from the C&C server within a predetermined time, the network access inducing apparatus transmits a separate virtual response packet and an access request to the terminal together.

Thereafter, data related to the analysis of the malicious code received from the terminal may be extracted.

For an example of using the virtual response packet, a packet format for creating a virtual response packet TCP session is sufficient. A general Transmission Control Protocol (TCP) protocol used by malicious code may generate a data packet transmitted by the client terminal to create only a TCP session. In addition, important information necessary for dynamic analysis of malicious code may be extracted from the data packet. In this way, even if the management server does not operate, dynamic analysis can be performed using the operation of the network connection inducing device.

In this way, the embodiment can analyze the event issued by executing the received file and store the dynamic analysis information in the database.

4 discloses an example of obtaining in-depth analysis information in the process of generating analysis information according to the disclosed embodiment.

The step of acquiring the mental analysis information according to the disclosed embodiment includes an attack technique that causes a malicious behavior or an attacker by disassembling an executable file including the received file and analyzing it at the machine language level. do.

In-depth analysis information can be obtained by using the results of the described static analysis or dynamic analysis, or executable files can be analyzed as files that cause malicious behavior according to the analysis criteria of the analyst.

In addition, the in-depth analysis information may include analysis information of the file itself or information obtained by processing the file multiple times, and may be performed based on previously stored information.

The in-depth analysis may include disassembling, extracting the disassembled machine language level code, identifying an attack behavior (TTP), identifying an attacker, and performing taint analysis.

It will be exemplified in detail with reference to the drawings as follows.

When the input file includes an executable file, the in-depth analysis disassembles the executable file (S2410).

The disassembled assembly codes may include an operation code (OP-CODE) and an operand. An operation code (OP-CODE) indicates a machine language instruction that can be called an instruction code, and an operand indicates information necessary for an execution operation, that is, target data or a memory location of the machine language instruction.

Hereinafter, for convenience, a portion of disassembled assembly codes excluding the OP-CODE will be referred to as an ASM-CODE. Therefore, hereinafter, the ASM-CODE may include an operand part.

Through disassembling, an executable file in object code format is converted into code in a specific format, for example, assembler language format or disassembled code. An OP-CODE (operation code) and an ASM-CODE having a predetermined format may be extracted from the disassembled code (S2420).

The extracted disassembled code may be converted into a certain type of data format. An example of conversion of a certain type of data format is disclosed below.

The in-depth analysis may identify the attack behavior based on the extracted disassembled code or the data format converted to the predetermined format (S2430).

In the disassembled code, the OP-CODE is a part of the machine language instruction that specifies the operation to be performed. Each attack behavior can have a very similar value or format. Therefore, by analyzing these OP-CODEs and ASM-CODEs, specific attack behaviors can be distinguished.

The disassembled codes may be extracted from the executable file, and the extracted disassembled codes may be separated according to an executable function.

For example, the OP-CODE and ASM-CODE extracted from the disassembled code or the recombined code of the disassembled code is a hash value such as a fuzzy hashing method or a CTPH (context triggered piecewise hashes) method or a It can be converted into a certain type of code.

The embodiment may identify the attack behavior by converting the disassembled code of the executable file into a predetermined format and matching the attack behavior details commonly recognized by cyber security expert groups.

In addition, it is possible to identify the TTP based on the database storing the previously extracted disassembled codes and the matching relation for each TTP. In this case, the fuzzy hash value according to the CTPH algorithm of the extracted disassembled codes or the matching similarity for each attack behavior (TTP) with the data converted into a predetermined format can be performed at high speed.

As an example of a database storing the attack behavior of such a security expert group, a database storing information such as MITER ATT&CK may be exemplified. MITER ATT&CK is one of the databases on actual security attack techniques and behaviors, and by displaying specific security attack techniques or behaviors as components in a matrix format, attack techniques and behaviors can be identified in a specific data set format.

MITER ATT&CK classifies the attack techniques of hackers or malicious codes by stage of attack and expresses them as a matrix of CVE codes (Common Vulnerabilities and Exposures Code).

The embodiment identifies a specific attack behavior among various attack behaviors by analyzing the disassembled code, but by matching the identified type of attack behavior with the actually performed attack codes recognized by expert groups, the identification of the attack behavior is specialized However, it can be expressed with elements that are recognized in common.

Since the OP-CODE in the disassembled code is a machine language instruction that causes a specific behavior, the OP-CODE of a file that causes the same attack behavior can be very similar. However, since the same attack behavior and the OP-CODE included in the file causing it are not exactly the same, the embodiment can perform artificial intelligence-based machine learning on the disassembled code including the OP-CODE. there is. When machine learning is performed, whether an attack code having a similarity greater than or equal to a threshold is included and an attack technique of the attack code can be identified.

Accordingly, even if the disassembled codes of the files causing the same malicious behavior are not completely identical, the file performing the malicious behavior can be identified based on the disassembled code.

Algorithms such as Perceptron, Logistic Regression, Support Vector Machines, and Multilayer Perceptron may be used as machine learning algorithms.

By matching the similarity of the fuzzy hash values of the disassembled codes with the attack codes of an attack technique such as MITER ATT&CK previously learned using an artificial intelligence (AI) algorithm, it is possible to finally detect a malicious code.

In addition, the embodiment may identify an attack action corresponding to the disassembled code or vulnerable elements of the attack action quickly with more accuracy by using the result of artificial intelligence machine learning.

Specific embodiments thereof will be described in detail below with reference to the drawings.

An embodiment of the in-depth analysis may include identifying an attacker who induces a similar attack behavior using the disassembled code and the artificial intelligence-based machine learning result (S2440). Similarly, a specific example of attacker identification will be described later.

In addition, an embodiment of the in-depth analysis may include a taint analysis that can determine whether there is an attack action through memory analysis of the system at a specific point in time even in the case of fileless malicious code. (S2450).

In-depth analysis is based on processing the disassembled code of the executable file, and the attack technique or attacker's identification or taint analysis accordingly may be selectively performed.

The final deep analysis information performed in this way may be stored in the database as in-depth analysis information corresponding to the file.

FIG. 5 discloses an example of disassembling a malicious code as an example of in-depth analysis to determine that a file contains a malicious behavior.

As described above, if the executable file is disassembled, OP-CODE and ASM-CODE, which are assembly language code types, can be obtained.

For example, a specific function A in an EXE executable file may be converted into disassembled code including OP-CODE or disassembled code (disassembled cocde) through a disassembler.

If the EXE executable file is malicious code that causes malicious behavior, disassemble the function or code part that causes such behavior to obtain a disassembled code set that causes malicious behavior.

The disassembled code set may include an OP-CODE set corresponding to the malicious behavior or malicious code, or a set in which an OP-CODE and an ASM-CODE are combined.

Even if the malicious behavior is the same, it is identified whether the input malicious code corresponds to a specific disassembled code set through artificial intelligence-based similarity analysis because the disassembly result of the executable file or the algorithm of the malicious code that performs it is not exactly the same. can do.

This malicious behavior corresponding to a specific disassembled code set can be used to identify an attack technique (TTP) by matching a professional and public attack method or attack technique such as MITER ATT&CK.

Alternatively, an OP-CODE set in a specific disassembled code or a set combining OP-CODE and ASM-CODE can be used to determine an attack technique by matching it with the attack technique elements defined in MITER ATT&CK.

This figure shows an example in which the execution file, the disassembled code set of the executable file, and the attack technique corresponding to the attack technique elements in MITER ATT&CK correspond to each other.

6 discloses an example of calculating correlation analysis information in a process of generating analysis information according to the disclosed embodiment.

The various types of analysis information obtained above may be used as cyber threat infringement information, and correlation analysis information indicating a relationship between an attacker or an attack technique is generated based on the cyber threat infringement information.

Cyber threat indicator of compromise (IoC) refers to various pieces of information that identify actual or potential cyber security threat behavior, attack behavior, or malicious behavior occurring on a system or network. For example, Cyber Threat Compromise Information (IoC) represents a file indicating these actions, various traces appearing on log information, the file itself, a path, or the like, or information that allows to infer these actions.

Using the files identified as static, dynamic, and in-depth analysis information already analyzed, the correlation between the analysis information and the IP information (S2510), the correlation between the hostname of the website or included in the email (S2520), URL associations (S2530) and file codesign associations (codesign) associations (S2540) can be obtained.

The process of obtaining the correlation analysis information exemplified here is an example, and does not necessarily follow the exemplified order or all correlations need to be analyzed. For example, by using only the correlation between IP and URL between the analysis information and the attack behavior, it is possible to obtain the correlation for the related file. This correlation analysis information can be used to accurately infer an attack technique or an attacker.

Even if the attack behavior or the attacker is not identified through static analysis, dynamic analysis, or in-depth analysis, information that can estimate the attack behavior and the attacker can be obtained by using the correlation between the analyzed information. A detailed description thereof will be described below with reference to the drawings.

Such correlation analysis information may be continuously and cumulatively stored with respect to a received file, and the stored correlation analysis information may be updated again whenever a new file is received in the future.

Based on the various analysis information analyzed above, cyber threat breach information is obtained.

In addition, various types of correlation information for identifying an attack action or an attacker may be obtained using the cyber threat breach information (IoC) (S2550).

Such cyber threat breach information (IoC) may be used to obtain correlation analysis information for inferring an attack technique later. The correlation analysis and an example of tracking an attacker or inferring an attack behavior using the correlation analysis will be described in detail below.

And the obtained correlation analysis information may be stored in the server or database again in response to the file.

As described above, the analyzed information can be collected and standardized through duplication, standardization, and enrichment processes. For example, static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information may be provided to a user or stored in a standardized format to update or reproduce cyber threat information later.

In this case, the overlapping or common analysis information of each analysis information may be duplicated and may perform an enrichment operation of the insufficient portion of the data.

And it may be provided as cyber threat information according to a user's inquiry query or according to a service policy. The provision of cyber threat information will also be described in detail below.

Such cyber threat information may be provided directly to the user, or may be generated as the cyber threat prediction information described below and then provided according to the user's request or service.

7 is a diagram illustrating an example of a process of obtaining correlation analysis information according to the disclosed embodiment.

In this figure, files A-1 (10), A-2 (20), and B-1 (30) refer to files that can cause malicious behavior, and are server (A) (110), server (B) (120). ) indicates the C&C server that causes malicious behavior.

According to the disclosed embodiment, when a file of file A-1 (10) is received and dynamic analysis is performed, it is assumed that it is confirmed that the server (A) 110 is connected when the file A-1 (10) is executed. .

In the embodiment, the stored analysis information of the file A-2 (20) similar to the file A-1 (10) can be obtained from a database storing various types of analysis information on the malicious code. From the analysis information of file A-2 (20), it can be understood that the server (A) (110), which is the same server, utilizes files A-1 (10) and file A-2 (20), and from this information, the server (A) ) 110 can be presumed to be a hacker using the same attack technique or the same server.

According to the embodiment, when the file A-2 (20), which is the already analyzed file, accesses not only the server (A) 110 but also the server (B) 120, as a relation of the file A-2 (20), the server ( B) The information of (120) can be stored.

If the file A-1(10) and file A-2(20) are completely different files, but the analysis information of the file B-1 (30) stores the record of accessing the server (B) (120), the file format is Although different, the server (A) 110 and the server (B) 120 may be the same attacker group or an attacker group using the same technique.

Therefore, by analyzing the correlation of various types of analysis information related to the file in this way, grouping information on the attacker causing the malicious behavior, attack technique, etc. can be obtained, and this correlation analysis information is used to identify the attacker or the group of attackers. can be

Hereinafter, an example of explaining cyber threat prediction information is disclosed.

