KR20160089800A - Apparatus and method for investigating cyber incidents - Google Patents

Abstract

A cyber infringement investigation apparatus according to an embodiment of the present invention includes a communication interface for receiving survey target data, survey target network information and survey cue information, a memory for storing a predetermined program, and a processor for performing a cyber infringement survey according to the program The program collects the data related to the investigation cue information among the survey target data and the survey target network information according to predetermined criteria and calculates the risk exposure index according to the data according to the data, The damage level for each node is determined according to whether the risk exposure index is exceeded, each node is set as one or more groups according to the damage level, the corresponding investigation range is displayed for each group, Obtain additional information, set the scope of investigation to the extent of the damage, It is configured to generate a report of a node corresponding to the range.

Description

[0001] APPARATUS AND METHOD FOR INVESTIGATING CYBER INCIDENTS [0002]

TECHNICAL FIELD The present invention relates to a technique for conducting an investigation of a cyber-infringement accident, and more particularly, to a technique for calculating a range of a damage caused by an accident when a cyber-infringement occurs.

Recent intelligent cyber attacks are not only a serious threat to public institutions and major social infrastructures, but also show different aspects from the existing cyber attacks in terms of attack purpose, attack method and attack period. And provides users with concerns about corporate confidential information and personal information infringement.

However, until now, there has been no system or manpower to prepare for the cyber-infringement accident due to such an attack. Therefore, it is difficult to identify the cause of the accident in a timely manner, .

One of the most needed information for an organization in the event of a cyber-infringement is information on the extent and extent of damage, such as whether information leakage has occurred, what information has been leaked, how much damage has been done to the system In reality, however, such information is hand-picked, and statistics are reported and reported.

However, the proposed methods do not propose a scope of investigation due to a cyber-infringement accident or suggest a method of calculating the extent of the damage. Therefore, in order to actually analyze the cyber-infringement incident, the network experts collect data As well as checking the suspicious situation, identifying the cause, and checking the damaged system. This is not only costly in terms of manpower and time, but also has a problem in that the method is inconvenient in terms of methods and calculation methods, resulting in errors in the results.

A problem to be solved by the present invention is to provide a cyber-infringement accident investigation apparatus and method for estimating a scope and scale of a cyber-infestation accident.

According to an aspect of the present invention, there is provided a communication system, comprising: a communication interface for receiving survey target data, survey target network information, and survey cue information; A memory for storing a predetermined program; And a processor for performing a cyber infringement investigation according to the program, wherein the program collects data related to the inquiry clue information among the survey object data and the survey object network information according to a predetermined criterion, Determining a damage level for each node according to whether the risk exposure index is exceeded for a predetermined threshold, and setting each node as one or more groups according to the damage level And the additional information is acquired for the node corresponding to the investigation range, the investigation range is set to the range of damage, and the report data for the node corresponding to the damage range is displayed The cyber infringement examination apparatus comprising:

The program may be configured to display a user interface that arbitrarily adds or removes each of the nodes to the survey range, changes the connection relationship between the nodes, and changes the survey range according to user input through the user interface.

The user interface may be a user interface for creating a new damage level or moving a node included in a damage level to another damage level.

The program may be configured to display a single closed curve connecting a node between the nodes according to a path through which the inter-node data is transmitted and received, and including a node corresponding to the survey range.

The program may be configured to calculate the risk exposure index by adding a mode of a product of the attribute and a predetermined weight to each attribute.

If the user inputs an instruction to continue the investigation after obtaining the additional information, data not corresponding to the cyber infringement is excluded from the seed data, the weight or the damage level is changed, and the new seed data is set , And re-calculating the risk exposure index to reset the survey range.

According to another aspect of the present invention, there is provided a cyber infringement investigation apparatus for examining a cyber infestation, comprising: inputting survey target data, survey target network information and survey cue information; Collecting data related to the survey cue information among the survey subject data and the survey subject network information according to predetermined criteria; Calculating a risk exposure index according to the attribute according to the data; Determining a damage level for each node according to whether the risk exposure index is exceeded for a predetermined threshold value; Setting each node as one or more groups according to the damage level, and displaying an irradiation range corresponding to each group; Obtaining additional information for a node corresponding to the survey range; Setting a range of the investigation range to a range of damage, and generating report data for a node corresponding to the range of damage.

