Apparatuses for optimizing rule to improve detection accuracy for exploit attack and methods thereof

1. An apparatus for optimizing a rule, comprising:

a memory to store a rule optimizer;

a processor to execute the rule optimizer to:

obtain log data including a result of detecting an exploit attack based on the rule;

time-series analyze the obtained log data;

derive increasing or decreasing trends for detection rates of previously applied detection rules;

raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;

update at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,

wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,

wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.

2. The apparatus of claim 1 , wherein the memory further stores a collector and a rule generator,

wherein the processor further executes the collector to collect vulnerability information on a device and exploit information associated with the vulnerability information, and

wherein the processor further executes the rule generator to generate the previously applied detection rules by analyzing the collected exploit information.

3. The apparatus of claim 2 , wherein the processor further executes the collector to

collect device information; and

collect the vulnerability information and the exploit information associated with the device by using the collected device information.

4. The apparatus of claim 2 , wherein the exploit information includes exploit codes, and

wherein the processor further executes the rule generator to

classify the type of attack associated with the exploit codes by analyzing the exploit codes; and

generate the previously applied detection rules by using an analysis result and a classification result of the exploit codes.

5. The apparatus of claim 1 , wherein the previously applied detection rules comprise action information performed based on satisfying a condition, and

wherein the processor further executes the rule optimizer to

calculate a number of true positives or true positive rates of the previously applied detection rules by analyzing the obtained log data; and

change action information of one of the previously applied detection rules in which the calculated number of true positives or the true positive rates is greater than or equal to a reference value.

6. The apparatus of claim 1 , wherein the processor further executes the rule optimizer to

calculate a number of true positives or true positive rates of the previously applied detection rules by analyzing the obtained log data; and

raise a priority of application of one of the previously applied detection rules in which the calculated number of true positives or the true positive rates is greater than or equal to a reference value.

7. The apparatus of claim 1 , wherein the processor further executes the rule optimizer to

calculate a number of false positives or false positive rates of the previously applied detection rules by analyzing the obtained log data; and

delete or modify one of the previously applied detection rules in which the calculated number of false positives or the false positive rates is greater than or equal to a reference value.

8. The apparatus of claim 1 , wherein the previously applied detection rules comprise action information performed based on satisfying a condition, and

wherein the processor further executes the rule optimizer to

derive an increasing or decreasing trend for a number of detections for each of the previously applied detection rules by time-series analyzing the obtained log data; and

change action information of one of the previously applied detection rules in which the derived trend of the number of detections is the increasing trend.

9. The apparatus of claim 1 , wherein the processor further executes the rule optimizer to

time-series derive an increasing or decreasing trend for a number of detections for each of the previously applied detection rules by analyzing the obtained log data; and

raise a priority of application of one of the previously applied detection rules in which the derived trend of the number of detections is the increasing trend.

10. The apparatus of claim 1 , wherein the processor further executes the rule optimizer to

derive an increasing or decreasing trend for a number of detections for each of the previously applied detection rules by time-series analyzing the obtained log data; and

delete or modify one of the previously applied detection rules in which the derived trend of the number of detections is the decreasing trend.

11. The apparatus of claim 1 , wherein the previously applied detection rules comprise action information performed based on satisfying a condition, and

wherein the processor further executes the rule optimizer to

derive increasing or decreasing trends for detection rates of the previously applied detection rules by time-series analyzing the obtained log data; and

change action information of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend.

12. The apparatus of claim 1 , wherein the processor further executes the rule optimizer to

derive increasing and decreasing trends for detection rates of the previously applied detection rules by time-series analyzing the obtained log data; and

delete or modify one of the previously applied detection rules in which the derived trend of the detection rate is the decreasing trend.

13. The apparatus of claim 1 , wherein in response to determining that an amount of log data of the second domain is less than a reference value, the processor further executes the rule optimizer to use the log data of the first domain.

14. An apparatus for optimizing a rule, comprising:

a memory to store a rule optimizer;

a processor to execute the rule optimizer to:

obtain device information associated with a device belonging to a target domain;

determine an exploit attack associated with the device by using the obtained device information;

derive increasing or decreasing trends for detection rates of previously applied detection rules by time-series analyzing the obtained device information;

raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;

update an existing rule set of the target domain with a rule set for detecting the determined exploit attack based on at least characteristics of the target domain, and

update at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,

wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,

wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.

15. The apparatus of claim 14 , wherein the memory further stores a collector,

wherein the processor further executes the collector to collect exploit information associated with vulnerability information, and

wherein the processor further executes the rule optimizer to

inquire a subset of the collected vulnerability information on the device by using the obtained device information; and

determine the exploit attack associated with the device by using the inquired subset of the collected vulnerability information.

16. The apparatus of claim 14 , wherein the memory further stores a collector and a rule generator,

wherein the processor further executes the collector to collect exploit information associated with vulnerability information;

wherein the processor further executes the rule generator to generate a detection rule by analyzing the collected exploit information,

wherein in response to determining that a new device exists in the target domain, the processor further executes the collector to collect vulnerability information and exploit information associated with the new device,

wherein the processor further executes the rule generator to generate a new detection rule by analyzing the exploit information associated with the new device, and

wherein the processor further executes the rule optimizer to update the existing rule set to include the generated new detection rule.

17. A method for optimizing a rule, the method being performed by a computing device, and comprising:

obtaining log data including a result of detecting an exploit attack based on the rule;

time-series analyzing the obtained log data;

derive increasing or decreasing trends for detection rates of previously applied detection rules;

raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;

updating at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,

wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,

wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.