엔드포인트 환경에서 머신러닝 기반 분석을 위한 악성 Procedure 검증에 대한 연구

Abstract

Recently, many security solutions use machine learning technology. In the endpoint field, EDR (Endpoint Detection and Response) solutions are applying machine learning-based technology. In addition, recently emerged XDR (eXtended Detection and Response) uses machine learning to analyze information in the network area and endpoint area. These solutions extract the features of malicious procedures and perform machine learning-based analysis, which is based on the MITER ATT&CK framework. However, in order to implement the Techniques specified in the MITER ATT&CK framework as a malicious procedure, there is a difficulty in analyzing and implementing the exploit code and tools. In addition, since there are many things that do not work in the real environment, more resources must be put into the task of refining the learning data, such as verifying whether it works and extracting features. Therefore, in this paper, we analyzed the exploit codes and tools used by major hacking groups, implemented a total of 67 malicious procedures, and confirmed that 46 malicious procedures were operating. Through this, it contributed to minimizing the cost required in the process of extracting and refining TTPs-based machine learning learning data in the endpoint environment.