The cyber infringement investigation method comprising the steps of: displaying a user interface for arbitrarily adding or removing each of the nodes to an investigation range and changing a connection relationship between the nodes; And changing the survey range according to user input through the user interface.

The user interface may be a user interface for creating a new damage level or moving a node included in a damage level to another damage level.

Wherein the step of setting each node as one or more groups according to the damage level and displaying an investigation range corresponding to each group comprises connecting the nodes through a connection line according to a path through which the inter-node data is transmitted and received, A single closed curve that includes the corresponding node.

The step of calculating the risk exposure index according to the attribute according to the data may be a step of calculating the risk exposure index by combining the attribute and the product of the predetermined weight for each attribute.

In the cyber infringement investigation method, when the user inputs an instruction to continue the investigation after obtaining the additional information, data not corresponding to the cyber infringement is excluded from the seed data according to the user input, the weight or the damage level is changed And setting new seed data, and re-calculating the risk exposure index to reset the survey range.

According to an embodiment of the present invention, a non-specialist inspector can intuitively know the information provided by the device, thereby determining the cause of the accident and the extent and extent of the infringement.

According to the embodiment of the present invention, it is possible to reduce costs such as manpower and time for investigating a cyber-infringement accident.

According to one embodiment of the present invention, a systematic method for investigating cyber-infringement incidents and a systematic estimation criterion for damage can be provided to increase trust in investigation and damage results.

1 is a block diagram illustrating a cyber-infringement investigation apparatus according to an embodiment of the present invention;
2 is a flowchart illustrating a cyber infringement investigation apparatus performing cyber infringement investigation according to an embodiment of the present invention.
3 is a view illustrating a screen in which a cyber infringement investigation apparatus according to an embodiment of the present invention presents survey ranges;

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, detailed description of known related arts will be omitted when it is determined that the gist of the present invention may be unnecessarily obscured. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate a thorough understanding of the present invention, the same reference numerals are used for the same means regardless of the number of the drawings.

1 is a block diagram illustrating a cyber-infringement investigation apparatus according to an embodiment of the present invention.

1, a cyber-infringement investigation apparatus according to an exemplary embodiment of the present invention includes a communication interface 110, a processor 120, a memory 130, a storage 140, a display 150, and an input interface 160, .

The communication interface 110 receives survey target data, survey target network information of the survey target domain, and survey cue information through an external device or a communication network according to a predetermined protocol. Here, the data to be researched includes all network packet, security device log, system log, malicious file information, IP address (Internet Protocol address) and URL (Uniform Resource Locator) Data. The surveyed network information is information that can grasp the internal network structure and status of the surveying organization, and is information that can identify the network topology, the system name, the IP address of each system, and the physical connectivity between the systems. The investigation clue information may be an IP address, URI, malicious code information, time information, etc., which the investigator inputs to start the investigation.

The processor 120 performs a cyber infringement investigation according to a program stored in the memory 130 to estimate the extent and scale of the damage.

The memory 130 performs a cyber infringement investigation to load a program for calculating a damage range and a scale, and provides the program to the processor 120. The memory 130 may be a volatile memory such as a random access memory.

The storage 140 may store a program, and the memory 130 may load a program stored in the storage 140. The storage 140 may be a non-volatile storage medium such as a hard disk, flash memory, or the like.

The display 150 displays the extent and scale of the damage due to the cyber infestation estimated by the processor 120. In addition, the display 150 outputs a user interface for receiving input necessary for cyber infringement investigation from the user.

The input interface 160 receives input from the user. The input interface 160 may be an input device of a known type such as a keyboard, a mouse, and the like.

FIG. 2 is a flowchart illustrating a cyber-infringement investigation apparatus according to an exemplary embodiment of the present invention. FIG. 3 is a flowchart illustrating a cyber-infringement investigation apparatus according to an exemplary embodiment of the present invention. Fig. Each process described below is referred to as a cyber-infringement investigation device for the purpose of briefly and clearly explaining the process or the invention performed through each functional unit constituting the cyber-infringement investigation apparatus, and the signal transmission process between each functional unit A description of a general process of the present invention will be omitted.

