Attack risk assessment system of an advanced persistent threat and the operation method
View Patent ↗Provided is an operation method of an attack risk assessment system, which includes: extracting, when an advanced persistent threat attack is detected, an attack component for the advanced persistent threat attack based on risk-aware problem domain ontology for assessing a security risk for an attack; identifying a risk component based on the attack component; deriving a security requirement by a goal based access scheme set for the risk component; and assessing the security risk based on an evidence set through a relationship between a domain asset identified as the risk component and the security requirement.
1 . An operation method of an attack risk assessment system, the operation method comprising:
extracting, by an attack component extraction processor, when an advanced persistent threat (APT) attack is detected, an attack component of the APT attack based on risk-aware problem domain ontology for assessing a security risk of an attack;
identifying, by a risk element identification processor, a risk component based on the attack component of the APT attack;
deriving, by a security requirement derivation processor, a security requirement corresponding to the risk component using a threat element of the risk component;
identifying, by a domain asset identification processor, specific domain asset influenced by the APT attack by using the risk component;
assessing, by a security risk assessment processor, the security risk by assessing a relationship between the specific domain asset and the security requirement based on predetermined evidence, to produce an assessment result of the security risk;
storing, by the security risk assessment processor, the attack component, the risk component, the security requirement, and the assessment result of the security risk in at least one of ontology server and database server; and
utilizing the attack component, the risk component, the security requirement, and the assessment result of the security risk to defend the APT attack,
wherein, in the assessing the security risk by assessing the relationship between the specific domain asset and the security requirement based on the predetermined evidence, a degree of the security risk is calculated based on a level of satisfaction of the specific domain asset for the security requirement according to information specified in the predetermined evidence, and the degree of security risk decreases as the level of satisfaction of the specific domain asset meeting the security requirement increases,
wherein the predetermined evidence includes a degree of the specific domain asset meeting the security requirement, a method for making the specific domain asset to meet the security requirement, a method for achieving a security goal, and a method for defending against a malicious goal,
wherein domain assets are classified into multiple viewpoints constituting a business process layer, a human layer, a technical layer, and a physical layer,
wherein the attack component includes attack groups, targets, attack goals and tactics, and
wherein the risk-aware problem domain ontology comprises a plurality of analysis models including an attack component model, a risk component model, a security requirement component model, and a domain component model, a plurality of ontologies including domain specified knowledge ontology, APT case knowledge ontology, and general security knowledge ontology.
2 . The operation method of an attack risk assessment system of claim 1 , wherein in the identifying of the risk component, the threat element of the risk component where a security weakness or a vulnerability occurs is identified by using an attack element of the attack component.
3 . The operation method of an attack risk assessment system of claim 1 , wherein the security requirement derived by the security requirement derivation processor meets a malicious goal and a security goal.
4 . The operation method of claim 3 , wherein the security requirement derivation processor identifies the malicious goal and the security goal in the risk component identified by the risk element identification processor.
5 . The operation method of claim 1 , wherein
the business process layer includes information of intangible and tangible activities performed by a corporate, the intangible and tangible activities including corporate management activities that produce services or products for customers,
the human layer includes personal information for a plurality of persons engaging in the corporate, the personal information including personal personnel information, a security degree, and an accessible computing device,
the technical layer includes knowledge technology for producing a product, the knowledge technology including a design technology, a manufacturing technology, and a facility technology for producing the product of the corporate, and
the physical layer includes a computer, a production facility, a manufacturing facility, and a server used by the corporate.
6 . An attack risk assessment system comprising:
an ontology server configured to store risk-aware problem domain ontology specialized for security risk assessment against an advanced persistent threat (APT) attack;
a database server configured to provide information on the APT attack; and
an attack risk assessment apparatus including:
an attack component extraction processor configured to extract an attack component of the APT attack based on the risk-aware problem domain ontology when the APT attack is detected,
a risk element identification processor configured to identify a risk component based on the attack component of the APT attack and information stored in the database server,
a security requirement derivation processor configured to derive a security requirement corresponding to the risk component and meeting a malicious goal and a security goal,
a domain asset identification processor configured to identify specific domain asset influenced by the APT attack by using the risk component, and
a security risk assessment processor configured to:
assess a security risk according to a relationship between the specific domain asset and the security requirement corresponding to the risk component based on predetermined evidence, to produce an assessment result of the security risk,
calculate a degree of the security risk based on a level of satisfaction of the specific domain asset for the security requirement according to the information specified in the predetermined evidence, wherein the degree of security risk decreases as the level of satisfaction of the specific domain asset meeting the security requirement increases,
store the attack component, the risk component, the security requirement, and the assessment result of the security risk in at least one of the ontology server and the database server, and
utilize the attack component, the risk component, the security requirement, and the assessment result of the security risk to defend the APT attack,
wherein the predetermined evidence includes a degree of the specific domain asset meeting the security requirement, a method for making the specific domain asset to meet the security requirement, a method for achieving the security goal, and a method for defending against the malicious goal,
wherein domain assets are classified into multiple viewpoints constituting a business process layer, a human layer, a technical layer, and a physical layer,
wherein the risk-aware problem domain ontology comprises a plurality of analysis models including an attack component model, a risk component model, a security requirement component model, and a domain component model, a plurality of ontologies including domain specified knowledge ontology, APT case knowledge ontology, and general security knowledge ontology, and
wherein the attack component includes attack groups, targets, attack goals and tactics.
7 . The attack risk assessment system of claim 6 , wherein
the business process layer includes information of intangible and tangible activities performed by a corporate, the intangible and tangible activities including corporate management activities that produce services or products for customers,
the human layer includes personal information for a plurality of persons engaging in the corporate, the personal information including personal personnel information, a security degree, and an accessible computing device,
the technical layer includes knowledge technology for producing a product, the knowledge technology including a design technology, a manufacturing technology, and a facility technology for producing the product of the corporate, and
the physical layer includes a computer, a production facility, a manufacturing facility, and a server used by the corporate.
8 . The attack risk assessment system of claim 6 , wherein the security requirement derivation processor identifies the malicious goal and the security goal in the risk component identified by the risk element identification processor.
9 . The attack risk assessment system of claim 6 , wherein the database server uses public knowledge base and threat intelligence managing the information on the APT attack.