Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program
Provided is a cyber threat information processing method including receiving input of a file or information on the file from a user through at least one interface; processing cyber threat information related to the received or input file or the information on the file; providing the processed cyber threat information to the user through a user interface; and performing natural language processing on the processed cyber threat information.
1. A method of processing cyber threat information, the method comprising:
receiving a file or information on the file from a user through at least one interface,
wherein the file includes either an executable file or non-executable file;
processing cyber threat information on advanced persistent threat (APT) attacks related to the received file or the information on the file,
wherein when the received file is the executable file, a first cyber threat feature being extracted from one or more functions in the file is classified into a first attack technique identifier and a first attack group identifier, and
when the received file is the non-executable file, a second cyber threat feature is extracted from memory data in a suspended state of an application of the non-executable file at the time of executing the application in a kernel area, and the extracted second cyber threat feature is classified into a second attack technique identifier and a second attack group identifier, and
wherein the cyber threat information is generated based on the first or second attack technique identifier and the first or second attack group identifier;
and
performing natural language processing on the cyber threat information and providing a real-time intelligence line feed service on the APT attacks based on the natural language through a user interface.
2. The method according to claim 1 , wherein the real-time intelligence line feed service includes a probability that the file is to be malicious.
3. An apparatus for processing cyber threat information, the apparatus comprising:
a database configured to store data; and
a server comprising a processor, wherein:
the server receives a file or information on the file from a user through at least one interface, wherein the file includes either an executable file or non-executable file, and
the processor:
processes cyber threat information on advanced persistent threat (APT) attacks related to the received file or the information on the file,
wherein when the received file is the executable file, a first cyber threat feature being extracted from one or more functions in the file is classified into a first attack technique identifier and a first attack group identifier, and
when the received file is the non-executable file, a second cyber threat feature is extracted from memory data in a suspended state of an application of the non-executable file at the time of executing the application in a kernel area, and the extracted second cyber threat feature is classified into a second attack technique identifier and a second attack group identifier, and
wherein the cyber threat information is generated based on the first or second attack technique identifier and the first or second attack group identifier;
and
performs natural language processing on the cyber threat information and provides a real-time intelligence line feed service on the APT attacks based on the natural language through a user interface.
4. The apparatus according to claim 3 , wherein the real-time intelligence line feed service includes a probability that the file is to be malicious.
5. A non-transitory computer-readable storage medium storing a cyber threat information processing program that executes computer instructions for:
receiving input of a file or information on the file from a user through at least one interface,
wherein the file includes either an executable file or non-executable file;
processing cyber threat information on advanced persistent threat (APT) attacks related to the received file or the information on the file,
wherein when the received file is the executable file, a first cyber threat feature being extracted from one or more functions in the file is classified into a first attack technique identifier and a first attack group identifier, and
when the received file is the non-executable file, a second cyber threat feature is extracted from memory data in a suspended state of an application of the non-executable file at the time of executing the application in a kernel area, and the extracted second cyber threat feature is classified into a second attack technique identifier and a second attack group identifier, and
wherein the cyber threat information is generated based on the first or second attack technique identifier and the first or second attack group identifier;
and
performing natural language processing on the cyber threat information and providing a real-time intelligence line feed service on the APT attacks based on the natural language through a user interface.
6. The non-transitory computer-readable storage medium according to claim 5 , wherein the real-time intelligence line feed service includes a probability that the file is to be malicious.