Referring to Fig. 2, in step 210, the cyber-infringement inspection apparatus receives survey target data, survey target network information, and survey cue information.

In operation 220, the cyber infringement survey apparatus performs attack scenario modeling and data collection. For example, the cyber infringement investigation apparatus sets the data to be searched as seed data, and models the attack scenario according to a known method predetermined for the seed data. The cyber-infringement investigation apparatus collects session data, transaction data, and packet data containing a specific IP address or URL, collects all data generated or transmitted within a specific time, collects files containing specific malicious code, Data that are considered to be related to the research clue information among the network information to be surveyed are selected and collected according to predetermined criteria. At this time, the cyber infringement investigation apparatus can previously store data selection criteria corresponding to each of the plurality of attack scenarios, and selects a part of the investigation subject information and the subject network information according to a data selection criterion corresponding to the modeled attack scenario .

In step 230, the cyber infringement survey apparatus calculates a risk exposure index for each node. For example, the cyber-infringement investigation apparatus can detect the importance of a node according to the structure analysis through the gathering of data and input information, the proximity among nodes, the flow of information (information based on malicious information and behavior) , The number of times of connection by other nodes, whether or not it is connected to a predetermined main server, etc.), whether or not the clue is found, the risk of the clue The risk information of each research cue information may be set according to the classification, and the node analysis result is calculated as shown in Equation (1) below. At this time, the node refers to a single system or a device constituting each system.

[Equation 1]

Where,

Where A is the set of attributes that are reflected in the risk-exposition calculation, and W is the set of weights corresponding to each element of A. The attributes that are reflected in the risk index calculation include the importance of nodes due to structure analysis through analysis of the adjacency between nodes and information (information based on malicious information and behavior), the occurrence of event clues, and the risk of clues It can be a numerical value calculated according to.

In step 240, the cyber infringement investigation apparatus determines the damage level for each node according to the risk exposure index for each node. For example, the cyber-infringement investigation apparatus can determine a damage level for each node according to whether the risk exposure index is exceeded for a predetermined threshold corresponding to each damage level.

In step 250, the cyber infringement investigation apparatus sets each node to one or more groups according to the damage level, and proposes a survey range corresponding to each group to the user. At this time, the survey range can be designated in advance for each damage level, and the cyber-infringement investigation apparatus can display the survey range corresponding to each damage level. In addition, the cyber infringement investigation apparatus can display the irradiation priority of each node in descending order of the risk exposure index within each investigation range. In this case, the irradiation priority means the order in which the irradiation is proceeded. Referring to FIG. 3, the cyber-infringement inspection apparatus may be configured to display the nodes of the entire system including the object to be connected through a connection line, and to display each of the inspection ranges as a single closed curve including a node corresponding to the inspection range . That is, in the cyber infringement investigation apparatus, a single closed curve including four nodes such as 310 is displayed as an irradiation range according to the first damage level, and a single closed curve including 11 nodes is displayed as an irradiation range according to the second damage level can do. The cyber infringement investigation apparatus can express the adjacency between the systems and the flow of information (the path through which data is transmitted and received) through the connection lines between the nodes. In addition, the cyber infringement investigation apparatus can display the degree of risk exposure for each node by displaying the color of each node differently, such as displaying in gradation according to the risk exposure level, or displaying the size of each node differently.

In addition, the cyber-infringement investigation apparatus arbitrarily adds or removes a node to an investigation range, edits a connection line between nodes to change a connection relationship between nodes, creates a new damage level, A user interface for performing editing such as moving the user interface, and can modify the survey range according to the user's input to the user interface.

In step 260, the cyber-infringement investigator obtains additional information through data retrieval and analysis associated with the infringement incident using known investigative functions such as timeline analysis, content analysis, and association analysis. At this time, the cyber infringement survey apparatus displays additional information.

In step 270, the cyber-infringement examination apparatus receives a survey completion selection input for selecting whether to end the cyber-infringement investigation from the user. At this time, the user can make an inquiry completion selection input to confirm the additional information and to complete the investigation or continue the investigation.