Cyber threat prediction information may be generated using at least one of the identification information of the file and the obtained analysis information or based on the collected data set.

8 discloses an example of generating prediction information of cyber threat information according to an embodiment. An example of generating prediction information of cyber threat information will be described with reference to the drawings.

When a data set for analysis information is secured, predictive information related to an attack behavior that will occur in the future can be generated based on the data set.

If the data set according to the analysis information extracted as above is processed into an artificial intelligence-based learning data set, and artificial intelligence analysis is performed based on the processed learning data set, various predictive information related to the attack behavior can be generated.

The data set of the prediction information generated in this way can be repeatedly generated or processed into a new training data set.

In the embodiment of this figure, the prediction information of the malicious code creator (S3110), the prediction information of the malicious code attack method (S3120), and the prediction information of the malicious code attack group (S3130) through the artificial intelligence learning of the data set of the above analysis information , examples of generating malicious code similarity prediction information (S3140), malicious code spread prediction information (S3150), and the like are disclosed.

Here, the order of prediction information is an example, and the order of obtaining prediction information may be changed. For example, the order of the malicious code similarity prediction information S3140 and the malicious code spread prediction information S3150 may be changed, and the generation of the remaining prediction information does not necessarily follow the illustrated order.

In addition to the exemplified similarity prediction information, it is also possible to generate additional prediction information related to cyber threat information.

The generated malicious code prediction information consists of risk prediction information that predicts its own risk, prediction information that predicts the attacker, attack group, similarity, spread, etc., or comprehensive prediction information of malicious code that comprehensively displays the prediction information. It can be divided and stored in a database.

By using the analysis information and prediction information of the cyber threat information above, the type of malicious code related to the input file can be identified and the level of risk can be determined.

In addition, profiling information including a record of malicious code related to the input file can be created and stored, and analysis information, prediction information, risk or profiling information related to the stored malicious code are additionally added so that the user can easily inquire it. can be processed.

An example of providing cyber threat information to a user is as follows.

Since various correlation analysis information may be generated based on a specific file, a very large amount of data communication may be required for cyber threat breach information (IoC). Embodiments may share, store, inquire, and update such information within a short time in order to quickly respond to cybersecurity threats.

Based on the above analysis information, in the embodiment, when a security event occurs, the cyber threat infringement information (IoC) related to the generated security event is transmitted to the cyber threat infringement information (IoC) storage server or other user terminals through encrypted socket communication. Inquiry can be requested using P2P socket communication. In addition, information that quickly receives the cyber threat breach information (IoC) from the cyber threat breach information (IoC) storage server or other user terminals can be used as the cyber threat breach information (IoC).

As another example, as another example of providing cyber threat information, when information on malicious code analyzed as described above is inquired from a terminal used by a user, the searched information may be provided as follows.

For example, when the terminal used by the user calculates the hash value of the file, it can transmit to the server a query to find out whether or not there is a malicious code with respect to the calculated hash value in a text format. After receiving the hash value and the query, the server delivers the hash value to the database in which the malicious code information is stored as above, and receives the inquiry result. The server receiving the inquiry result may return the result back to the user terminal as a text value corresponding to the hash value.

Another example of providing cyber threat information according to a user's request based on the stored malicious code information will be described with reference to the drawings.

9 discloses an example of malicious code queries for providing cyber threat information according to an embodiment.

According to the embodiment of the cyber threat information processing, the malicious code identified based on the analysis information and the prediction information calculated as described above may be stored together with various types of meta information.

As described above, a user can request an inquiry as exemplified in the database in which malicious code information is stored.

Referring to Query (A), the user can store malicious code-related period, specific malicious code quantity, detection name, file type, distribution site, code sign, and You can query malicious codes by categories such as file size.

Then, the database in which the cyber threat information is stored returns cyber threat information or malicious code information corresponding to the query through the server.

As another example, as exemplified in Query (B) of this figure, the user may inquire about a specific date related to a malicious code, a quantity of a specific malicious code, a file type, whether to distribute it, whether to create a child process, and the like.

As exemplified in Query (C), the user uses information on the period related to the malicious code, the quantity of specific malicious code, file type, distribution information, file name information, attack behavior according to malicious code execution, and file size. You can query for information about

In the example of Query (D), information on malicious code can be queried using the period related to malicious code, quantity of specific malicious code, file type, distribution address, and statistical information of malicious code.

As described above, in the embodiment of the cyber threat information processing method, the analysis information and the prediction information store information meeting the above conditions in the database together with the malicious code in order to provide malicious code information corresponding to the user's inquiry inquiry.

Therefore, the server can obtain information about malicious code matching the query condition from the database and transmit it to the user.

As illustrated, the user can inquire the malicious code information using various types of meta information of the file. Users can get information in advance that needs to be protected or that the system can be damaged or threatened by malicious code.

10 is a diagram illustrating an embodiment of an apparatus for processing cyber threat information. The embodiment of this figure conceptually exemplifies a cyber threat information processing device. An embodiment of the cyber threat information processing device will be described with reference to this drawing.

The disclosed cyber threat information processing device is a physical device (2000), a database and a server (2100), and a platform (10000) including a database (2200) and an application programming interface (API) running on the physical device (2000). includes Hereinafter, the platform 10000 will be referred to as a cyber threat intelligence platform (CTIP) or simply an intelligence platform 10000 .

The server 2100 may include an arithmetic unit such as a central processing unit (CPU) or a processor, and may store or read data in the database 2200 .

The server 2100 calculates and processes input security-related data, and executes a file to generate various security events and process related data. In addition, the server 2100 may control input/output of various cyber security-related data and store data processed by the intelligence platform 10000 in the database 2200 .

The server 2100 may include a network device for data input or a network security device. The central processing unit, processor, or arithmetic unit of the server 2100 may perform a framework illustrated in the following drawings or a module within the framework.

The intelligence platform 10000 according to an embodiment provides an application programming interface (API) for processing cyber threat information. For example, the intelligence platform 10000 may receive a file or data input from a network security device connected to a network or cyber malicious behavior prevention programming software that scans and detects malicious behavior.

For example, the intelligence platform 10000 according to the embodiment provides a Security Information and Event Management (SIEM) API that provides a security event, an Environmental Data Retrieval (EDR) API that provides data on an execution environment, and a security defined network traffic. Functions such as a firewall API to monitor and control according to policy can be provided. In addition, the intelligence platform 10000 may also provide a role of an API of an IPS (Intrusion Prevention Systems) that performs a role similar to a firewall between the internal and external networks.

The application programming interface (API) 1100 of the intelligence platform 10000 according to an embodiment may receive files including malicious codes that perform cybersecurity attacks from various client devices 1010, 1020, 1030. there is.

The intelligence platform 10000 according to the embodiment may include a preprocessor (not shown), an analysis framework 1210 , a prediction framework 1220 , an AI engine 1230 , and a postprocessor (not shown).

The preprocessor of the intelligence platform 10000 performs preprocessing to analyze cyber threat information on various files received from the client devices 1010 , 1020 , and 1030 .

For example, the preprocessor may process the received file to obtain various types of meta information including source information of the file, collection information obtained by obtaining the file, and user information of the file from the file. For example, if the file contains a uniform resource locator (URL) or is included in an e-mail, you can obtain information about the file collected. The user information may include user information that is created, uploaded, or finally saved in a file. In the preprocessing process, as meta information of the file, IP (internet protocol) information, country information based on it, and API (Application Programming Interface) key information can be obtained.

The preprocessor (not shown) of the intelligence platform 10000 may extract a hash value of the input file. If the hash value is already known to the cyber threat information processing device, the file type can be identified based on it.

If the file is not already known, the file type is identified by inquiring the hash value and file information on reference Internet sites for cyber threat information such as C-TAS (Cyber Threats Analysis System), CTA (Cyber Threat Alliance) operating system, and VitusTotal. analysis information can be obtained for

As described above, the hash value of the input file may be a hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), and SHA 256.

The analysis framework 1210 may generate analysis information on the malicious code from the input file.

The analysis framework 1210 may include an analysis module according to various analysis methods, such as a static analysis module 1211 , a dynamic analysis module 1213 , an in-depth analysis module 1215 , and a correlation analysis module 1217 .

The static analysis module 1211 may analyze the malicious code-related information on the file itself as the analysis information of the malicious behavior related to the input file.

The dynamic analysis module 1213 may analyze malicious code-related information by performing various actions based on various pieces of information obtained from the input file.

The in-depth analysis module 1215 may analyze malicious code-related information by using information processed on an executable file related to an input file or by performing memory analysis related to an executable file. The in-depth analysis module 1215 may include artificial intelligence analysis to accurately identify malicious behavior.

The correlation analysis module 1217 may include correlation analysis information capable of estimating a correlation to an attack action or an attacker by correlating analysis information that is already stored or generated analysis information in relation to the input file. .

The analysis framework 1210 analyzes the information analyzed from the static analysis module 1211 , the dynamic analysis module 1213 , the in-depth analysis module 1215 , and the correlation analysis module 1217 on the characteristics and behavior of the malicious code. may be combined with each other, and the combined final information may be provided to the user.

For example, the analysis framework 1210 may perform integrated analysis of static analysis information, dynamic analysis information, in-depth analysis information, correlation analysis information, etc. for a single file for accurate attack technique and attacker identification. The analysis framework 1210 removes overlapping portions between analysis information and uses common information between analysis information to increase accuracy.

The analysis framework 1210 may standardize the information provided, for example, by normalizing or enriching cyber threat compromise information (indicator of compromise, IoC) collected through multiple analyzes and paths. work In addition, it is possible to generate analysis information on the final standardized malicious code or malicious behavior.

The static analysis module 1211, the dynamic analysis module 1213, the in-depth analysis module 1215, and the correlation analysis module 1217 of the analysis framework 1210 provide artificial intelligence to the analysis target data to increase the accuracy of the analyzed data. Machine learning or deep learning techniques according to the analysis can be performed.

The AI engine 1230 may perform an artificial intelligence analysis algorithm to generate analysis information of the analysis framework 1210 .

Such information may be stored in the database 2200, and the server 2100 may provide analysis information on malicious code or malicious behavior stored in the database 2200 as cyber threat intelligence information according to a user or client request. .

The prediction framework 1220 may include a plurality of prediction information generation modules according to prediction information, such as a first prediction information generation module 1221 and a second prediction information generation module 1223 . The prediction framework 1220 may generate prediction information about whether a malicious behavior occurs, an attack technique, an attacker group, etc. by using the data set of the various types of information analyzed above in order to increase analysis accuracy.

The prediction framework 1220 predicts malicious behavior related to the input file by performing an artificial intelligence analysis algorithm using the AI engine 1230 based on the data set for the analysis information analyzed by the analysis framework 1210 . information can be created.

The AI engine 1230 generates additional analysis information by learning with artificial intelligence-based machine learning on the data set for the analysis information, and the additionally generated analysis information is again used as input data of artificial intelligence as new learning data. there is.

The prediction information generated by the prediction framework 1220 may include malicious code creator information, malicious code attack method information, malicious code attack group prediction, malicious code similarity prediction information, and malicious code spread prediction information.

As described above, the prediction framework 1220 that generates prediction information related to various malicious codes or attack behaviors may store the generated prediction information in the database 2200 . In addition, the predicted information generated according to the user's request or attack symptoms may be provided to the user.

As described above, the server 2100 may provide cyber threat information related to the input file after post-processing the analysis information or prediction information stored in the database 2200 .

The processor of the server 2100 determines the type of malicious code and the degree of risk of the malicious code based on the generated analysis information or prediction information.

The processor of the server 2100 may generate profiling information about the malicious code. The database 2200 may store a result of performing self-analysis on a file through file analysis or a result of performing additional and predictive analysis.

