클라우드 환경에서의 ATT&CK 매트릭스 기반 이벤트 로그 분석 프레임워크
Event Log Analysis Framework Based on the ATT&CK Matrix in Cloud Environments
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
클라우드 마이그레이션 증가와 함께 클라우드 컴퓨팅 환경에서의 보안 위협도 급증하고 있다. 이에 효율적인 사고 조사를 수행하기 위한 로그 데이터 분석의 중요성이 강조되고 있다. 클라우드 환경에서는 서비스 다양성과 간편한 리소스 생성 등의 특성으로 인해 대량의 로그 데이터가 생성된다. 이로 인해 사고 발생 시 어떤 이벤트를 조사해야 하는지 판단하기 어렵고, 방대한 데이터를 모두 확인하려면 상당한 시간과 노력이 필요하다. 따라서 데이터를 효율적으로 조사하기 위한 분석체계가 필요하다. AWS(Amazon Web Services)의 로깅 서비스인 CloudTrail은 계정에서 발생한 모든 API 호출 이벤트 로그를 수집한다. 그러나 사고 발생 시 어떤 로그를 분석해야 하는지 판단하기 위한 인사이트 제공 역할은 부족하다. 본 논문에서는 Cloud Matrix와 이벤트 정보를 연계하여 사고 조사를 효율적으로 수행할 수 있도록 하고, 이를 기반으로 사용자 행위 로그 이벤트의 발생 빈도 및 공격 정보를 동시에 확인할 수 있는 자동화 분석 프레임워크를 제안한다. 이를 통해 ATT&CK Framework를 기반으로 주요 이벤트를 식별하고, 사용자 행위를 효율적으로 파악함으로써 클라우드 사고 조사에 기여할 것으로 기대한다.
Abstract
With the increasing trend of Cloud migration, security threats in the Cloud computing environment have also experienced a significant increase. Consequently, the importance of efficient incident investigation through log data analysis is being emphasized. In Cloud environments, the diversity of services and ease of resource creation generate a large volume of log data. Difficulties remain in determining which events to investigate when an incident occurs, and examining all the extensive log data requires considerable time and effort. Therefore, a systematic approach for efficient data investigation is necessary. CloudTrail, the Amazon Web Services(AWS) logging service, collects logs of all API call events occurring in an account. However, CloudTrail lacks insights into which logs to analyze in the event of an incident. This paper proposes an automated analysis framework that integrates Cloud Matrix and event information for efficient incident investigation. The framework enables simultaneous examination of user behavior log events, event frequency, and attack information. We believe the proposed framework contributes to Cloud incident investigations by efficiently identifying critical events based on the ATT&CK Framework.
참고문헌 (30)
- Gartner Forecasts Worldwide Public Cloud End-User Spending to Reach Nearly $600 Billion in 2023, "Gartner", Gartner, ~ (2023)
- James Guffey, "Cloud Service Misconfigurations: Emerging Threats, Enterprise Data Breaches and Solutio", 2023 IEEE 13th Annual Computing and Communication Workshop and Conference (CCWC), pp.806~812 (2023)
- Pranitha Sanda, "An insight into cloud forensic readiness by leading cloud service providers", Computing, 104(9), pp.1~26 (2022)
- "What is AWS CloudTrail?, “CloudTrail”" (2023)[URL]
- "Activity log" (2023)[URL]
- "What is Amazon CloudWatch?, “CloudWatch”" (2023)[URL]
- Hussain Akbar, "Security Issues and challenges in Cloud Computing", International Journal for Electronic Crime Investigation, 7(1), pp.13~32 (2023)
- Jon-Michael Brook, "Top Threats to Cloud Computing: Pandemic 11Deep Dive", Cloud Security Alliance (CSA), ~ (2023)
- Simeen Sheikh, "Automated Resource Management on AWS Cloud Platform", Proceedings of 6th International Conference on Big Data and Cloud Computing Challenges :ICBCC 2019, pp.133~147 (2019)
- "CloudTrail record" (2023)[URL]
- Z. AlSaed, "An Integrated Framework Implementation For Cloud Forensics Investigation Using Logging Tool", 2022 International Conference on Smart Applications, Communications and Networking, pp.1~6 (2022)
- Suleman Khan, "Cloud Log Forensics: Foundations, State of the Art, and Future Directions", ACM Computing Surveys, 49(1), pp.1~42 (2016)
- Kenny Awuson-David, "BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem", Future Generation Computer Systems, 122(2), pp.1~13 (2021)
- Ju Young Kim, "A Study on Transferring Electronic Records from Record Production System to Record Management System Using Cloud Storage", Journal of Korean Society of Archives and Records Management, 19(2), pp.1~24 (2019)
- Benjamin Yankson, "Analysis of the Current State of Cloud Forensics: The Evolving Nature of Digital Forensics", 2019 IEEE, 2019, 1~8
- "Top Cloud Security Challenges in 2023, “Cloud Security”" (2023)[URL]
- "Cloud Matrix" (2023)[URL]
- Chanho Shin, "Cyberattack Goal Classification Based on MITRE ATT&CK : CIA Labeling", Journal of Internet Computing and Services(JICS), 23(6), pp.15~26 (2022)
- P Rajesh, "Analysis Of Cyber Threat Detection And Emulation Using MITRE Attack Framework", 2022International Conference on Intelligent Data Science Technologies and Applications(IDSTA), pp.4~12 (2022)
- "Building a SIEM with AWS ser vices, “SIEM”" (2023)[URL]
- Chen Qian, "A novel method based on data visual autoencoding for time-series classification", Proceedings of the 2015Chinese Intelligent Automation Conference, Lecture Notes in Electrical Engineering, pp.97~104 (2015)
- "Stratus" (2023)[URL]
- "Stratus" (2023)[URL]
- "Sigma" (2023)[URL]
- Chan-Woong Hwang, "MITRE ATT&CK and Anomaly detection based abnormal attack detection technology research", Journal of Information and Security, 21(3), pp.13~23 (2021)
- Shilin He, "Identifying impactful service system problems via log analysis", Proceedings of the 201826th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp.60~70 (2018)
- Paul Agbabian, "Understanding the Open Cybersecurity Schema Framework(OCSF)", ~ (2023)
- Alan D Moore, "Python GUI Programming with Tkinter: Design and build functional and user-friendly GUI applications" (2022), Packt Publishing Ltd
- Alexander M. Kirksharian, "Solving the Skills Gap: A Dynamic Approach to Cybersecurity Training", M.S., pp.2023
- "Credentials from Password Stores: Cloud Secrets Management Stores, “Password Managers”" (2023)[URL]