If it is determined in step 270 that the survey completion selection input is an input instructing the completion of the investigation, the cyber infringement investigation apparatus determines the damage range in the current investigation range in step 280, and transmits the report including the information of each node corresponding to the damage range .

If the inquiry completion selection input is an input instructing the continuation of the investigation in step 270, in step 290, the cyber infringement examination apparatus excludes data not corresponding to cyber infringement from the user from the seed data, and inputs, An input for changing the damage level and an input for setting new seed data. Thereafter, the cyber-infringement investigation apparatus repeats the procedure from step 220.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

Claims (12)

A communication interface for receiving survey target data, survey target network information and survey cue information;
A memory for storing a predetermined program; And
A processor for performing a cyber infringement investigation according to the program;
, ≪ / RTI &
The program includes:
Data related to the survey cue information among the survey subject data and the survey subject network information is selected and collected according to a predetermined criterion,
The risk exposure index is calculated according to the attribute according to the data,
Determining a damage level for each node according to whether the risk exposure index is exceeded for a predetermined threshold,
Setting each node as one or more groups according to the damage level, displaying an irradiation range corresponding to each group,
Acquiring additional information for nodes corresponding to the survey range,
Wherein the search range is set to a damage range and report data for nodes corresponding to the damage range are generated.
The method according to claim 1,
The program includes:
Each of the nodes is arbitrarily added to or removed from an investigation range, a user interface for changing a connection relationship between nodes is displayed,
And change the survey range according to user input through the user interface.
3. The method of claim 2,
Wherein the user interface is a user interface for generating a new damage level or moving a node included in a damage level to another damage level.
The method according to claim 1,
The program includes:
Connecting the nodes through a connection line according to a path through which the inter-node data is transmitted and received,
Wherein the cyber infringement survey apparatus is configured to display a single closed curve that includes nodes corresponding to the survey range.
The method according to claim 1,
The program includes:
And calculates the risk exposure index by summing the product of the attribute and a predetermined weight for each attribute.
6. The method of claim 5,
The program includes:
If the user inputs an instruction to continue the investigation after obtaining the additional information, data not corresponding to the cyber infringement is excluded from the seed data, the weight or the damage level is changed, and the new seed data is set , And re-calculating the risk exposure index to reset the survey range.
A method for a cyber infringement survey apparatus for examining a cyber infestation,
Receiving survey data, survey target network information, and survey cue information;
Collecting data related to the survey cue information among the survey subject data and the survey subject network information according to predetermined criteria;
Calculating a risk exposure index according to the attribute according to the data;
Determining a damage level for each node according to whether the risk exposure index is exceeded for a predetermined threshold value;
Setting each node as one or more groups according to the damage level, and displaying an irradiation range corresponding to each group;
Obtaining additional information for a node corresponding to the survey range;
Setting the survey range as a damage range and generating report data for nodes corresponding to the damage range;
And a cyber infringement investigation method.
8. The method of claim 7,
Displaying a user interface for arbitrarily adding or removing each of the nodes to the survey range and changing a connection relationship between the nodes; And
Changing the survey range according to user input through the user interface
The cyber infringement investigation method further comprising:
9. The method of claim 8,
Wherein the user interface is a user interface for creating a new damage level or moving a node included in a damage level to another damage level.
8. The method of claim 7,
Setting each node to one or more groups according to the damage level, and displaying an irradiation range corresponding to each group,
And connecting the nodes to each other through a connection line according to a route through which the inter-node data is transmitted and received, and displaying a single closed curve including the node corresponding to the survey range.
8. The method of claim 7,
The step of calculating the risk exposure index according to the attribute according to the data includes:
And calculating the risk exposure index by summing the product of the attribute and a predetermined weight for each attribute.
12. The method of claim 11,
If the user inputs an instruction to continue the investigation after obtaining the additional information, data not corresponding to the cyber infringement is excluded from the seed data, the weight or the damage level is changed, and the new seed data is set , And re-calculating the risk exposure index to reset the survey range
Further comprising the step of:

Images