The cyber threat information provided to the user by the server 2100 includes information on which the described pre-processing has been performed, generated or identified analysis information, generated prediction information, or aggregated information of these information or information determined based on the information. can do.

The provided cyber threat information may include information analyzed or predicted above by using analysis information stored in a database in relation to the input file.

According to an embodiment, when a user inquires not only a malicious action for an input file but also cyber threat information about a previously stored file or a malicious action, information on this may be provided.

Such integrated analysis information may be stored in a standardized format in a server or database corresponding to the corresponding file. Such integrated analysis information may be stored in a standardized format and used to search or inquire about cyber threat information.

11 shows an example for describing in detail a function of a static analysis module in an analysis framework according to an embodiment disclosed herein. An example of a process of performing the static analysis module with reference to this figure is as follows.

As disclosed, the analysis framework 15000 of the intelligence platform 100 may include a static analysis module 15100 .

The static analysis module 15100 can analyze the file itself, and based on the file or meta information of the file, whether there is a coding-based weak item, an interface or function call structure problem, or the file's binary structure, etc. Information that can be related to malicious behavior can be obtained.

The static analysis module 15100 includes a file structure analysis module 15101, a file pattern analysis module 15103, a file production information analysis module 15105, a file environment analysis module 15107, and a file related analysis module 15109 can do.

The file structure analysis module 15101 among the static analysis modules 15100 may analyze basic structure information of the identified file in an environment in which the file is not executed.

The file structure analysis module 15101, for example, even if the file type is different from the file type in ELF (Executable and Linkable Format), PE (Portable Executable), APK (Android Application Package), etc., from the above file structure of the file or its structure Obtain or analyze extractable information.

The file pattern analysis module 15103 can perform pattern analysis of the file, and without taking any action on the identified file, the file itself is opened and extracted by checking several strings that can be extracted to obtain the pattern of the file. can

The file production information analysis module 15105 may obtain and analyze information related to the production of the input file. The file production information analysis module 15105 may obtain unique information or meta information possessed by the file, for example, file creator information, and code signing information in the case of an executable file.

The file environment analysis module 15107 may analyze environment information of the input file. The file environment analysis module 15107 may obtain information such as system environment component information that the target file should have.

The file related analysis module 15109 may also analyze various other meta information related to the input file.

The static analysis module 15100 may convert the static information of the file itself obtained and analyzed without performing the input file into a data format such as JSON (JavaScript Object Notation) and store it in the database 2200 .

The server 2100 may provide static analysis information on a file stored in the database 2200 to the user.

The static analysis module 15100 of the analysis framework 15000 compares the hash value of the input file with the hash value already stored for the malicious code in the database 2200 to determine whether the input file is malicious code. can be analyzed. In addition, the analyzed information on the malicious code of the input file may be stored in the database 2200 .

When the input file is mobile data, the static analysis module 15100 of the analysis framework 15000 may extract code information of the mobile malicious suspicious code from the input file. The code information of the suspected malicious code may include hash information, code size information, file header information, identifiable string information included in the code, operation platform information, and the like.

The static analysis module 15100 of the analysis framework 15000 may detect whether there is a malicious code in the file based on the analyzed analysis information. In addition, static analysis information related to the detected malicious code may be stored in the database 2200 .

12 shows an example for describing in detail the function of the dynamic analysis module in the analysis framework according to the disclosed embodiment. An example of the process of performing the dynamic analysis module with reference to this figure is as follows.

The analysis framework 15000 of the illustrated intelligence platform 10000 may include a dynamic analysis module 15200 . The dynamic analysis module 15200 may acquire dynamic analysis information according to result data executed in an execution environment of a file identified based on at least one of preprocessed file information or static analysis information.

The dynamic analysis module 15200 may detect a weak or dangerous anomaly by analyzing various input/output data in the environment in which the file is being executed or by analyzing the change in interaction with the execution environment when the file is executed. The dynamic analysis module 15200 may analyze whether there is an abnormality by creating a virtual environment, etc., and directly executing a file in the created virtual environment.

The dynamic analysis module 15200 of the analysis framework 15000 includes an environment preparation module 15201, a file execution module 15203, a behavior collection module 15205, an analysis result collection module 15207, and an analysis environment recovery module 15209 ) may be included.

The environment preparation module 15201 creates and prepares a dynamic analysis environment for executing an executable file related to an input file. When the type of the execution file is identified, the environment preparation module 15201 may identify which execution environment is required according to the type of each file. For example, depending on the file, it can be identified whether the file is running on a Windows operating system, a Linux operating system, or a mobile device operating system. The environment preparation module 15201 may prepare the identified environment to execute the executable file.

The file execution module 15203 executes the file to determine whether the executable file contains malicious code in the analysis environment prepared by the environment preparation module 15201 .

The behavior collection module 15205 may collect events occurring in the system during execution of a file executed in the execution environment in order to acquire dynamic analysis information. For example, the behavior collection module 15205 may collect an event for a file itself, a process, a memory, a registry, a system of a network, or an event for changing a setting of each system.

The analysis result collection module 15207 analyzes the events collected by the behavior collection module 15205 individually or by collecting them.

The analysis environment recovery module 15209 restores the environment for dynamic analysis after collecting the collected results.

The dynamic analysis module 15200 may store the obtained result in the database 2200 as dynamic analysis information corresponding to the corresponding file or malicious code of the file.

An example in which the dynamic analysis module 15200 collects and analyzes dynamic analysis information according to the above embodiment is briefly described as follows.

As an embodiment of the dynamic analysis, when the input file is identified as a file operating in the mobile device operating system, the dynamic analysis module 15200 creates an emulator or virtualization environment configured to be the same as the mobile terminal or mobile terminal environment. can do. In addition, the dynamic analysis module 15200 may directly execute the file in the created emulator or virtual environment. The dynamic analysis module 15200 may extract and record all changes that occur in the terminal after the mobile malicious code is executed in the file, that is, behavior information. The behavior information may include event information such as process, file, memory, and network information even when the operating system (OS) environment of the terminal is different.

As another embodiment of the dynamic analysis, the dynamic analysis module 15200 converts the hash value of the file extracted from the terminal without extracting the hash value of the file input in the preprocessing process to the intelligence platform 10000 even if it is extracted from the user terminal. ) can be received through

If the hash value of the file is not already stored in the database 2200, the dynamic analysis module 15200 executes the received file in a virtual or real operating system, collects the actions that occur during execution in real time, and collects the collected dynamic The analysis information may be compared with information already stored in the database 2200 .

If the comparison result exceeds the predefined risk level, it may be determined that the input file contains malicious code, and the dynamic analysis module 15200 may store the hash value of the file corresponding to the malicious code in the database 2200. there is. The stored malicious hash value can be used for static analysis later.

The malicious code communicates with an external server and can issue additional commands and receive files.

However, if the platform and server that can perform dynamic analysis are stopped, such dynamic analysis may take a very long time, and even if the corresponding behavior is blocked in advance, there are cases where dynamic analysis cannot be performed.

When analyzing a network behavior, the dynamic analysis module 15200 according to an embodiment includes a command control server (C&C server) used by malicious code, a download server for downloading additional malicious code, or exchange information between malicious codes or hackers Information such as communication packets exchanging information with and can be extracted and analyzed.

The dynamic analysis module 15200 disclosed herein may perform dynamic analysis even when the server 2100 is stopped.

For example, a network access inducing device (not shown) may process a terminal access request between a client terminal infected with a malicious code and the intelligence platform 10000 or server 2100 to perform dynamic analysis.

The network access inducing device (not shown) may receive an access request from the terminal and transmit it to a C&C server that induces malicious code behavior.

And, if the network access inducing apparatus does not receive a response packet from the C&C server within a predetermined time, the network access inducing apparatus transmits a separate virtual response packet and an access request to the terminal together.

Thereafter, data related to the analysis of the malicious code received from the terminal may be extracted.

For an example of using the virtual response packet, a packet format for creating a virtual response packet TCP session is sufficient. A general Transmission Control Protocol (TCP) protocol used by malicious code may generate a data packet transmitted by the client terminal to create only a TCP session. In addition, important information necessary for dynamic analysis of malicious code may be extracted from the data packet. In this way, even if the management server does not operate, dynamic analysis can be performed using the operation of the network connection inducing device.

13 shows an example for describing in detail the function of the in-depth analysis module among the analysis framework according to the disclosed embodiment. With reference to this figure, the process of performing the in-depth analysis module is exemplified as follows.

The analysis framework 15000 of the intelligence platform 10000 may include an in-depth analysis module 15300 . The in-depth analysis module 15300 may disassemble the executable file including the received file and analyze it at the machine language level to identify an attack technique or attacker that induces a malicious behavior.

The in-depth analysis module 15300 may obtain in-depth analysis information on the basis of the described static analysis or dynamic analysis, or may analyze executable files using files that induce malicious behavior according to the analysis criteria of the analyst.

The in-depth analysis module 15300 may include the analysis information of the file itself or the information of processing the file several times, and may generate the in-depth analysis information based on the already stored information.

In-depth analysis module 15300 also includes in-depth analysis disassembling module 15301, machine language code extraction module 15303, attack behavior (TTP) identification module 15305, attacker identification module 15307, A taint analysis module 15309 may be included.

In the analysis framework 15000, the deep analysis module 15300 performs an artificial intelligence-based machine learning algorithm using the AI engine 1230, and as a result, in-depth analysis information can be obtained.

The disassembling module 15301 disassembles the executable file when the input file includes the executable file.

When an executable file is disassembled, it is converted into a code in a specific format of an object code format, for example, an assembler language format.

The machine language code extraction module 15303 may extract a disassembled code including an OP-CODE (operation code) and an ASM-CODE having a predetermined format. An OP-CODE (operation code) having a certain format refers to an OP-CODE part related to malicious code, and the disassembled code including the extracted OP-CODE refers to a part related to malicious code or malicious behavior.

The machine language code extraction module 15303 may convert the disassembled code into a data format of a certain format. An example of conversion of a certain type of data format is disclosed below.

Attack behavior can be identified by matching the disassembled code of the executable file to the attack behavior details commonly recognized by cyber security expert groups.

The attack behavior (TTP) identification module 15305 may identify an attack behavior, an attack technique, and an attack process based on the extracted disassembled code or data of a format converted into a predetermined format.

The attack behavior (TTP) identification module 15305 identifies the attack behavior by matching the fuzzy hash value based on the disassembled code of the executable file with the detailed elements of the attack behavior commonly recognized by cyber security expert groups. can

The attack behavior (TTP) identification module 15305 is configured to identify the attack behavior (TTP) based on the database 2200 that stores the previously extracted disassembled codes and the matching relationship for each attack behavior (TTP) or an external reference database. can do. Attack behavior (TTP) identification module 15305 performs matching similarity for each attack behavior (TTP) with fuzzy hash values such as CTPH algorithm of disassembled codes extracted using machine learning of AI engine 1230 at high speed. Attack behavior or attack technique can be classified.

The OP-CODE in the disassembled code is a part of the machine language instruction that specifies the operation to be performed, and includes the OP-CODE that induces an attack technique or attack behavior (Terrorist Tactics, Techniques, and Procedures, hereinafter TTP) for cyber security. The disassembled code used in the attack may have very similar values or formats for each attack action. Therefore, by analyzing the disassembled code, which is a combination of the OP-CODE and the ASM-CODE, a specific type of attack can be distinguished.

For example, the TTP identification module 15305 may convert a disassembled code extracted from an executable file into a hash value of a fuzzy hashing method or a context triggered piecewise hashes (CTPH) method.

