KR102061833B1 - Apparatus and method for investigating cyber incidents - Google Patents

Abstract

The cyber infringement investigation apparatus according to an embodiment of the present invention includes a communication interface for receiving survey data, survey network information, and investigation clue information, a memory for storing a predetermined program, and a processor for performing cyber infringement investigation according to the program. The program may include collecting and collecting data related to the survey clue information among the surveyed data and the surveyed network information according to predetermined criteria, calculating the risk exposure indicator according to the attribute according to the data, and for the predetermined threshold. Determine the damage level for each node based on whether the hazard indicators are exceeded, set each node to one or more groups according to the damage level, display the coverage for each group, and for the nodes that fall under the coverage. Obtain additional information, set the scope of the investigation to damage, It is configured to generate a report of a node corresponding to the range.

Description

Apparatus and Method for Investigating Cyber Breach Incidents {APPARATUS AND METHOD FOR INVESTIGATING CYBER INCIDENTS}

The present invention relates to a technology for performing investigations on cyber infringement accidents, and more particularly, to a technology for calculating a damage range according to an accident when a cyber infringement accident occurs.

Recently, intelligent cyber attacks show a different dimension from existing cyber attacks in various aspects such as attack purpose, attack method, and duration of attack, and are not only a big threat to public institutions and major social infrastructure, Users are concerned about corporate confidentiality and privacy infringement.

However, until now, it is difficult to identify the cause of the accident in a timely manner and to identify the damage caused by the accident because it is not equipped with a system and manpower to prepare for when the cyber infringement occurred due to such an attack. There is this.

In the event of a cyber infringement, one of the most necessary information for the organization is information about the extent and extent of the damage, such as whether information leakage has occurred, what information has been leaked, and how much the system has been damaged. Nevertheless, in reality, these contents are manually investigated and statistics are reported.

However, since the proposed methods do not suggest the scope of investigation or estimate the extent of damage due to cyber infringement incidents, the data collected by network experts based on the collection and analysis tools are actually used for the analysis of cyber infringement incidents. We've been exploring each one, looking for suspicious situations, identifying the cause, and identifying the affected system. This is not only costly in terms of manpower and time, but also has a problem in that errors are likely to occur in the result due to an unstructured method in the method or calculation criteria.

The problem to be solved of the present invention is to provide a cyber infringement incident investigation apparatus and method for investigating a cyber infringement incident to calculate the extent and scale of the damage.

According to an aspect of the present invention, a communication interface for receiving survey object data, survey object network information, and survey clue information; A memory for storing a predetermined program; And a processor configured to perform a cyber infringement investigation according to the program, wherein the program selects and collects data related to the investigation clue information among the investigation target data and the investigation target network information according to a predetermined criterion, The risk exposure index is calculated according to the attribute according to the data, the damage level for each node is determined according to whether the risk exposure index is exceeded for a predetermined threshold, and each node is set to one or more groups according to the damage level. Display a survey range corresponding to each group, obtain additional information on the nodes corresponding to the survey range, set the survey range as the damage range, and report data on the nodes corresponding to the damage range. There is provided a cyber infringement investigation apparatus, which is configured to generate.

The program may be configured to arbitrarily add or remove each node to a survey range, display a user interface for changing a connection relationship between nodes, and change the survey range according to a user input through the user interface.

The user interface may be a user interface for creating a new damage level or moving a node included in one damage level to another damage level.

The program may be configured to display a single closed curve connecting the nodes between the nodes according to a path through which data is transmitted and received between the nodes, and including a node corresponding to the irradiation range.

The program may be configured to mode sum the product of the attribute and a preset weight for each attribute to calculate the risk exposure indicator.

After receiving the additional information, if the user receives an input for continuing the investigation, excludes data that does not correspond to cyber infringement from the seed data, changes the weight or damage level, and sets new seed data according to the user input. The survey scope may be reset by performing one or more of the above and recalculating the risk exposure indicators.

