사이버 킬체인 기반 사이버 지휘통제체계 방어 및 공격 모델 연구 = A Study on Defense and Attack Model for Cyber Command Control System based Cyber Kill Chain

다국어 초록 (Multilingual Abstract)

Cyber Kill Chain is derived from Kill chain of traditional military terms. Kill chain means a continuous and cyclical process from detection to destruction of military targets requiring destruction, or dividing it into several distinct actions. The kill chain has evolved the existing operational procedures to effectively deal with time-limited emergency targets that require immediate response due to changes in location and increased risk, such as nuclear weapons and missiles. It began with the military concept of incapacitating the attacker's intended purpose by preventing it from functioning at any one stage of the process of reaching it. Thus the basic concept of the cyber kill chain is that the attack performed by a cyber attacker consists of each stage, and the cyber attacker can achieve the attack goal only when each stage is successfully performed, and from a defense point of view, each stage is detailed. It is believed that if a response procedure is prepared and responded, the chain of attacks is broken, and the attack of the attacker can be neutralized or delayed. Also, from the point of view of an attack, if a specific response procedure is prepared at each stage, the chain of attacks can be successful and the target of the attack can be neutralized. The cyber command and control system is a system that is applied to both defense and attack, and should present defensive countermeasures and offensive countermeasures to neutralize the enemy's kill chain during defense, and each step-by-step procedure to neutralize the enemy when attacking. Therefore, thist paper proposed a cyber kill chain model from the perspective of defense and attack of the cyber command and control system, and also researched and presented the threat classification/analysis/prediction framework of the cyber command and control system from the defense aspect.

참고문헌 (Reference)

• 1 Dongho Kang, "rule based event correlation approach for physical and logical security convergence" 12 (12): 28-, 2012
• 2 Tarun Yadav, "Technical aspects of cyber kill chain" Springer 438-452, 2015
• 3 "MITRE ATT&CK (Adversarial Tactics, Techniques &Common Knowledge)"
• 4 Sung-young Cho, "Killchain model and cyber threat classification for cyber situational awareness" 149-153, 2017
• 5 Sungyoung Cho, "Cyber Kill Chain based Threat Taxonomy and its Application on Cyber Common Operational Picture" IEEE 1-8, 2018
• 6 Ali Ahmadian Ramaki, "Causal knowledge analysis for detecting and modeling multi-step attacks" Wiley Online Library 9 (9): 6042-6065, 2016
• 7 Bryan Harris, "Breaking the DDoS attack chain" Institute for Software Research 2013
• 8 Sung-young Cho, "Automation Method ofcyber threat scenario analysis and prediction" 564-569, 2018
• 9 Bin Zhu, "Alert correlation for extracting attack strategies" 3 (3): 244-258, 2006
• 10 Chih-Hung Wang, "Alert Correlation System with Automatic Extraction of Attack Strategies by Using Dynamic Feature Weights" International Academy Publishing (IAP) 5 (5): 1-10, 2016