Algorithms such as Perceptron, Logistic Regression, Support Vector Machines, Multilayer Perceptron, etc. may be used as the machine learning algorithm of the AI engine 1230 performed together with the TTP identification module 15305 . In addition, an ensemble machine learning algorithm or a natural language processing algorithm may be used as the AI engine 1230 . Examples of this are disclosed in detail below.

As an example of a database that stores the attack behavior of a group of security experts, MITER ATT&CK is a database of actual security attack techniques or behaviors. The attack behavior (TTP) identification module 15305 is disassembled including the extracted OP-CODE. It enables the code-converted hash value to be identified as a certain data set format or identifier on the database of MITER ATT&CK.

MITER ATT&CK expresses the vulnerable factors to the attack technique of hackers or malicious codes as a matrix of CVE codes (Common Vulnerabilities and Exposures Codes).

The embodiment identifies a specific attack behavior among various attack behaviors by analyzing the disassembled code, but by matching the identified type of attack behavior with elements of the attack behavior recognized by expert groups, the identification of the attack behavior is professional and It can be expressed as elements that are commonly recognized.

As described above, since OP-CODE is a machine language instruction that induces a specific behavior, the disassembled code of a file that causes the same attack behavior may be very similar. However, since the disassembled code of the file that causes the attack and the disassembled code do not exactly match, there may be some differences in the code.

The attack behavior (TTP) identification module 15305 allows the AI engine 1230 to perform machine learning on the code converted from the extracted disassembled code into a predetermined format. Therefore, even if the OP-CODEs of the files that cause the same malicious behavior are not completely identical, the attack behavior (TTP) identification module 15305 matches the fuzzy hash value based on machine learning and the extracted OP-CODE and the corresponding attack element. In this way, the attack behavior can be identified.

The attack behavior (TTP) identification module 15305 may match the similarity of disassembled codes with an attack technique such as MITER ATT&CK using an AI algorithm to finally detect that the file is a malicious code.

A specific example of this will be described later.

The attacker identification module 15307 may also include identifying an attacker who induces a similar attack behavior using the extracted disassembled code and artificial intelligence-based machine learning results. Similarly, a specific example of attacker identification will be described later.

The taint analysis module 15309 may determine whether there is an attack action through memory analysis of the system at a specific point in time even in the case of fileless malicious code.

The in-depth analysis module 15300 may store in-depth analysis information corresponding to a corresponding file or a malicious code identified from the file in the database 2200 .

14 shows an example for describing in detail the function of the correlation analysis module in the analysis framework according to the disclosed embodiment. With reference to this drawing, the process of performing the correlation analysis module is exemplified as follows.

The analysis framework 15000 of the intelligence platform 10000 may include a correlation analysis module 15400 . The correlation analysis module 15400 generates correlation analysis information so that various types of analysis information analyzed by the analysis framework 15000 are expressed as correlations between attackers or attack techniques based on cyber threat breach information (IoC). do.

The correlation analysis module 15400 is a first correlation analysis module 15401 that analyzes the correlation between the analysis information and the IP information between the attack behavior, and analyzes the correlation between the hostname included in the email or included in the website. A second association analysis module 15403, a third association analysis module 15405 for analyzing the association of URLs, a fourth association analysis module 15407 for analyzing the association of a codesign of a file, It may include a fifth association analysis module 15407 that analyzes associations between attack techniques, and the like.

The modules shown in this figure are only examples, and even if not shown in this figure, the correlation analysis module 15400 includes modules that can analyze various correlations between the attack technique and the information analyzed to determine the attacker. may include For example, the correlation analysis module 15400 may include an integrated analysis module for collecting or integrating the generated correlation information.

The association analysis module 15400 may generate association analysis information used to accurately infer an attack technique or an attacker.

The correlation analysis module 15400 continuously and accumulatively stores analysis information for a received file or malicious code, and then updates the related relationship analysis information again whenever a new file or malicious code is analyzed later in the database 2220 . save to

The correlation analysis module 15400 may obtain cyber threat infringement information based on various analysis information (static analysis information, dynamic analysis information, in-depth analysis information, etc.) analyzed above.

The correlation analysis module 15400 can obtain various types of correlation information that can identify an attack action or an attacker using cyber threat infringement information (IoC), and store the analyzed correlation analysis information in the database 2200 . can

As disclosed above, the analysis framework 15000 of the intelligence platform 10000 may synthesize the analyzed information and store the standardized information in the database 2220 through the process of deduplication, standardization, and enrichment.

The intelligence platform 10000 may store static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information in the database 2200 in a standardized format to update or reproduce cyber threat information.

Here, the intelligence platform 10000 may remove a duplicate part of each analysis information or a duplicate part of the common analysis information, and may perform an enrichment operation of the insufficient part of the data.

The intelligence platform 10000 may store standardized information through post-processing in a format such as STIX or TAXII, which are standards designed to prevent cyber attacks.

The server 2100 may provide standardized cyber threat information such as analysis information generated by the analysis framework 15000 according to a user's inquiry query or service policy. A method of providing cyber threat information will also be described in detail below.

Such cyber threat information may be provided according to a user's request or service.

15 shows an example for explaining in detail the function of the prediction information generation module of the prediction framework according to the disclosed embodiment. An example of the execution process of the prediction framework with reference to this figure is as follows.

The prediction framework 17000 of the illustrated intelligence platform 10000 may include a prediction information generation module 17100 . The prediction information generation module 17100 may include a plurality of information prediction modules according to the generated prediction information. In this example, the prediction information generation module 17100 includes a first information prediction module 1711 , a second information prediction module 1713 , a third information prediction module 1715 , a fourth information prediction module 1717 , and a fifth An example including the information prediction module 1719 is shown.

The prediction framework 17000 may use analysis information generated by the previously exemplified analysis framework (not shown). The prediction framework 17000 may process a data set according to various types of analysis information into an artificial intelligence-based learning data set, and the AI engine 1230 may perform artificial intelligence analysis based on the processed learning data set. .

Through the execution of the prediction framework 17000 and the AI engine 1230, various types of prediction information related to the attack behavior may be generated.

In this example, the first information prediction module 1711 may generate prediction information of a malicious code creator through artificial intelligence learning. The second information prediction module 1713 may generate prediction information of a malicious code attack method, and the third information prediction module 1715 may generate prediction information of a malicious code attack group. In addition, the fourth information prediction module 1717 generates malicious code similarity prediction information, and the fifth information prediction module 1719 generates malicious code spread prediction information.

An example of generation of specific prediction information will be described later.

The prediction framework 17000 may store the generated prediction information in the database 2200 .

For example, the prediction framework 17000 may generate malicious code risk prediction information that predicts the risk of a specific malicious code itself and store it in the database 2200 .

In addition, the prediction framework 17000 may store prediction information of a producer, an attack method, an attack group, similarity, and spread of a specific malicious code in the database 2200 .

As disclosed, the intelligence platform 1000 may generate a malicious code type and a risk level of the malicious code based on analysis information or prediction information. In addition, the intelligence platform 10000 may generate profiling information about the malicious code.

The intelligence platform 10000 may store, in the database 2200 , a result of performing self-analysis on a file through file analysis or a result of performing additional and predictive analysis.

The cyber threat information provided by the intelligence platform 10000 may include information that has been pre-processed, generated analysis information, generated prediction information, or aggregated information of these information, or information that is additionally processed based on this information. can

Therefore, the provided cyber threat information includes integrated analysis related to the input file.

The integrated analysis information provided by the exemplified intelligence platform 10000 may be stored in a standardized format in the database 2200 by the server 2100 in response to an input file. Such integrated analysis information may be stored in a standardized format and used for searching or inquiring cyber threat information.

Hereinafter, detailed embodiments according to each processing step or module are disclosed.

16 illustrates an example of performing static analysis according to the disclosed embodiment. An example of a static analysis method according to an embodiment will be described with reference to the drawings.

As described, the type of file can be identified in the pre-processing stage or in the initial stage of static analysis before performing static analysis. This figure exemplifies a case in which ELF, EXE, and ARK files are identified as types of files for convenience, but application of the embodiment is not limited thereto.

Static analysis or detection of malicious code can be operated based on the characteristics of the file itself as above and the process of comparing it with the previously identified pattern database.

The static information extractor can obtain structure information by parsing the structure of the input file.

A pattern in the structure of the parsed file may be compared with a pattern of malicious code already stored in the database (DB) 2200 .

The structure characteristics and patterns of the parsed file may be meta information of the parsed file.

Although not shown in the example disclosed above, a machine learning engine may also be used in the static analysis of the disclosed embodiment. The database 2200 may store a data set including the learned characteristics of the previously stored malicious code.

The AI engine learns meta information obtained from the corrugated file as above through machine learning, and compares the data set already stored in the database 2200 to determine whether it is a malicious code.

A file analyzed as malicious code through static analysis can be saved back as a data set related to the malicious code, the structural characteristics of the file.

17 illustrates an example of performing dynamic analysis according to the disclosed embodiment. An example of a dynamic analysis method according to an embodiment will be described with reference to the drawings.

As described above, the file type can be identified in the pre-processing stage or in the initial stage of the dynamic analysis before performing the dynamic analysis. Similarly, in this example, ELF, EXE, and ARK files are identified as types of files for convenience.

Through pre-processing, the types of files that are subject to dynamic analysis can be identified. The identified file may be executed in a virtual environment according to the type and type of each file.

For example, if the identified file is an ELF file, it may be executed in the operating system of a Linux virtual machine (VM) through a queue.

An event that occurs when the ELF file is executed may be recorded in an action log.

In this way, Windows, Linux, and mobile operating systems are virtually built for each type of identification file, and then an execution event of the virtual system is recorded.

In addition, execution events of the malicious code already stored in the database 2200 may be compared with recorded execution events. Although not illustrated above, even in the case of dynamic analysis, execution events recorded through machine learning may be learned, and it may be determined whether the learned data is similar to execution events of previously stored malicious code.

For dynamic analysis, you need to build a virtual environment according to the file, which can increase the size of your analysis and detection system.

18 illustrates an example of performing in-depth analysis according to an embodiment disclosed herein. An example of the in-depth analysis method according to the embodiment will be described with reference to the drawings.

As described, the type of file can be identified in the pre-processing stage or in the initial stage of in-depth analysis before performing deep analysis. The disclosed examples illustrate executable binary files in which the identified files are ELF, EXE, and ARK.

If the executable binary file is disassembled, the structure of functions in the instruction set of the CPU (Central Processing Unit) can be analyzed.

Unlike dynamic analysis, in-depth analysis operates based on the code extracted by disassembling the binary file, so it is possible to analyze the system relatively simply. And deep analysis can perform artificial intelligence analysis based on the data created through the process of normalizing the extracted codes without a separate engine.

In this figure, the disassembled code is expressed as a combination of OP-CODE and ASM-CODE.

The embodiment may combine two codes based on the OP-CODE and the ASM-CODE, and extract a meaningful code block from the combined codes.

The code block of disassembled code, including OP-CODE and ASM-CODE, transforms a certain format to identify whether the code is related to malicious code, what kind of malicious code it is, or which attacker developed it. there is.

There are several processes for converting data of a code block to determine this. The data conversion process of the disassembled code may be selectively applied according to the data processing speed and accuracy, but only the normalization process and the vectorization process are indicated in this figure.

A normalization process and a vectorization process may be performed on the extracted code block of the combined code of the OP-CODE and the ASM-CODE.

In other words, after extracting a code block with the combination of OP-CODE and ASM-CODE of binary code, vectorizing the characteristic information of this code block, comparing it with the data learned through various characteristic information, attack behavior, etc. to identify

Since the code blocks extracted as described above may all be different even for the same executable file, the embodiment is a machine learning or artificial intelligence (AI) method in which the extracted code block is determined and classified as malicious code. is available.

