클러스터 기반 IT 자산들의 유사도 계산: 공격자의 다음 목표를 탐지하는 방법
Cluster-Based Similarity Calculation of IT Assets: Method of Attacker's Next Targets Detection
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
공격자들은 공격 대상인 IT 자산을 찾을 때 자신이 가지고 있는 유사한 취약점을 사용하는 경향이있다. 따라서 IT 자산 중 표적이 될 수 있는 유사한 운영체제, 애플리케이션이 있을 때 이를 사전에찾아내는 것이 중요하다. 본 논문은 효율적인 취약자산 관리 및 제로데이 대응을 위한 새로운 접근방식을 제안한다. 해당 방법론은 클러스터링과 유사도 계산 결과를 기반으로 새로운 취약점이나 이미발견된 취약점에 의해 감염될 가능성이 있는 IT 자산을 탐지하는 기능을 제공한다. 실험 결과, 수집된전체 자산의 86%의 정확도로 클러스터의 목적에 맞게 분류되었으며, 무작위 자산을 선정하여 유사성계산 실험을 한 결과 동일한 운영체제 및 서비스를 사용하는 자산이 나열됐다.
Abstract
Attackers tend to use similar vulnerabilities when finding their next target IT assets. They also continuously search for new attack targets. Therefore, it is essential to find the potential targets of attackers in advance. Our method proposes a novel approach for efficient vulnerable asset management and zero-day response. In this paper, we propose the ability to detect the IT assets that are potentially infected by the recently discovered vulnerability based on clustering and similarity results. As the experiment results, 86% of all collected assets are clustered within the same clustering. In addition, as a result of conducting a similarity calculation experiment by randomly selecting vulnerable assets, assets using the same OS and service were listed.
참고문헌 (17)
- L. Allodi, "Economic factors of vulnerability trade and exploitation", Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp.1483~1499 (2017)
- "Cost of a data breach 2023 a million-dollar race to detect and respond" (2022)[URL]
- M. Kozlovszky, "Cloud security monitoring and vulnerability management", Proc. IEEE 17th Int. Conf. Intell. Eng. Syst. (INES), pp.265~269 (2013)
- M. Nyanchama, "Enterprise vulnerability management and its role in information security management", Inf. Secur. J. A Glob. Perspect, 14(3), pp.29~56 (2005)[DOI]
- Juan Fco Gómez, "Risk-Based Criticality for Network Utilities Asset Management", IEEE Transactions on Network and Service Management (2019)[DOI]
- A. Li, "Generating interpretable network asset clusters for security analytics", 2018 IEEE International Conference on Big Data (Big Data), pp.2972~2979 (2018), IEEE
- D. Everson, "Network attack surface simplification for red and blue teams", 2020 IEEE Secure Development (SecDev), pp.74~80 (2020), IEEE
- G. Dupont, "Similarity-based clustering for iot device classification", 2021 IEEE International Conference on Omni-Layer Intelligent Systems (COINS), pp.1~ (2021), IEEE
- D. Tovarňák, "Graph-based cpe matching for identification of vulnerable asset configurations", 2021IFIP, 2021, 986~991
- Diaz-Honrubia, A. J., "A trusted platform module-based, pre-emptive and dynamic asset discovery tool", Journal of Information Security and Applications, 71, pp.103350~ (2022)[DOI]
- "criminalip" (2022)[URL]
- "Nmap" (1997)[URL]
- Common platform enumeration: Name matching specification version 2.3, "E. a. Mary", NIST, ~, pp.RFC 7696 (2011)
- W. Zhang, "A comparative study of tf* idf, lsi and multi-words for text classification", Expert systems with applications, 38(3), pp.2758~2765 (2011)[DOI]
- A. Kapoor, "A comparative study of k-means, k-means++ and fuzzy c-means clustering algorithms", 20173rd international conference on computational intelligence &communication technology (CICT), pp.1~ (2017), IEEE
- F. Nielsen, "Introduction to HPC with MPI for Data Science", pp.195~211 (2016)
- D. W. Richardson, "The limits of automatic os fingerprint generation", Proceedings of the 3rd ACM workshop on Artificial intelligence and security, pp.24~34 (2010)