Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program
Provided is a cyber threat information processing method including acquiring webpage data based on link information, and analyzing tag structure information of the webpage data, converting data included in a tag area of the webpage data into tag feature data according to the tag structure information, and training an AI model using the converted tag feature data to acquire cyber threat information of the data included in the tag area.
1 . A cyber threat information processing method to provide a cyber intelligence service through Application Program Interface (API) interface, the cybersecurity threat information processing method comprising:
acquiring webpage data based on link information, and analyzing tag structure information of the webpage data;
converting hypertext markup language (HTML) data included in a tag area of the webpage data according to the tag structure information to extract tag feature data;
detecting whether the HTML data in the webpage data is malicious on multiple layers using two or more detection techniques which include antivirus-based malicious pattern detections or signature-based malicious pattern detections;
training an artificial intelligence (AI) model on the tag feature data to detect attack techniques of a malicious activity caused by the data included in the tag area,
wherein multiple attack techniques are classified with multi-labeling by using a binary vector based on multi-labeling classification;
acquiring cyber threat information on the malicious activity; and
providing the cyber intelligence service through the API interface related to the webpage data with the attack techniques classified with the multi-labeling and an attack group of the malicious activity.
2 . The cyber threat information processing method according to claim 1 , wherein the tag structure information comprises a document object model (DOM) tree structure.
3 . The cyber threat information processing method according to claim 1 , wherein, when the HTML data included in the tag area of the webpage data is converted into the tag feature data, the cyber threat information processing method is applied to user-related data in a tag except for grammar included in the webpage data.
4 . A cyber threat information processing apparatus to provide a cyber intelligence service through Application Program Interface (API) interface, the cyber threat information processing apparatus comprising:
a database configured to store webpage data; and
a processor,
wherein the processor:
acquires the webpage data based on link information, and analyzes tag structure information of the webpage data;
converts hypertext markup language (HTML) data included in a tag area of the webpage data according to the tag structure information to extract tag feature data;
detects whether the HTML data in the webpage data is malicious on multiple layers using two or more detection techniques which include antivirus-based malicious pattern detections or signature-based malicious pattern detections;
trains an AI model on the tag feature data to detect attack techniques of a malicious activity caused by the data included in the tag area,
wherein multiple attack techniques are classified with multi-labeling by using a binary vector based on multi-labeling classification;
acquires cyber threat information on the malicious activity; and
provides the cyber intelligence service through the API interface related to the webpage data with the attack techniques classified with the multi-labeling and an attack group of the malicious activity.
5 . The cyber threat information processing apparatus according to claim 4 , wherein the tag structure information comprises a DOM tree structure.
6 . The cyber threat information processing apparatus according to claim 4 , wherein, when the HTML data included in the tag area of the webpage data is converted into the tag feature data, the cyber threat information processing apparatus is applied to user-related data in a tag except for grammar included in the webpage data.
7 . A non-transitory computer-readable storage medium storing a cyber threat information processing program to provide a cyber intelligence service through Application Program Interface (API) interface, the program executing computer instructions comprising:
a module for acquiring webpage data based on link information, and analyzing tag structure information of the webpage data;
a module for converting hypertext markup language (HTML) data included in a tag area of the webpage data into tag feature data according to the tag structure information to extract tag feature data;
a module for detecting whether the HTML data in the webpage data is malicious on multiple layers using two or more detection techniques which include antivirus-based malicious pattern detections or signature-based malicious pattern detections; and
a module for training an AI model on the tag feature data to detect attack techniques of a malicious activity caused by the data included in the tag area,
wherein multiple attack techniques are classified with multi-labeling by using a binary vector based on multi-labeling classification,
acquiring cyber threat information on the malicious, and
providing the cyber intelligence service through the API interface related to the webpage data with the attack techniques classified with the multi-labeling and an attack group of the malicious activity.
8 . The non-transitory computer-readable storage medium according to claim 7 , wherein the tag structure information comprises a DOM tree structure.
9 . The non-transitory computer-readable storage medium according to claim 7 , wherein, when the HTML data included in the tag area of the webpage data is converted into the tag feature data, the cyber threat information processing program is applied to user-related data in a tag except for grammar included in the webpage data.