And in the embodiment, the final data on which the normalization and vectorization processes are performed is learned through artificial intelligence. The learned data may be compared with an attack technique (TTP) already stored in the database 2200 and data of an attacker or an attack group to obtain information such as whether or not there is a malicious code.

The embodiment can classify and distinguish components that are a core part of malicious code based on the MITER ATT&CK model.

Specific examples thereof are disclosed in more detail below.

19 shows an example of matching an attack technique with codes extracted from a binary code according to the disclosed embodiment. Here, an example of using a standardized model as an example of matching an attack technique is disclosed.

Here, the MITER ATT&CK® Framework is exemplified as a standardized model.

For example, in terms of cyber security, “malicious behavior” is interpreted differently depending on the analyst, and in many cases it is interpreted differently depending on the insight each analyst has.

Internationally, many efforts are being made among experts to standardize “malicious behavior” that occurs on the system and to ensure that everyone can interpret it the same. MITER (https://attack.mitre.org), a non-profit R&D organization that performed national security-related tasks with support from the US federal government, studied the definition of “malicious behavior” and created the ATT&CK® Framework. announced. This framework is defined so that everyone can define the same “malicious behavior” for cyber threats or malware.

MITER ATT&CK® Framework (hereinafter referred to as MITER ATT&CK®) is an abbreviation of Adversarial Tactics, Techniques, and Common Knowledge, which summarizes the latest attack technology information of attackers. MITER ATT&CK® analyzes the attack methods (Tactics) and techniques (Techniques) of the attacker's malicious behaviors after observing actual cyber attack cases to classify and list information on the attack techniques of various attack groups. This is standardized data.

MITER ATT&CK® is a systematization (patterning) of threatening tactics and techniques to improve the detection of advanced attacks by slightly different from the concept of the traditional cyber kill chain. Originally, ATT&CK started by documenting TTP such as methods (Tactics), techniques (Techniques), and procedures (Procedures) for hacking attacks used in corporate environments using Windows operating systems in MITER. Since then, ATT&CK has developed into a framework that can identify the attacker's behavior by mapping the TTP information based on the analysis of the consistent attack behavior pattern generated by the attacker.

The malicious behavior mentioned in the disclosed embodiment can be expressed by matching the malicious code to the attack technique based on a standardized model such as MITER ATT&CK® It can match an identifier.

The example of this figure conceptually shows how the malicious behavior of the malicious code matches the attack technique based on the MITER ATT&CK model.

Executable file EXE may include various functions (Function A, B, C, D, E,…, N,…, Z) that are executed when the file is executed. A function group including at least one of the functions may perform one tactic.

In the example of this figure, functions A, B, and C correspond to tactic A, and functions D, B, and F correspond to tactic B. Similarly, functions Z, R and C correspond to tactic C, and functions K and F correspond to tactic D.

The embodiment may correspond to a set of functions corresponding to each tactic and a specific disassembled code part. The database stores attack identifiers (T-IDs) of attack methods (Tactics), techniques (Techniques), and procedures (TTP) that can correspond to disassembled codes already learned by artificial intelligence.

Attack Identifiers (T-IDs) of Tactics, Techniques, and Procedures (TTP) follow a standardized model, and the example in this figure illustrates MITER ATT&CK® as a standardized model of cyber threat information did.

Accordingly, the embodiment may match the result data extracted from the disassembled code in the binary file with the standardized attack identifier. A more specific way of matching an attack identifier is disclosed below.

20 shows an example of matching an attack technique with a code set including an OP-CODE according to an embodiment disclosed herein.

Most AI engines use a data set learned based on various characteristic information of malicious code to identify malicious code. Then, it is judged whether the malicious code is malicious, but in this way, it is difficult to explain why the malicious code is malicious code. However, as illustrated, if the standardized attack method (TTP) identifier is matched, it is possible to identify what kind of threat the malicious code has. Accordingly, the embodiment can accurately deliver cyber threat information to a security administrator and enable the security administrator to systematically and long-term manage cyber threat information.

When generating a dataset for artificial intelligence learning to identify an attack method (TTP) based on the disassembled code, the embodiment not only distinguishes only the identifier or labeling of the attack method (TTP), but also how to implement the attack method (TTP) The characteristics of what has been done can be reflected as an important factor.

Even if the malicious code implements the same attack method (TTP), it is impossible to generate the same code depending on the developer. That is, the attack method (TTP) technology is in the form of a human oral language, but the implementation method and the code writing method are not the same depending on the developer.

The difference in writing these codes depends on the developer's ability or the way or habits of implementing the program logic, and this difference is expressed as binary code or the difference between disassembled OP-CODE and ASM-CODE.

Therefore, if an attack identifier is simply assigned or matched according to the type of the resulting attack method (TTP), it is difficult to accurately identify an attacker who generates a malicious code or a group of attackers.

Conversely, when modeling is performed by reflecting the characteristics of disassembled OP-CODE and ASM-CODE as important variables, it is possible to identify the developer who developed a specific malicious code or attack tool, or even the tool that automatically creates it.

According to the unique characteristics of the disassembled OP-CODE and ASM-CODE combined code, the disclosed embodiment can generate threat intelligence, which is very important in modern cyber warfare. That is, based on these unique characteristics, the embodiment can identify how the attack code or the malicious code operates, and the contents of who developed the attack code or the malicious code for what purpose.

In the future, based on the characteristic information that the attacker continues to attack, it is possible to supplement the vulnerable system and to enable an active and preemptive response to cyber security threats.

On this concept, the embodiment simply provides completely different results in the method and performance of identifying an attack technique according to an attack result based on the OP-CODE.

The embodiment can generate a data set of disassembled codes based on the combined characteristics of the disassembled OP-CODE and ASM-CODE to accurately identify and classify the coding technique used to implement the attack method (TTP). there is. Modeling to identify unique characteristics from this generated data set makes it possible to identify not only the attack method (TTP) but also the developer's characteristic information, that is, who the developer (or automated production tool) is.

This figure shows an example of matching an OP-CODE data set modeled in the manner described above to an attack identifier.

In this example, it indicates that the first OP-CODE set (OP-CODE set #1) matches the attack technique identifier T1011, and the second OP-CODE set (OP-CODE set #2) matches the attack technique identifier T2013. And the third OP-CODE set (OP-CODE set #3) may match the attack technique identifier T1488, and the Nth OP-CODE set (OP-CODE set #N) matches the arbitrary attack technique identifier T1XXX indicates that The standardized model, MITER ATT&CK®, expresses the identifier of the attack technique in a matrix format for each element, but in the embodiment, an attacker or an attack tool can be additionally identified in addition to the identifier of the attack technique.

Although this drawing is shown as an OP-CODE data set for convenience, identifying an attack technique with a disassembled code data set including OP-CODE and ASM-CODE is more difficult than identifying an attack technique with only OP-CODE data set. It is possible to identify fine-grained attack techniques.

According to an embodiment, by analyzing the combination of the disassembled code data set, not only the attack technique identifier but also the attacker or the attack group may be identified.

Accordingly, the embodiment can provide a more advanced technology in terms of acquiring intelligence information than the existing technology, and can solve problems that have not been solved in the conventional security area.

Fast data processing and algorithms are required to secure accurate intelligence information in the complex environment as above. Hereinafter, additional embodiments related thereto and performance thereof will be disclosed.

21 is a diagram illustrating a flow of processing cyber threat information according to the disclosed embodiment.

A case where the file identified in this figure is an executable binary file of ELF, EXE, and ARK will be described as an example. The processing of this step is related to the in-depth analysis described above.

First, a detailed example of a process of extracting a disassembled code including an OP-CODE code as a first step will be described as follows.

Compiling the source code creates an executable file.

The raw source code is generated as new data in a form suitable for processing by the machine by the compiler in each executable operating system (OS) environment. The newly constructed binary data is in a form that is not suitable for human reading, so it is impossible for a human to understand the internal logic by interpreting the file created in the form of an executable file.

However, the reverse process is performed for vulnerability analysis of the security system and for various purposes, and the interpretation or analysis of machine language is performed. The disassembly process may be performed according to the central processing unit (CPU) of a specific operating system and the number of processing bits (32-bit, 64-bit, etc.).

Disassembled assembly code can be obtained by disassembling each of the illustrated ELF, EXE, and ARK executable files.

The disassembled code may include a code in which an OP-CODE and an ASM-CODE are combined.

The embodiment may extract the OP-CODE and ASM-CODE from the executable file by analyzing the executable file based on the disassembly tool.

The disclosed embodiment does not use the extracted OP-CODE and ASM-CODE as it is, but reconfigures the OP-CODE array by reconfiguring for each function. When the OP-CODE array is rearranged, the data can be reconstructed so that the data can be sufficiently interpreted by including the original binary data. Through this rearrangement, the new combination of OP-CODE and ASM-CODE provides basic data that can identify attackers as well as attack techniques.

A process (ASM) of processing assembly data as a second step will be described in detail as follows.

The assembly data processing process is a process of analyzing the similarity and extracting information based on the data reconstructed into a human or computer-readable form after separating only the OP-CODE and the necessary ASM-CODE.

In this step, the disassembled assembly data may be converted into a certain data format.

Conversion of this data format increases data processing speed and for accurate analysis of data, all of the conversion methods described below may be selectively applied without needing to be applied.

Various functions can be extracted from the assembly data of the rearranged OP-CODE and ASM-CODE combination.

Disassembling one executable file can contain on average about 7,000 to 12,000 functions, depending on the size of the program. Some of these functions are implemented by the programmer as needed, and some are provided by default in the operating system.

If we analyze the actual ASM-CODE, about 87%~91% of the functions are basically provided by the operating system (OS supported), and the ASM-CODE actually implemented by the programmer for the program logic is about 10%. The functions provided by the operating system are functions included in various DLLs and SO files that are basically installed when the operating system is installed along with the function names (default functions). These operating system-provided functions can be already analyzed and stored to be filtered from the analysis target data. By separating only the code to be analyzed in this way, processing speed and performance can be increased.

In the embodiment, in order to accurately perform functional analysis of a program, the OP-CODE may be separated and processed into function units. The embodiment may perform the minimum unit of all semantic analysis based on a function included in the assembly code.

In order to increase analysis performance and processing speed, the embodiment may filter out operator-level functions with inaccurate meaning, and remove functions with an amount of information smaller than a threshold from analysis. Whether or not the functions are filtered may be set differently according to an embodiment.

The embodiment may remove annotation data provided by the disassembler when outputting from the OP-CODE organized according to the function. And the embodiment may rearrange the disassembled code.

For example, the disassembled code output by the disassembler may have the order of [ASM-CODE, OP-CODE, parameter].

The embodiment may remove the parameter data from the assembly data and rearrange or reorganize the disassembled code of the above order in the order of [OP-CODE, ASM-CODE]. The reassembled disassembled code is easy to process by normalizing or vectorizing it. And the processing speed can be significantly increased.

In particular, among disassembled codes having a combination of [OP-CODE, ASM-CODE], the ASM-CODE part has different data lengths, so it is not easy to compare with each other. Therefore, in order to check the uniqueness of the corresponding assembly data, the data can be normalized into a data format of a specific size. For example, the embodiment provides a data set of a specific length, for example, CRC (cyclic redundancy check) data, which is easy to normalize a data part in order to check the uniqueness of the disassembled code of the [OP-CODE, ASM-CODE] combination. can be converted to

As an example, in the disassembled code of [OP-CODE, ASM-CODE] combination, it is also possible to convert the OP-CODE part into CRC data of the first length and the ASM-CODE part into CRC data of the second length, respectively. .