According to another aspect of the present invention, a method for investigating cyber infringement by the cyber infringement investigation apparatus, the method comprising the steps of: receiving the investigation target data, the investigation target network information and the investigation clue information; Selecting and collecting data related to the survey clue information from the survey target data and the survey target network information according to a predetermined criterion; Calculating a risk exposure indicator according to an attribute according to the data; Determining a damage level for each node according to whether the risk exposure indicator is exceeded for a predetermined threshold; Setting each node to at least one group according to the damage level, and displaying an irradiation range corresponding to each group; Obtaining additional information about a node corresponding to the survey range; A cyber infringement investigation method is provided, comprising: setting the investigation range to a damage range, and generating report data for a node corresponding to the damage range.

The cyber breach investigation method may further include adding or removing each node to an investigation range and displaying a user interface for changing a connection relationship between nodes; And changing the survey range according to a user input through the user interface.

The user interface may be a user interface for generating a new damage level or moving a node included in one damage level to another damage level.

The step of setting each node to one or more groups according to the damage level, and displaying the irradiation range corresponding to each group, connecting the nodes between the nodes by a connection line according to the path of the data transmission and reception between the nodes, the irradiation range It may be a step of displaying a single closed curve to include a node corresponding to.

The calculating of the risk exposure indicator according to the attribute according to the data may be a step of calculating the risk exposure indicator by mode sum of a product of the attribute and a preset weight for each attribute.

The cyber infringement investigation method excludes data that does not correspond to cyber infringement from the seed data, and changes the weight or damage level according to the user input when the user receives an input for instructing the investigation to continue after obtaining the additional information. And resetting the survey range by performing one or more of setting new seed data and recalculating the risk exposure indicator.

According to an embodiment of the present invention, a non-expert investigator may have an intuitive information provided by the device to determine a more accurate cause of the accident and whether or not to infringe.

According to an embodiment of the present invention, it is possible to reduce costs such as manpower and time for investigating cyber infringement incidents.

According to one embodiment of the present invention, it is possible to increase the confidence in the investigation and damage results by providing a systematic method for the cyber infringement incident investigation and a systematic calculation criteria for damage.

1 is a block diagram illustrating a cyber infringement investigation apparatus according to an embodiment of the present invention.
2 is a flowchart illustrating a process of performing a cyber infringement investigation by the cyber infringement investigation apparatus according to an embodiment of the present invention.
3 is a diagram illustrating a screen in which a cyber infringement investigation apparatus according to an embodiment of the present invention presents an investigation range.

The present invention may be variously modified and have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals (eg, first, second, etc.) used in the description process of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, in the present specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that, unless there is an opposite substrate, it may be connected or connected via another component in the middle.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, the same reference numerals will be used for the same means regardless of the reference numerals in order to facilitate the overall understanding.

1 is a block diagram illustrating a cyber infringement investigation apparatus according to an embodiment of the present invention.

Referring to FIG. 1, a cyber infringement investigation apparatus according to an embodiment of the present invention may include a communication interface 110, a processor 120, a memory 130, a storage 140, a display 150, and an input interface 160. It includes.

The communication interface 110 receives, as an input, survey target data, survey target network information, and survey clue information of a domain to be surveyed through an external device or a communication network according to a predetermined protocol. Here, the data to be investigated can be collected for all incident investigation such as network packet, security equipment log, system log, malicious file information, Internet Protocol address (IP address) and Uniform Resource Locator (URL) information of each packet origination or destination. Means data. The network information to be investigated is information that can grasp the internal structure and current status of the research institute, and means information that can identify the network topology, system name, IP address of each system, and physical connectivity between systems. Investigation lead information is information input by an investigator to start an investigation, and may be an IP address, a URI, malware information, or time information.

The processor 120 performs a cyber infringement investigation according to a program stored in the memory 130 to calculate a damage range and magnitude.

The memory 130 loads a program that performs a cyber infringement investigation to calculate a damage range and magnitude, and provides the program to the processor 120. The memory 130 may be a volatile memory such as a random access memory.

The storage 140 may store a program, and the memory 130 may load a program stored in the storage 140. The storage 140 may be a nonvolatile storage medium such as a hard disk or a flash memory.

