사이버 방어작전 프레임워크 기반의 공격그룹 분류 및 공격예측 기법 = Methods for Classification and Attack Prediction of Attack Groups based on Framework of Cyber Defense Operations

국문 초록 (Abstract)

최근 320 사이버테러, 625 사이버공격 등 대규모 피해를 유발하는 해킹공격이 지속적으로 발생하고 있다. 이러한 사이버 위협 환경에서 효과적인 방어계획을 수립하는 것은 매우 중요하다. 특히, 공격자는 누구이며, 어떠한 방법으로 공격을 진행하고, 무엇을 원하는지 파악하는 것은 방어계획을 수립하는 가장 중요한 요소이다. 따라서 본 논문에서는 공격 집단이 공격을 진행할 때 생성되는 다양한 디지털 단서와 공개출처정보(OSINT: Open Source Intelligence)를 이용하여 공격그룹을 분류하고 공격을 예측할 수 있는 사이버방어작전 프레임워크를 제안한다. 제안하는 프레임워크는 탐지, 디지털단서추출, 그룹분류, 주체분석, 예측, 대응의 6단계로 구성되며, OO기관에서 수집된 해킹메일에 대상으로 주요 공격그룹을 가시화 하였으며, 식별된 공격자를 추적하고 추가적인 공격이 예측 가능함을 보여주었다. 본 논문에서 제안한 사이버방어작전 프레임워크는 향후 발생 가능한 사이버공격에 대한 효과적인 대응에 기여할 것으로 기대한다.

다국어 초록 (Multilingual Abstract)

Recently, cyber-attacks such as 3·20 cyber terror, 6·25 cyber-attack, etc., causing large-scale damage keep on occurring. Under such cyber threat environment, it is very important to establish efficient defense plans. Especially, recognizing who the attackers are, how they attack, and what they want are the most important factors. Therefore, this paper suggests a cyber defense operation framework that can classify attack groups and predict potential cyber threats using various digital bread crumbs and Open Source Intelligence (OSINT) that are generated when the attack groups carry out their attacks. The suggested framework consists of six phases which are detection, extraction of digital bread crumbs, classification and analysis of attack groups, prediction, and reaction. Using APT(Advanced Persistent Threats) mails collected from OO Organization, the framework shows the positive result that it can classify the attack groups, track the classified attack groups, and predict additional potential cyber threats. The cyber defense operation framework proposed in this paper is expected to contribute efficient reactions to potential cyber threats in the future.

목차 (Table of Contents)

• 요약
• Abstract
• 1. 서론
• 2. 관련연구
• 3. 제안하는 디지털단서 기반의 사이버방어작전 프레임워크
• 4. 실험 및 결과
• 5. 결론 및 향후연구
• References

참고문헌 (Reference)

1 "WHOIS"

2 "Virus Total"

3 Roland Dela Paz, "The HeartBeat Apt Campaign, Trend Micro Incorporated Research Paper" 2012

4 Dmitry Tarakanov, "The 'Kimsuky' Operation: A North Korean APT?"

5 Aditya K Sood, "Targeted Cyberattacks: A Superset of Advanced Persistent Threats" 11 (11): 54-61, 2013

6 "Snort"

7 "Sentinel Visualizer"

8 "Python"

9 Robert D. Steele, "Open Source Intelligence: What Is It? Why Is It Important to the Military?" OSS, Inc. International Public Information Clearinghouse 329-341, 1997

10 US Army, "Open Source Intelligence" Dept. Army 2006

11 "Norman Sanbox"

12 "Malwre Domain List"

13 Eric M. Hutchins, "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" Lockheed Martin Corporation 2010

14 Michael Classman, "Intelligence in the internet age: the emergence and evolution of Open Source Intelligece (OSINT)" 28 (28): 673-682, 2012

15 "IDA Pro"

16 Ivan Herman, "Graph Visualization and Navigation in Information Visualization: A Survey" 6 (6): 24-43, 2000

17 "GEOIP"

18 "Domain Tools"

19 Robin Gandhi, "Dimensions of Cyber-Attacks: Cultural, Social, Economic, and Political" 30 (30): 28-38, 2011

20 FireEye, Inc., "Digital Bread Crumbs: Seven Clues To Identifying Who‘s Behind Advanced Cyber Attacks"

21 Sanjay Goel, "Cyberwarfare: connecting the dots in cyber intelligence" 54 (54): 132-140, 2011

22 KISA, "Computer Emergency Response Team(CERT) Building & Operation Book"

23 Saeed Nari, "Automated malware classification based on network behavior" 1 : 642-647, 2013

24 Ronghua Tian, "An automated classification system based on the strings of trojan and virus families" 1 : 23-30, 2009

25 Mohamad Fadli Zolkipli, "An approach for malware behavior identification and classification" 1 : 191-194, 2011

26 MANDIANT, "APT1 : Exposing One of China’s Cyber Espionage Units"

27 Yang Zhong, "A Malware Classification Method based on Similarity of Function Structure" 1 : 256-261, 2012

28 NIS, "2013 National Information Security White Paper" 2013