Ai multi-domain integrated system and method for automatic generation of cyber crisis scenario
There is provided a method for automatically generating a cyber crisis scenario, performed by a computing system. The method may comprise classifying types of content included in a cyber crisis report and extracting image data and text data from the cyber crisis report, inputting the image data into an image processing model and extracting attack procedure/behavior information included in the image data, inputting the text data into a text processing model and generating structured attack procedure-related data from each attack procedure included in the text data, generating threat behavior data corresponding to the attack procedure-related data, and merging the threat behavior data with the attack procedure-related data, matching the attack procedure-related data to the attack procedure/behavior information and generating a cyber crisis scenario template and automatically generating a cyber crisis scenario based on the attack procedure-related data and the cyber crisis scenario template.
1. A method for automatically generating a cyber crisis scenario, performed by a computing system, the method comprising:
classifying types of content included in a cyber crisis report and extracting image data and text data from the cyber crisis report;
inputting the image data into an image processing model and extracting attack procedure/behavior information included in the image data using an analysis result of the image data obtained from the image processing model;
inputting the text data into a text processing model and generating structured attack procedure-related data from each attack procedure included in the text data using an analysis result of the text data obtained from the text processing model;
generating threat behavior data corresponding to the attack procedure-related data using unique identification information of Tactics, Techniques, and Procedures (TTPs) defined in the MITRE ATT&CK framework, and merging the threat behavior data with the attack procedure-related data;
matching the attack procedure-related data to the attack procedure/behavior information and generating a cyber crisis scenario template; and
automatically generating a cyber crisis scenario by combining the cyber crisis scenario template with execution elements corresponding to the threat behavior data included in the cyber crisis scenario template.
2. The method of claim 1 , wherein the extracting the attack procedure/behavior information comprises: defining components included in the image data and relationships between the components; and extracting the attack procedure/behavior information based on the components and the relationships.
3. The method of claim 1 , wherein the generating the structured attack procedure-related data comprises generating unique execution order identification information for a first attack procedure and a second attack procedure included in the text data based on an execution sequence.
4. The method of claim 3 , wherein the generating the cyber crisis scenario template comprises: determining whether content of the first and second attack procedures includes all content of the attack procedures recorded in the cyber crisis report based on the attack procedure/behavior information; and determining, based on a result of the determination, whether the first and second attack procedures match the respective attack procedures recorded in the cyber crisis report.
5. The method of claim 1 , wherein the attack procedure-related data comprises information on a targeted organization, information on an executed attack, and tags for the executed attack.
6. The method of claim 5 , wherein the generating the threat behavior data corresponding to the attack procedure-related data comprises: performing semantic analysis on the information on the executed attack; and matching the executed attack to a corresponding TTP identifier (ID) defined in the MITRE ATT&CK framework based on a result of the semantic analysis.
7. The method of claim 1 , wherein the generating the cyber crisis scenario template comprises: verifying validity of information as to whether the cyber crisis scenario template includes all the content of the cyber crisis report; and verifying appropriateness of information as to whether the threat behavior data is properly matched to TTPs defined in the MITRE ATT&CK framework.
8. The method of claim 7 , wherein the automatically generating the cyber crisis scenario comprises automatically generating the cyber crisis scenario only when both the validity and appropriateness of the information have been successfully verified.
9. A cyber crisis scenario automatic generation system comprising:
a communication interface;
a memory configured to load a computer program; and
at least one processor configured to execute the computer program,
wherein the computer program includes instructions for performing operations of: classifying types of content included in a cyber crisis report and extracting image data and text data from the cyber crisis report; inputting the image data into an image processing model and extracting attack procedure/behavior information included in the image data using an analysis result of the image data obtained from the image processing model; inputting the text data into a text processing model and generating structured attack procedure-related data from each attack procedure included in the text data using an analysis result of the text data obtained from the text processing model; generating threat behavior data corresponding to the attack procedure-related data using unique identification information of Tactics, Techniques, and Procedures (TTPs) defined in the MITRE ATT&CK framework, and merging the threat behavior data with the attack procedure-related data; matching the attack procedure-related data to the attack procedure/behavior information and generating a cyber crisis scenario template; and automatically generating a cyber crisis scenario by combining the cyber crisis scenario template with execution elements corresponding to the threat behavior data included in the cyber crisis scenario template.
10. The system of claim 9 , wherein the operation of extracting the attack procedure/behavior information comprises: defining components included in the image data and relationships between the components; and extracting the attack procedure/behavior information based on the components and the relationships.
11. The system of claim 9 , wherein the operation of generating the structured attack procedure-related data comprises generating unique execution order identification information for a first attack procedure and a second attack procedure included in the text data based on an execution sequence.
12. The system of claim 11 , wherein the operation of generating the cyber crisis scenario template comprises: determining whether content of the first and second attack procedures includes all content of the attack procedures recorded in the cyber crisis report based on the attack procedure/behavior information; and determining, based on a result of the determination, whether the first and second attack procedures match the respective attack procedures recorded in the cyber crisis report.
13. The system of claim 9 , wherein the attack procedure-related data comprises information on a targeted organization, information on an executed attack, and tags for the executed attack.
14. The system of claim 13 , wherein the operation of generating the threat behavior data corresponding to the attack procedure-related data comprises: performing semantic analysis on the information on the executed attack; and matching the executed attack to a corresponding TTP identifier (ID) defined in the MITRE ATT&CK framework based on a result of the semantic analysis.
15. The system of claim 9 , wherein the operation of generating the cyber crisis scenario template comprises: verifying validity of information as to whether the cyber crisis scenario template includes all the content of the cyber crisis report; and verifying appropriateness of information as to whether the threat behavior data is properly matched to TTPs defined in the MITRE ATT&CK framework.
16. The system of claim 15 , wherein the operation of automatically generating the cyber crisis scenario comprises automatically generating the cyber crisis scenario only when both the validity and appropriateness of the information have been successfully verified.
17. A non-transitory computer-readable storage medium storing a computer program that performs, in conjunction with a computing device, operations of:
classifying types of content included in a cyber crisis report and extracting image data and text data from the cyber crisis report;
inputting the image data into an image processing model and extracting attack procedure/behavior information included in the image data using an analysis result of the image data obtained from the image processing model;
inputting the text data into a text processing model and generating structured attack procedure-related data from each attack procedure included in the text data using an analysis result of the text data obtained from the text processing model;
generating threat behavior data corresponding to the attack procedure-related data using unique identification information of Tactics, Techniques, and Procedures (TTPs) defined in the MITRE ATT&CK framework, and merging the threat behavior data with the attack procedure-related data;
matching the attack procedure-related data to the attack procedure/behavior information and generating a cyber crisis scenario template; and
automatically generating a cyber crisis scenario by combining the cyber crisis scenario template with execution elements corresponding to the threat behavior data included in the cyber crisis scenario template.