Security requirement recommendation system and operation method
View Patent ↗Provided is an operation method of a security requirement recommendation system including inputting an attack scenario of an advanced persistent threat (APT); and estimating a specific APT attack case similar to the attack scenario based on a case-based problem domain ontology including characteristic models of the APT attack cases, and recommending a security requirement corresponding to the specific APT attack case.
1. An operation method of a security requirement recommendation system, comprising:
inputting an attack scenario of an advanced persistent threat (APT);
estimating a specific APT attack case similar to the attack scenario based on a case-based problem domain ontology including characteristic models of APT attack cases; and
recommending a security requirement corresponding to the specific APT attack case, the recommending having:
extracting a specific attack component by applying the attack scenario to an attack component model,
measuring a similarity between the specific attack component and each attack component of each of the APT attack cases,
listing attack target candidates in an order of greater similarities,
estimating the specific APT attack case for the attack target candidates by analyzing the attack target candidates with a security requirement component model, a risk component model, and a domain component model, and
extracting the security requirement corresponding to the specific APT attack case.
2. The operation method of claim 1 , wherein the characteristic models of the APT attack cases include:
the attack component model including information about attacks of the each of the APT attack cases;
the security requirement component model including a security requirement information defined in the each of the APT attack cases;
the risk component model including weakness components by the APT attack cases; and
the domain component model including an element of an attack target.
3. The operation method of claim 1 , wherein the similarity is measured by assigning a weight to a sibling/parent relationship characteristic, a platform performance characteristic, a tactical target characteristic, and an attack pattern characteristic between the specific attack component and the each attack component of the each of the APT attack cases.
4. The operation method of claim 1 , wherein the similarity between the specific attack component and the each attack component of the each of the APT attack cases is measured by a Jaccard similarity.
5. The operation method of claim 1 , wherein applying a Jaccard similarity identifies the specific APT attack case matching the attack scenario inputted.
6. The operation method of claim 1 , wherein recommending the security requirement corresponding to the specific APT attack case further comprises transmitting the security requirement corresponding to the specific APT attack case to an external device.
7. A security requirement recommendation system, comprising:
an input device configured to input an attack scenario of an advanced persistent threat (APT);
an ontology server storing a case-based problem domain ontology including characteristic models of APT attack cases; and
a security requirement recommendation device estimating a specific APT attack case similar to the attack scenario inputted based on the case-based problem domain ontology and recommending a security requirement corresponding to the specific APT attack case,
wherein the security requirement recommendation device comprises:
a component extraction unit extracting a specific attack component by applying the attack scenario to an attack component model;
a similarity measurement unit measuring a similarity between the specific attack component and each attack component of each of the APT attack cases, and listing attack target candidates in an order of greater similarities; and
a security requirement extraction unit analyzing the attack target candidates with a security requirement component model, a risk component model, and a domain component model to estimate the specific APT attack case for the attack target candidates, and extracting the security requirement corresponding to the specific APT attack case.
8. The security requirement recommendation system of claim 7 , wherein the characteristic models of the APT attack cases comprises:
the attack component model including information about attacks of the each of the APT attack cases;
the security requirement component model including a security requirement information defined in the each of the APT attack cases;
the risk component model including weakness components by the APT attack cases; and
the domain component model including an element of the attack target.
9. The security requirement recommendation system of claim 7 , wherein the similarity measurement unit measures the similarity by assigning a weight to a sibling/parent relationship characteristic, a platform performance characteristic, a tactical target characteristic, and an attack pattern characteristic between the specific attack component and the each attack component of the each of the APT attack cases.
10. The security requirement recommendation system of claim 7 , wherein the similarity between the specific attack component and the each attack component of the each of the APT attack cases is measured by a Jaccard similarity.
11. The security requirement recommendation system of claim 7 , wherein the similarity measurement unit identifies the specific APT attack case matching the attack scenario inputted by applying a Jaccard similarity.
12. The security requirement recommendation system of claim 7 , wherein the similarity measurement unit outputs the similarity on a graph.
13. The security requirement recommendation system of claim 7 , wherein the security requirement extraction unit of the security requirement recommendation device extracts and transmits the security requirement corresponding to the specific APT attack case to an external device.