The display 150 displays the extent and magnitude of the damage caused by the cyber infringement calculated by the processor 120. In addition, the display 150 outputs a user interface for receiving input required for cyber infringement investigation from the user.

The input interface 160 receives a user's input. The input interface 160 may be a known type of input device such as a keyboard or a mouse.

2 is a flowchart illustrating a process of performing a cyber infringement investigation by the cyber infringement investigation apparatus according to an embodiment of the present invention, Figure 3 is a cyber infringement investigation apparatus according to an embodiment of the present invention showing the scope of investigation The figure illustrates a screen. Each process described below is a process performed through each functional unit constituting the cyber infringement investigation apparatus or collectively referred to as the cyber infringement investigation apparatus for the concise and clear explanation of the invention, the signal transmission process between each functional unit, etc. A description of the general process of the description will be omitted.

Referring to FIG. 2, in step 210, the cyber infringement investigation apparatus receives the investigation target data, the investigation target network information, and the investigation clue information.

In operation 220, the cyber breach investigation apparatus performs attack scenario modeling and data collection. For example, the cyber infringement investigation apparatus sets the investigation target data as seed data and models an attack scenario according to a known method previously specified for the seed data. The cyber infringement investigation apparatus collects session data, transaction data, and packet data including a specific IP address or URL, collects all data transmitted or received within a specific time, and collects files including specific malicious code, Among the network information to be surveyed, data that is considered to be related to the survey clue information is collected and collected according to predetermined criteria. In this case, the cyber infringement investigation apparatus may store data selection criteria corresponding to each of the plurality of attack scenarios in advance, and select some of the investigation target information and the investigation target network information according to the data selection criteria corresponding to the modeled attack scenario. Can be.

In operation 230, the cyber breach investigation apparatus calculates a risk exposure index for each node. For example, the cyber infringement investigation apparatus uses the collected data and the input information to determine the importance of the nodes (eg, each node) according to the structural analysis through grasping the flow of proximity between the nodes and information (information based on malicious information and behavior). The importance can be set according to predefined criteria such as the role of the server, the number of connections by other nodes, and whether it is connected to a pre-designated major server. The risk exposure index for each node is calculated as shown in Equation 1 below by classifying the clue information and reflecting the result of the node analysis through the classification). At this time, the node refers to a single system or a device constituting each system.

[Equation 1]

Where,

Where A is a set of attributes reflected in the risk exposure indicator calculation and W is a set of weights corresponding to each element of A. The attributes reflected in the risk exposure indicator calculation are based on the pre-established criteria such as the importance of the nodes according to the structural analysis through the analysis of the proximity of the nodes and the flow of information (information based on malicious information and behaviors). It can be calculated according to.

In operation 240, the cyber breach investigation apparatus determines the damage level for each node according to the risk exposure index for each node. For example, the cyber infringement investigation apparatus may determine the damage level for each node according to whether the risk exposure indicator is exceeded for a predetermined threshold corresponding to each damage level.

In operation 250, the cyber infringement investigation apparatus sets each node into one or more groups according to the damage level, and proposes a survey range corresponding to each group to the user. In this case, the irradiation range may be previously designated for each damage level, and the cyber infringement investigation apparatus may display an irradiation range corresponding to each damage level. In addition, the cyber infringement investigation apparatus may display the investigation priority of each node in the order of the high risk exposure index within each investigation range. At this time, the research priority means the order in which the research proceeds. Referring to FIG. 3, the cyber infringement investigation apparatus may map nodes of the entire system including the victim to be connected by a connection line, and display each investigation range as a single closed curve to include nodes corresponding to the investigation range. . That is, the cyber infringement investigation apparatus displays a single closed curve including four nodes as the irradiation range according to the first damage level, such as 310, and displays a single closed curve including eleven nodes as the irradiation range according to the second damage level. can do. The cyber infringement investigation apparatus may express the proximity between systems and the flow of information (paths through which data is transmitted and received) between systems through connection lines between nodes. In addition, the cyber infringement investigation apparatus may display the risk exposure level for each node by differently displaying the color of each node such as gradation according to the risk exposure level or by displaying the size of each node differently.