The normalized data converted from OP-CODE and ASM-CODE can maintain the uniqueness of each code before the corresponding conversion, respectively. In order to speed up a similarity determination speed of the normalized data transformed with uniqueness, vectorization may be performed on the normalized data.

As described above, a normalization or vectorization process as a data transformation process may increase data processing speed and selectively apply accurate data analysis.

Detailed examples of the normalization process and the vectorization process are again described in detail below.

As the third step, the process of analyzing data for analyzing the disassembled code will be described in detail as follows.

In this process, conversion of various data formats can be used to increase data processing speed and to accurately analyze data. Some of the conversion methods described below do not need to be applied, but some of them can be selectively applied.

It is a step of analyzing the similarity to malicious code based on the data set for each function in the transformed disassembled code based on the transformed data.

The embodiment may convert vectorized OP-CODE and ASM-CODE data sets back into byte data in order to perform code-to-code similarity.

It is possible to extract a block-unit hash value based on the reconverted byte data and generate a hash value of the entire data based on the block-unit unique value.

The hash value may be compared by extracting a hash value of a unit designated to extract a unique value of each block unit in order to efficiently perform a block unit comparison that is a part of byte data.

A fuzzy hashing technique may be used to extract the hash value of the designated unit and compare the similarity of two or more pieces of data. For example, the embodiment compares the hash value extracted in block units with the hash value of some units of pre-stored malicious codes using the CTPH (Context Triggered Piecewise Hashing) method among fuzzy hashing to determine the similarity. can

In summary, the embodiment is based on the fact that the combination code of OP-CODE and ASM-CODE implements a specific function as a function unit, disassembled code of OP-CODE and ASM-CODE to check the uniqueness of each specific function create a unique value of And based on this unique value, it is possible to perform a similarity operation by extracting a unique value in units of blocks among the OP-CODE and ASM-CODE of the disassembled code.

A detailed example of extracting a block-unit hash value will also be disclosed with reference to the drawings below.

As described above, the embodiment may use a block-unit hash value when performing a similarity operation.

The extracted block-unit hash value is composed of String Data (Byte Data), and String Data (Byte Data) is a numerical value that compares the similarity between codes. If you do a byte comparison of billions of disassembled code data sets, it can be very time consuming to get a single similarity result.

Therefore, according to the embodiment, String Data (Byte Data) can be converted into a numerical value. Based on the numerical value, similarity analysis can be quickly performed using artificial intelligence technology.

The embodiment may vectorize String Data (Byte Data) of the hash value of the extracted block unit based on N-gram data. The embodiment of this figure exemplifies a case in which a block-unit hash value is vectorized into 2-gram data in order to increase the operation speed. However, in the embodiment, it is not necessary to convert the block-unit hash value into 2-gram data, and 3-gram, 4-gram, ... , it is also possible to vectorize and transform N-gram data. In N-gram data, as N increases, the characteristics of the data can be accurately reflected, but the speed of data processing time increases.

As described, byte transformation, hash transformation, and N-gram transformation below can be selectively applied to increase data processing speed and to accurately analyze data.

The illustrated 2-gram transformed data has a maximum of 65,536 dimensions. As the dimension of the training data increases, the distribution of the data becomes sparse, which may adversely affect classification performance. And as the dimension of the training data increases, the time complexity and spatial complexity for learning the data increase.

In order to solve this problem, the embodiment may be processed by various natural language processing algorithms based on various text expressions. In this embodiment, as such an algorithm, a Term Frequency-Inversed Document Frequency (TF-IDF) technique will be described as an example.

As an example for processing the similarity of the learning data in this step, when determining an attack identifier or class (T-ID) from among high-dimensional data, a Term Frequency-Inversed Document (TF-IDF) to select a meaningful feature (pattern) frequency) method can be used. In general, the TF-IDF technique is used to find documents with high similarity in a search engine, and the equations for calculating this are as follows.

는 특정 문서

에서 특정 단어

의 빈도율을 의미하고 그 단어가 반복적으로 나올수록 높은 값을 갖는다. here

is a specific document

specific word in

means the frequency rate of , and the more the word is repeated, the higher the value.

는 특정 단어

를 포함하는 문서

의 비율의 역수 값으로, 단어가 여러 문서에서 흔하게 나타날수록 낮은 값을 갖는다.

is a specific word

documents containing

It is the reciprocal value of the ratio of , with a lower value as the word appears more frequently in multiple documents.

는

와

를 곱한 값으로, 어떤 단어가 어떤 문서에 더 적합한지 수치화시킬 수 있다.

Is

Wow

By multiplying by , it is possible to quantify which word is more suitable for which document.

The TF-IDF method reflects the weight according to the importance of words in the document word matrix as shown in Equation 3 by using the word frequency according to Equation 1 and the inverse document frequency (inverse number specific to the frequency of the document) according to Equation 2 way to do it

In an embodiment, a document including a corresponding word may be inferred as an attack identifier (T-ID) based on a characteristic or pattern of a word in the block unit code. Therefore, if the TF-IDF is calculated for the pattern extracted from the code of the block unit, a pattern that appears frequently within a specific attack identifier (T-ID) or a pattern unrelated to a specific attack identifier (T-ID) is extracted. Branches can remove code.

For example, assuming that the specific pattern A is a pattern expressed in all attack identifiers (T-IDs), the TF-IDF value for the specific pattern A will be measured low. And it can be determined that such a pattern is an unnecessary pattern in order to distinguish an actual attack identifier (T-ID). An algorithm for determining the similarity of natural language, such as TF-IDF, may be performed through learning of a machine learning algorithm.

The embodiment may reduce unnecessary calculations and shorten inference time by removing such unnecessary patterns.

In detail, the embodiment may perform a similarity algorithm based on text representation of various natural language processing on the converted block-unit code data. Through the similarity algorithm, by removing the code of the pattern not related to the attack identifier, the execution of the algorithm performed below and the execution of the classification process according to machine learning can be greatly shortened.

The embodiment may perform classification modeling to classify a pattern of an attack identifier based on a feature or pattern on a code of a block unit. The embodiment may learn whether a vectorized block unit code feature or pattern is a pattern of a known attack identifier, and classify it as an accurate attack technique or implementation method. The embodiment uses various ensemble machine learning models to classify an attacker with an accurate attack implementation method, that is, an attack identifier and an attacker for code determined to have a code pattern similar to malicious code.

Ensemble machine learning models are techniques that generate multiple classification nodes from prepared data and perform accurate predictions by combining the node predictions for each classification node. As described above, ensemble machine learning models that classify the attack implementation method of the word feature or pattern in the block unit code, that is, the attack identifier or the attacker, are performed.

When applying ensemble machine learning models, a threshold value for classification of prepared data can be set to prevent over-detection and false-positive. Only data above the set detection threshold may be classified, and data that does not reach the set detection threshold may not be classified.

As described, the conversion of several data formats can be used to speed up data processing and to accurately analyze the data. Among the data conversion methods described above,

A specific embodiment for applying such ensemble machine learning models will be described in detail below again below.

As the fourth step, the profiling process of identifying an attack technique (TTP) and assigning labeling will be described as follows.

An example of vectorizing through feature extraction of disassembled codes including OP-CODE and ASM-CODE of input binary data based on an already analyzed attack code or malicious code has been described above.

After the vectorized data is learned through machine learning modeling, it is classified into a specific attack technique, and the classified codes are labeled in the profiling process.

Labeling can be largely performed in two parts. One is to attach a unique index to the attack identifier defined in the standardized model, and the other is to write information about the user who wrote the attack code.

Labeling is assigned according to a standardized model, for example, an attack identifier (T-ID) reflected in MITER ATT&CK, so that accurate information can be delivered to the user without additional work.

And the labeling is given to distinguish not only the attack identifier but also the attacker who implemented the attack identifier. Therefore, it is possible to provide not only an attack identifier, but also an attacker and an implementation method accordingly.

In an embodiment, advanced profiling is possible based on data learned from previously classified data sets of disassembled codes (OP-CODE, ASM-CODE, or a combination thereof). In the embodiment, data of the static analysis, dynamic analysis, or association analysis disclosed above may also be utilized as reference data for performing labeling. Therefore, even for a data set that has not been analyzed previously, profiling data can be obtained very quickly and efficiently by considering the results of static, dynamic, and association analysis together.

The process of learning a code having a pattern similar to that of the malicious code in step 3 above and classifying the learned data and profiling the classified data in step 4 can be performed together by an algorithm in machine learning.

A detailed example of this is disclosed below. And an actual example of the profiled data set is also illustrated with reference to the drawings below.

22 is a diagram illustrating values obtained by converting an OP-CODE and an ASM-CODE of a disassembled code into a normalized code as an example of data conversion according to the disclosed embodiment.

As described above, if the executable file is disassembled, the combined data of OP-CODE and ASM-CODE is output.

The embodiment may remove the annotation data output for each function from the disassembled data and change the arrangement order of the OP-CODE, ASM-CODE, and corresponding parameters to facilitate processing.

The reconstructed OP-CODE and ASM-CODE are changed to normalized code data, and the example of this figure exemplifies CRC data as normalized code data.

For example, the OP-CODE may be converted to CRC-16 and the ASM-CODE may be converted to CRC-32.

In the first row of the illustrated table, it is exemplified that the push function of OP-CODE is changed to CRC-16 data of 0x45E9 and 55 of ASM-CODE is changed to CRC-32 data of 0xC9034AF6.

In the second row, the mov function of OP-CODE is changed to CRC-16 data of 0x10E3, and 8B EC of ASM-CODE is changed to CRC-32 data of 0x3012FD2C. In the third row, the lea function of OP-CODE is changed to CRC-16 data of 0xAACE, and 8D 45 0C of ASM-CODE is changed to CRC-32 data of 0x9214A6AA.

In the fourth row, it is an example of changing the push function of OP-CODE to CRC-16 data of 0x45E9 and changing 50 of ASM-CODE to CRC-32 data of 0xB969BE79.

Unlike this example, normalized code data different from CRC data or code data having a different length may be used.

If the disassembled code is changed to a normalized code in this way, it is possible to easily and quickly perform subsequent operations, similarity calculation, and vectorization while securing the uniqueness of each code.

23 is a diagram illustrating vectorized values of OP-CODE and ASM-CODE of disassembled code as an example of data conversion according to the disclosed embodiment.

This figure exemplifies the result of vectorizing the normalized OP-CODE code (CRC-16 according to the above example) and the normalized ASM-CODE (CRC-32 according to the above example), respectively.

A vectorized value of the normalized OP-CODE code (OP-CODE Vector) and a vectorized normalized ASM-CODE code (ASM-CODE Vector) are shown in table format in this figure.

The OP-CODE vector value and the ASM-CODE vector value of each row of this figure correspond to the normalized value of the OP-CODE and the normalized value of the ASM-CODE of each row of FIG. 22, respectively.

For example, vectorized values of CRC data 0x45E9 and 0xB969BE79 of the fourth row of the table of FIG. 22 are 17897 and 185 105 121 44 of the fourth row of the table of this figure, respectively.

When vectorization is performed on the normalized data in this way, the disassembled OP-CODE function and ASM-CODE are changed to vectorized values while each including unique features.

24 is a diagram illustrating an example of converting a block unit of a code into a hash value as an example of data conversion according to the disclosed embodiment.

In order to perform the similarity analysis, the vectorized data set of each OP-CODE and ASM-CODE is reconverted into a byte data format. The reconverted byte data may be converted into a block-unit hash value. And again, based on the hash values of the block unit, a hash value of the entire retransformed byte data is generated.

In the embodiment, hash values such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), and SHA 256 may be used to calculate the reconverted hash value, and a fuzzy hash ( Fuzzy Hash) function can be used.

