Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program
Provided is a cyber threat information processing method including receiving a CTI analysis request for a file from a client; analyzing the file to obtain analysis information of the CTI for the file; generating a CTI query related to the file based on the analyzed CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query obtained from the CTI for the analyzed file and the natural language model.
1 . A method of providing cyber threat information (CTI), the method comprising:
receiving a CTI analysis request for a file from a client;
analyzing the file to obtain analysis information of the CTI for the file;
generating a CTI query related to the file based on the analysis information and delivering the CTI query to a natural language model; and
providing natural language description information according to the CTI query obtained from the CTI for the analyzed file and the natural language model,
wherein the CTI query includes at least one of a keyword of the CTI, a hash value, an attack identifier, an attack group identifier, an attack technique, or attack campaign information related to the CTI, and wherein the natural language description information includes damage severity according to a degree of maliciousness, a probabilistic value of the maliciousness and a related tag of the file.
2 . The method according to claim 1 , wherein the analysis information of the CTI comprises at least one of whether the file is malicious, an attack technique related to the file, an attack group related to the file, an attack campaign related to the file, a target industry of a cyberattack related to the file, or target nation information of the cyberattack related to the file.
3 . The method according to claim 1 , further comprising:
providing evidence of answer in response to the CTI query when providing the natural language description information.
4 . The method according to claim 1 , further comprising:
generating candidate answers based on the CTI query by searching a database and providing evidence from the database for the candidate answers.
5 . The method according to claim 1 , wherein the CTI query further includes an attack group, attack technique related to a malicious action by the file, and an attack campaign according to the analysis information.
6 . The method according to claim 1 , further comprising:
obtaining visualization information of the natural language description information.
7 . An apparatus for providing cyber threat information (CTI), the apparatus comprising:
a database configured to store data; and
a processor,
wherein the processor performs operations comprising:
an operation of receiving a CTI analysis request for a file from a client;
an operation of analyzing the file to obtain analysis information of the CTI for the file;
an operation of generating a CTI query related to the file based on the analysis information and delivering the CTI query to a natural language model; and
an operation of providing natural language description information according to the CTI query obtained from the natural language model,
wherein the CTI query includes at least one of a keyword of the CTI, a hash value, an attack identifier, an attack group identifier, an attack technique, or attack campaign information related to the CTI, and
wherein the natural language description information includes damage severity according to a degree of maliciousness, a probabilistic value of the maliciousness and a related tag of the file.
8 . The apparatus according to claim 7 , wherein the analysis information of the CTI comprises at least one of whether the file is malicious, an attack technique related to the file, an attack group related to the file, an attack campaign related to the file, a target industry of a cyberattack related to the file, or target nation information of the cyberattack related to the file.
9 . The apparatus according to claim 7 , wherein the processor performs operations further comprising:
an operation of providing evidence of answer in response to the CTI query when providing the natural language description information.
10 . The apparatus according to claim 7 , wherein the processor performs operations further comprising:
an operation of generating candidate answers based on the CTI query by searching a database and providing evidence from the database for the candidate answers.
11 . The apparatus according to claim 7 , wherein the CTI query further includes an attack group, attack technique related to a malicious action by the file, and an attack campaign according to the analysis information.
12 . The apparatus according to claim 7 , wherein the processor performs operations further comprising:
an operation of obtaining visualization information of the natural language description information.
13 . A non-transitory computer-readable storage medium for storing a program for providing cyber threat information (CTI) executable by a computer, the program comprising instructions configured to:
receive a CTI analysis request for a file from a client;
analyze the file to obtain analysis information of the CTI for the file;
generate a CTI query related to the file based on the analysis information and delivering the CTI query to a natural language model; and
provide natural language description information according to the CTI query obtained from the natural language model,
wherein the CTI query includes at least one of a keyword of the CTI, a hash value, an attack identifier, an attack group identifier, an attack technique, or attack campaign information related to the CTI, and
wherein the natural language description information includes damage severity according to a degree of maliciousness, a probabilistic value of the maliciousness and a related tag of the file.
14 . The non-transitory computer-readable storage medium according to claim 13 , wherein the analysis information of the CTI comprises at least one of whether the file is malicious, an attack technique related to the file, an attack group related to the file, an attack campaign related to the file, a target industry of a cyberattack related to the file, or target nation information of the cyberattack related to the file.
15 . The non-transitory computer-readable storage medium according to claim 13 , wherein the program comprises further instructions configured to:
provide evidence of answer in response to the CTI query when providing the natural language description information.
16 . The non-transitory computer-readable storage medium according to claim 13 , wherein the program comprises further instructions configured to:
generate candidate answers based on the CTI query by searching a database and providing evidence from the database for the candidate answers.
17 . The non-transitory computer-readable storage medium according to claim 13 , wherein the CTI query further includes an attack group, attack technique related to a malicious action by the file, and an attack campaign according to the analysis information.
18 . The non-transitory computer-readable storage medium according to claim 13 , wherein the program comprises further instructions configured to:
obtain visualization information of the natural language description information.