In addition, the cyber infringement investigation apparatus arbitrarily adds or removes nodes to the scope of investigation, edits the connection lines between nodes to change the connection relationship between nodes, creates new damage levels, or moves nodes included in one damage level to other damage levels. A user interface for editing such as moving can be displayed, and the survey range can be modified according to a user's input to the user interface.

In operation 260, the cyber infringement investigation apparatus obtains additional information through data search and analysis related to the infringement incident using a known investigation function such as timeline analysis, content analysis, and association analysis. At this time, the cyber infringement investigation apparatus displays additional information.

In operation 270, the cyber infringement investigation apparatus receives an investigation completion selection input for selecting whether to terminate the cyber infringement investigation. At this time, the user may make a survey completion selection input for confirming additional information to complete the survey or to continue the survey.

If the investigation completion selection input in step 270 is an input for commanding the investigation completion, in step 280, the cyber infringement investigation apparatus determines the damage range of the current investigation range, and reports the report data including the information of each node corresponding to the damage range. Create

In step 270, if the investigation completed selection input is an input for instructing the investigation to continue, in step 290, the cyber infringement investigation apparatus excludes data that does not correspond to cyber infringement from the user from the seed data to correct an error, weight or You can receive input to change the damage level and input to set new seed data. Thereafter, the cyber infringement investigation apparatus performs the process from step 220 again.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art to which the present invention pertains without departing from the spirit and scope of the present invention as set forth in the claims below It will be appreciated that modifications and variations can be made.

Claims (12)

A communication interface for receiving survey data, survey network information, and survey clue information;
A memory for storing a predetermined program; And
Including a processor for performing a cyber infringement investigation in accordance with the program,
The program,
Selecting and collecting data related to the survey clue information from the survey target data and the survey target network information according to a predetermined criterion;
Calculating a risk exposure indicator according to the attributes of the collected data,
Determine the damage level for each node according to whether the risk exposure indicator is exceeded for a predetermined threshold,
Set each node to one or more groups according to the damage level, display a survey range corresponding to each group,
Obtaining additional information about a node corresponding to the survey range,
Set the investigation range to a damage range, and generate report data for a node corresponding to the damage range;
The attributes of the collected data include numerical values according to predetermined criteria corresponding to node importance, clue finding, or risk of clue according to structural analysis through grasping flow of information.
And a weight corresponding to each of the numerical values is determined.
According to claim 1,
The program,
Display a user interface for arbitrarily adding or removing each said node to a survey range, changing the connection relationship between the nodes,
The cyber infringement investigation apparatus, characterized in that configured to change the investigation range in accordance with a user input through the user interface.
The method of claim 2,
And the user interface is a user interface for generating a new damage level or moving a node included in one damage level to another damage level.
According to claim 1,
The program,
Connecting the nodes between the nodes according to a path through which data is transmitted and received between the nodes;
And a single closed curve for displaying a node corresponding to the survey range.
According to claim 1,
The program,
And summing the product of the attribute and a preset weight for each attribute to calculate the risk exposure indicator.
The method of claim 5,
The program,
After receiving the additional information, if the user receives an input for continuing the investigation, excludes data that does not correspond to cyber infringement from the seed data, changes the weight or damage level, and sets new seed data according to the user input. And conducting at least one of the at least one risk exposure indicator and resetting the survey range.
In the way that the cyber infringement investigation device investigates cyber infringement,
Receiving survey data, survey network information, and survey clue information;
Selecting and collecting data related to the survey clue information from the survey target data and the survey target network information according to a predetermined criterion;
Calculating a risk exposure indicator according to an attribute according to the data;
Determining a damage level for each node according to whether the risk exposure indicator is exceeded for a predetermined threshold;
Setting each node to at least one group according to the damage level, and displaying an irradiation range corresponding to each group;
Obtaining additional information about a node corresponding to the survey range;
Setting the survey range to a damage range and generating report data on a node corresponding to the damage range;
The attributes of the collected data include numerical values according to predetermined criteria corresponding to node importance, clue finding, or risk of clue according to structural analysis through grasping flow of information.
And a weight corresponding to each of the numerical values is determined.
delete delete delete delete delete

Images