The first row of the table in this figure represents human-readable characters that may be included in the data. Among the reconverted byte data, a value included in a block unit may include such readable characters.

Each character is the ASCII value (ascii val) of the second line, 97, 98, 99, 100, … It can correspond to ., 48, 49.

Data including character values in the first row can be segmented and separated into blocks that can be summed up as ASCII values.

The third row of the table shows the sum of ASCII values corresponding to each character value within a block unit having 4 characters.

In the case of the first block, it can have a value of 394, which is the ASCII sum of 97, 98, 99, and 100 ASCII values corresponding to the characters in the block.

And the last row shows the case in which the sum of ASCII values in block units is converted to a base 64 representation. The letter K is the sum of the first block.

In this way, a signature called Kaq6KaU can be obtained for that data.

Based on such a signature, it is possible to calculate the degree of similarity for two block unit data.

In this embodiment, a hash value may be calculated with a fuzzy hash function for determining the similarity for block units included in the code among the retransformed byte data, and the similarity may be determined based on the calculated hash values. Although CTPH (Context Triggered Piecewise Hashing) is exemplified as a fuzzy hash function for determining the similarity, it is also possible to use other fuzzy hash functions that can calculate the similarity of data.

25 is a diagram illustrating an example of an ensemble machine learning model according to the disclosed embodiment.

The embodiment may accurately classify an attack identifier (T-ID) of a file determined to be a malicious code by using an ensemble machine learning model.

The hash value of the block unit composed of String Data (Byte Data) is digitized based on N-gram characteristic information, and the similarity is evaluated using a technique such as TF-IDF to determine whether this is an attack identifier (T-ID) or a class to be classified. can be calculated

In order to increase the performance of identifying an attack technique by reducing unnecessary operations, the embodiment may remove unnecessary patterns based on the similarity among the above hash values.

And by modeling data from which unnecessary patterns have been removed through ensemble machine learning, attack identifiers can be classified.

There are methods such as voting, bagging, and boosting as a method of combining the learning results of several classification nodes of an ensemble machine learning model. It can contribute to improving the classification accuracy of

Here, as an example, a method of more accurately classifying an attack identifier will be described by taking the case of applying the random forest method of the bagging method as an example.

The random forest method is a method to generate a large number of decision trees to reduce the classification error by a single decision tree and to obtain a generalized classification result. The embodiment may apply a random forest learning algorithm using at least one decision tree to the prepared data. Here, the prepared data means data from which unnecessary patterns are removed from the fuzzy hash value in units of blocks.

A decision tree model having at least one node is performed to determine the similarity of block-unit hash values. A feature value that can distinguish one or more classes (attack identifier; T-ID) according to the degree of information gain of the decision tree (here, the number of expression of classification patterns based on block-unit hash values) ) can be optimized for comparison.

For this purpose, a decision tree as exemplified in the drawing may be generated.

In this figure, the upper quadrilaterals 2510, 2520, 2530, and 2540 are terminal nodes and mean the conditions for classifying the class, and the lower square parts 2610, 2620, 2630 mean the class classified as terminal nodes. do.

For example, when a random forest model is applied as an ensemble machine learning model, it is a classification model that uses an ensemble technique using one or more decision trees. Various decision trees are constructed by differentiating the characteristics of the input data of the decision tree constituting the random forest model. Classification is performed on several generated decision tree models, and the final classification class is determined using a majority vote technique. The test of each node can be performed in parallel, resulting in high computational efficiency.

When classifying a class, it is possible to set a threshold to prevent over-detection and false-positive, discard values below the lower threshold, and perform classification to data objects above the detection threshold.

26 is a diagram illustrating a flow of learning and classifying data by machine learning according to an embodiment disclosed herein.

The profiling of the input data may include a classification step (S2610) and a learning step (S2620).

In an embodiment, the learning step (S2620) includes (a) hash value extraction process, (b) N-gram pattern extraction process, (c) natural language processing analysis (TF-IDF analysis) process, (d) pattern selection process, (e) ) may include a model learning process, etc.

And in the embodiment, the classification step (S2610) may include (a) a hash value extraction process, (b) an N-gram pattern extraction process, (f) a pattern selection process, (g) a classification process by vectorization, etc. .

A classification step ( S2620 ) among the profiling steps according to an embodiment will be first described as follows.

Receive input data from a set of executables or processed files.

It receives input data from a set of executable files stored in the database or receives input data including an executable file transmitted from the processing process exemplified above. The input data may be data obtained by vectorizing data obtained by converting disassembled codes including OP-CODE and ASM-CODE codes.

A fuzzy hash value is extracted from the disassembled code, which is the input data (a), and N-gram pattern data for a specific function is extracted (b). In this case, 2-gram pattern data including patterns determined to be similar to malicious codes among the existing semantic pattern sets can be selected (f).

The N-gram data of the selected pattern can be converted into vectorized data, and the vectorized data can be classified into a function whose semantic pattern is determined (g).

Among the profiling steps according to an embodiment, the learning step S2610 is performed as follows.

If the input data is a new file, a fuzzy hash value is extracted from the disassembled code that is the input data (a).

The extracted fuzzy hash value is vectorized into N-gram data (2-gram in this example) (b).

Perform natural language processing analysis such as TF-IDF on the extracted specific pattern (c)

A data set with a high similarity is selected among data sets having a pattern related to an existing attack identifier (T-ID) and the rest is filtered (d). In this case, compared with the data sets stored in the existing semantic pattern set, sample data sets including features of some or all of the data sets having a pattern related to an attack identifier (T-ID) may be selected.

Vectorized N-gram data can be trained based on the extracted sample data set (e).

By inputting the vectorized data of N-gram into the classification model, the probability is obtained for each attack identifier (T-ID). For example, the probability that the vectorized data of the N-gram structure is a specific attack identifier (T-ID) T1027 is A%, and the probability that the attack identifier T1055 is (100-A)% can be obtained.

The classification model may use an ensemble machine learning model such as a random forest including at least one decision tree.

(A) Here, it is possible to determine which attack technique or attacker the vectorized N-gram data is based on the classification model.

Labeling is performed by classifying the input data according to the classification result of the classification model (e) or the selection (f) result of the existing stored pattern (g).

The result of the final labeling is exemplified with reference to the following drawings.

27 is a diagram illustrating an example in which an attack identifier and an attacker are labeled by learning and classifying input data according to the disclosed embodiment.

This figure is a diagram showing an attack identifier, an attacker or an attack group, a fuzzy hash value corresponding to an assembly code, and an N-gram corresponding thereto (indicated as 2-gram data here) in tabular form as a result of profiling.

According to an embodiment, when profiling is completed, classified data in relation to the implementation of the following attack method may be obtained.

According to the profiling according to the embodiment, each may be labeled with an attack identifier (T-ID) and an attacker or an attacker group.

Here, the attack identifier (T-ID) may follow the standardized model as described. In this example, the result of giving the attack identifier (T-ID) provided by MITER ATT&CK® is exemplified.

Labeling may also be added to the identified Attacker or Group as described above. This figure shows an example in which the attacker TA504 is identified by the labeling of the attacker or group of attackers.

SHA-256 (size) indicates the fuzzy hash value and data size of the malicious code corresponding to each attack identifier (T-ID) or attacker or group. As described above, such malicious code can respond to the rearrangement and combination of OP-CODE and ASM-CODE.

And the value of the section marked with N-gram is N-gram pattern data corresponding to the attack identifier (T-ID) or the fuzzy hash value of the attacker group and the malicious code, and in this example, it is displayed as a part of the 2-gram data.

As illustrated in this figure, fuzzy hash values of malicious codes (OP-CODE and ASM-CODE) and attack identifiers (T-IDs) or attacker groups corresponding to N-gram pattern data may be labeled and stored.

The illustrated labeled data may be used as reference data for ensemble machine learning, and may be used as reference data for a classification model.

The performance results of the embodiments disclosed below are exemplified.

28 is a diagram illustrating a result of identifying an attack identifier according to an embodiment.

This figure exemplifies the Euclidean Distance Matrix, which may represent the similarity between two data sets.

In this figure, the bright part means that the similarity between the two data sets is low, and the dark part means that the similarity between the two data sets is high.

In this figure, T10XX denotes an attack identifier (T-ID), and characters T, K, and L in parentheses denote an attacker group that wrote an attack technique according to the corresponding attack identifier (T-ID).

That is, the row and column mean the attack identifiers (T-IDs) generated by each attacker group (T, K, L), and the row and column have the same meaning. For example, T1055(K) means the T1055 attack created by the L attackers group, and T1055(K) means the same attack method T1055 created by the K attackers group.

Since the samples of each data set include their own samples, when the distances from other samples are calculated respectively, a distribution with high uniformity is shown in the diagonal direction from the top left to the bottom right.

Referring to this figure, it can be seen that the same attack identifier (T-ID) exhibits similar characteristics even if the attacker groups are different. For example, even if the attack group is T or K, the attack identifier of T1027 may have a high similarity if the attack technique is similar.

Therefore, when learning is conducted based on the extracted data set as in the above embodiment, the characteristics of the same attack technique (T-ID) implemented by the same attacker are clearly identified (the darkest part), and the The same attack technique (T-ID) can confirm that the similarity is high (the middle dark part).

Therefore, if the attack technique is classified by extracting and applying the sample data based on the combination of OP-CODE and ASM-CODE in this way, even if the attacker is different, a specific attack technique or identifier (T-ID) can be reliably classified. can Conversely, through the combination of OP-CODE and ASM-CODE, it is possible to clearly identify the specific code implemented inside the malicious code, as well as identify the attack implementation method including the attacker and the attack identifier.

29 is a diagram illustrating a gram data pattern according to an attack identifier according to an embodiment.

This figure is a diagram illustrating a pattern of gram data when different attack identifiers (T-IDs) are different. For example, if each malicious code including the attack identifiers T1027 and T1055 is converted into 2-gram pattern data and classified according to the embodiment, gram patterns with different attack identifiers (T-IDs) are shown.

That is, according to an embodiment of identifying attack techniques in a malicious code based on a combination of OP-CODE and ASM-CODE, a pattern of gram data may be divided for each attack identifier (T-ID).

This result means that according to the present embodiment, even if the attacker is the same, various attack identifiers (T-IDs) hidden in the malicious code can be clearly identified.

30 is a diagram illustrating performance of an embodiment of processing the disclosed cyber threat information.

This figure exemplifies the performance of the operation speed for classifying an attack identifier or an attacker among the performance of the disclosed embodiment.

The horizontal axis represents the amount of data stored in the database, and the vertical axis represents the time it takes to classify an attack identifier.

While increasing the number of data of fuzzy hash data stored in the database, comparing typical samples by N:1 (N vs. 1), respectively, processing time can increase exponentially according to the number of data. For example, simply comparing the similarity of hash values or fuzzy hash values (expressed as ssdeep) greatly increases the time required depending on the amount of data to be compared.

However, if the decision tree model of the ensemble machine learning model of the embodiment is used, the inference time for classifying an attack identifier or the like does not increase even if the number of data increases.

In other words, the decision tree model that generates the optimized comparison tree has the advantage that the calculation speed is not significantly affected even if the number of data increases because the nodes can be processed in parallel.

31 is a diagram illustrating an example of providing detection names to detection engines of engines that detect cyber threat information.

Various engines in the field of malware detection have been developed to detect and perform cyber threat information. Even if the detection ability of malicious code increases with the increase in artificial intelligence analysis, the effectiveness of such detection ability is very low if the detected malicious code is not properly explained and information is provided.

This figure illustrates famous overseas detection engines 3210 (left) provided by the VirusTotal site and the detection names (right) of the same malicious code provided by each detection engine.

Since identification and delivery of the same malicious code is not performed accurately, it is difficult to identify for what reason the corresponding malicious code was detected. Therefore, it was difficult for the security officer to find a countermeasure for which object to take based on the information, and it was difficult to respond to the risk of security threats.

However, the disclosed embodiment improves versatility and efficiency by providing cyber threat information with a matrix element of an attack identifier provided by a standardized model, such as MITER ATT&CK, and a combination thereof, and providing information on malicious code as a standardized identifier (T-ID). can be very high.

Hereinafter, an example of tracking an attacker and predicting a new attack based on the disclosed embodiment will be described in detail.

32 is a diagram illustrating an example of a new malicious code and an attack method according to an embodiment.

Developers of code tend to use their own customs, such as variable name declaration, function call structure, and parameter call method, when generating code. It is very difficult to completely change these habits because the development of programs is based on the flow of logic and experience.

Based on this basis, the embodiment can track the attacker by using these results on the code as the developer's fingerprint.

When the training data is configured based on the attack identifier (T-ID) of the malicious code, the developer can be specified using the above characteristic information. The disassembled code of the malicious code reflects the unique characteristics or habits of these developers.

In order to implement a specific attack technique, a specific hacker can use his/her own technique that he is not aware of, and as the complexity of the code increases, the possibility of designating a specific developer increases.

In addition, by combining the code blocks of OP-CODE and ASM-CODE for each attack identifier (T-ID), it can be used to detect new or variant malicious codes that are not yet known.

This figure discloses an example of creating a new TTP combination that does not exist through the combination of the disassembled OP-CODE and ASM-CODE according to the embodiment below.

In this example, T1044, T1039, T1211,… , T-N respectively illustrate attack identifiers (T-IDs).

OP-CODEs 1 to N sets corresponding to each attack identifier refer to code sets included in the malicious code of each attack identifier.

As exemplified here, malware is a malicious code that includes a combination of previously known attack identifiers OP-CODE 1 of T1044, OP-CODE2 of T1039, OP-CODE3 of T1211, and OP-CODE 1 of T-N. lets do it. Malware Malware that contains a set of combinations of these OP-CODEs may be known or unknown codes.

In a similar manner, a new attack technique including OP-CODE 3 of T1044, OP-CODEN of T1039, OP-CODE4 of T1211, and OP-CODE 2 of T-N can be found.

Alternatively, new and unknown attack techniques including OP-CODE 4 of T1044, OP-CODE4 of T1039, OP-CODE2 of T1211, and OP-CODE 3 of T-N may be found.

Above, for convenience, an example of finding an attack technique using only the combination of OP-CODE is disclosed. However, if the disassembled code is generated by combining OP-CODE and ASM-CODE, not only can the attack technique be found, but also the attacker or attack group can be identified. .

Similarly, a new code set can be generated through recombination of disassembled codes including OP-CODE and ASM-CODE. In addition to the OP-CODE corresponding to the function of the executable file, the ASM-CODE indicating the target or storage location of the executable file can be reconstructed or a recombined disassembled code can be generated.

By learning this reconstructed disassembled code through machine learning and comparing it with the previously analyzed malicious code, it is possible to predict future attacks beyond identifying a new segmented attack technique and an attacker who creates it.

This combination of new TTP and attack path can create a new attack method of cyber threats or malicious codes that have not existed before. can check whether Whether the code is attackable can be checked through tests such as dynamic analysis.

Accordingly, the embodiment can provide information capable of responding to future security threats through the combination of disassembled code sets, thereby enabling a preemptive response thereto.

For example, based on the combined code, it is possible to generate a code that reflects values such as the frequency of use for each attack technique (TTP) or the probability of success when used.

Alternatively, by learning artificial intelligence, an attack code or malicious code of a new code block combination with a high probability of success can be generated in advance. And by reflecting this information, it is possible to create a pattern that existing security products can respond to, or provide information that can strengthen the security of a vulnerable part of the internal system.

33 is a diagram illustrating another embodiment of a method for processing cyber threat information.

The disassembled code is obtained by disassembling the input executable file, and the disassembled code is reconstructed to obtain the reconstructed disassembled code (S3110).

An example of obtaining and reconfiguring the disassembled code has been described with reference to FIGS. 18 and 21 .

The reconstructed disassembled code is converted into a data set of a predetermined format ( 3120 ).

Examples of converting the reconstructed disassembled code into a data set of a predetermined format are exemplified in FIGS. 18, 21, 22, 23, and 24 .

A similarity is determined based on the converted data set in a certain format, and the cyber threat attack technique included in the executable file is classified into at least one standardized attack identifier according to the determination (S3130).

Examples of similarity determination and classification of attack identifiers in this step have been described with reference to FIGS. 19, 20, 21, 25, 26, 27, and the like.

34 is a diagram illustrating another embodiment of an apparatus for processing cyber threat information.

Another embodiment of the cyber threat information processing apparatus may include a server 2100 including a processor, a database 2200 , and an intelligence platform 10000 .

The intelligence platform 10000 may include an application programming interface 1100, a framework 18000, an analysis and prediction module 18100 that executes various algorithms and execution modules, and an AI engine 1230. there is.

The database 2200 may store previously classified malicious codes or pattern codes of malicious codes.

The processor of the server 2100 disassembles the executable file received from the application programming interface 1100 to obtain the disassembled code, and reconstructs the disassembled code to generate the reconstructed disassembled code. Obtaining the first module 18101 can be performed.

Examples of the execution process of the first module 18101 are illustrated in FIGS. 18, 21, 22, 23, 24, and the like.

In addition, the processor of the server 2100 may perform the second module 18103 for performing a code processing module that converts the reconstructed disassembled code into a data set of a specific format.

Examples of the execution process of the second module 18103 are illustrated in FIGS. 18, 21, 22, 23, and 24 .

The processor of the server 2100 determines whether it is similar to the stored malicious code based on the converted data set of the specific format, and classifies the converted data set of the specific format into at least one standardized attack identifier according to the determination A third module 18105 may be performed.

An example of the process of performing the third module 18105) has been described with reference to FIGS. 19, 20, 21, 25, 26, 27, and the like.

Therefore, according to the disclosed embodiment, it is possible to detect and respond to malicious code that does not exactly match data learned by machine learning, and to respond to a variant of the malicious code.

According to the embodiment, even a variant of the malicious code can identify the malicious code, attack technique, and attacker within a very short time, and furthermore predict the attack technique of a specific attacker in the future.

According to the embodiment, it is possible to accurately identify a cyber attack implementation method based on whether such malicious code exists, an attack technique, an attack identifier, and an attacker, and provide it as a standardized model. According to an embodiment, information on malicious codes in which the names of malicious code detection and the like are not unified or the cyber attack technique is not accurately described may be provided in a normalized and standardized manner.

In addition, it can predict the possibility of generating previously unknown malicious code and the attackers who can develop it, and provide a predictive means of what kind of cyber threat attack there will be in the future.

1010, 1020, 1030: Client
1100: application programming interface
1210, 150000: Analysis Framework
1211, 15100: static analysis module
1213, 15200: dynamic analysis module
1215, 15300: In-depth analysis module
1217,15400: correlation analysis module
1220, 17000: Prediction Framework
1221: first prediction information generating module
1223: second prediction information generation module
1230: AI Engine
2000: physics device
2200: database
2100: Server
2510, 2520, 2530,2540, 2610, 2620,2630 Decision Tree Nodes
10000: Intelligence Platform
15101: file structure analysis module
15103: file pattern analysis module
15105: file production information analysis module
15107: file environment analysis module
15109: File-related analysis module
15201: Environment preparation module
15203: file execution module
15205: behavior collection module
15207: Analysis result collection module
15209: Analysis environment recovery module
15301: disassembly module
15303: Machine language code extraction module
15309: Attack technique identification module
15307: Attacker identification module
15309: Taint analysis module
15401: first association module
15403: second association module
15409: third association module
15407: fourth association module
15409: fifth association module
17100: prediction information generation module
17101: first information prediction module
17103: second information prediction module
17105: third information prediction module
17107: fourth information prediction module
17109: fifth information prediction module
18000: framework
18100: Analysis and Prediction Module
18101, 18103, 18105: first module, second module, third module

Claims (11)

disassembling the input executable to obtain disassembled code and reconstructing the disassembled code to obtain reconstructed disassembled code;
Here, the reconstructed disassembled code includes an OP-CODE (operation code) corresponding to a program implementation function and operands ( assembly code corresponding to operand);
obtaining the reconstructed disassembled code by changing and rearranging the order of the OP-CODE (operation code) and the assembly code;
converting the reconstructed disassembled code into a data set of a specific format;
wherein normalizing the reconstructed disassembled code to data of a first length, vectorizing the normalized data, and converting the vectorized data into a data set of Fuzzy Hashing function values; and
judging whether it is similar to a pre-stored malicious code based on the converted data set, and classifying the converted data set of a specific format into at least one standardized attack identifier according to the determination; by a processor comprising a; How cybersecurity threat information is processed. delete delete The method of claim 1,
The classification step is
determining whether a malicious code is included in the data set of the specific format based on the similarity between the data set of the specific format and the malicious code of a previously identified pattern;
and classifying the included malicious code into one or more standardized attack identifiers by performing ensemble machine learning on the data set of the specific format according to the determination result. 5. The method of claim 4,
The at least one standardized attack identifier is a cyber security threat information processing method according to the classification of MITER ATT&CK. a database for storing classified malicious codes; and
a processor for processing input executable files;
The processor disassembles the input executable file through an application programming interface (API) to obtain a disassembled code, and reconstructs the disassembled code to obtain a reconstructed disassembled code. do,
The processor performs a code processing module that converts the reconstructed disassembled code into a data set of a specific format,
Here, the reconstructed disassembled code includes an OP-CODE (operation code) corresponding to a program implementation function and operands ( assembly code corresponding to operand);
The processor changes and rearranges the order of the OP-CODE (operation code) and the assembly code to obtain the reconstructed disassembled code,
The processor normalizes the reconstructed disassembled code to data of a first length, vectorizes the normalized data, converts the vectorized data into a data set of fuzzy hashing function values, and the transform determining whether it is similar to a previously stored malicious code based on the data set and performing a classification module for classifying the converted data set of a specific format into at least one standardized attack identifier according to the determination; Cybersecurity threat intelligence processing unit. delete delete 7. The method of claim 6,
The classification module is
Based on the similarity between the data set of the specific format and the stored malicious code, it is determined whether a malicious code is included in the data set of the specific format, and ensemble machine learning is performed on the converted data set of the specific format according to the determination result A cyber security threat information processing device for classifying the included malicious code into at least one standardized attack identifier by performing 10. The method of claim 9,
The at least one standardized attack identifier is a cyber security threat information processing device according to the classification of MITER ATT&CK. disassemble the input executable to obtain disassembled code and reconstruct the disassembled code to obtain reconstructed disassembled code,
Here, the reconstructed disassembled code includes an OP-CODE (operation code) corresponding to a program implementation function and operands ( assembly code corresponding to operand);
obtaining the reconstructed disassembled code by changing and rearranging the order of the OP-CODE (operation code) and the assembly code;
converting the reconstructed disassembled code into a data set of a specific format;
wherein normalizing the reconstructed disassembled code to data of a first length, vectorizing the normalized data, and converting the vectorized data into a data set of Fuzzy Hashing function values; and
determining whether it is similar to a pre-stored malicious code based on the converted data set and classifying the converted data set of a specific format into at least one standardized attack identifier according to the determination; A computer readable storage medium storing a program for processing cybersecurity threat information.

Images