Method and system for identifying attack infrastructure

Patent metadata

Field	Value
Publication number	US-12464004-B1
Application number	US-202519037886-A
Country	US
Kind code	B1
Filing date	Jan 27, 2025
Priority date	Dec 27, 2024
Publication date	Nov 4, 2025
Grant date	Nov 4, 2025

Abstract

There is provided a method for identifying attack infrastructure, performed by a computing system. The method may comprise collecting network traffic data of a host device that is the target of a security incident, acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment, automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, wherein the attack infrastructure corresponds to resources utilized by an attacker during the security incident.

First claim

What is claimed is:

1 . A method for identifying attack infrastructure, performed by a computing system, the method comprising:
collecting network traffic data of a host device that is the target of a security incident; acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment; automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model; and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, wherein the attack infrastructure corresponds to resources utilized by an attacker during the security incident, wherein the predefined classification model includes first attack infrastructure used to attack a network and second attack infrastructure compromised by the attacker, wherein each of the first attack infrastructure and the second attack infrastructure includes a plurality of attack infrastructures corresponding to different data, and wherein the automatically identifying the attack infrastructure comprises: identifying the first attack infrastructure or the second attack infrastructure; and identifying third attack infrastructure corresponding to the first data, the second data, and the third data among the plurality of attack infrastructures included in the identified attack infrastructure.

2 . The method of claim 1 , wherein the attack infrastructure includes the first attack infrastructure, which is a resource owned by the attacker to attack the network that includes the host device.

3 . The method of claim 2 , wherein the first attack infrastructure includes at least one of Virtual Private Network (VPN), The Onion Router (TOR), proxy, Layer 2 Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP), and botnet.

4 . The method of claim 1 , wherein
the attack infrastructure includes the second attack infrastructure, which is a resource owned by a third party other than the attacker and compromised by the attacker.

5 . The method of claim 4 , wherein the second attack infrastructure includes at least one of Network-Attached Storage (NAS), malware, web hosting, Domain Name System (DNS), Network Time Protocol (NTP) server, and network equipment.

6 . The method of claim 1 , further comprising:
mapping the identified attack infrastructure to Tactics, Techniques, and Procedures (TTPs) in the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework.

7 . The method of claim 1 , wherein the automatically identifying the attack infrastructure further comprises: updating the predefined classification model automatically if the attack infrastructure corresponding to the first data, the second data, and the third data is not defined in the predefined classification model.

8 . The method of claim 1 , wherein the automatically identifying the attack infrastructure further comprises: acquiring an IP address of the attacker who has used the attack infrastructure; collecting first network traffic data associated with the acquired IP address; acquiring, from the first network traffic data, first derived data regarding port numbers recorded in the first network traffic data, second derived data regarding protocols recorded in the first network traffic data, and third derived data regarding textual information included in network packets recorded in the first network traffic data or category information provided by network equipment; and automatically identifying fourth attack infrastructure corresponding to the first derived data, the second derived data, and the third derived data by using the predefined classification model.

9 . A system for identifying attack infrastructure, comprising:
a communication interface; a memory in which a computer program is loaded; and at least one processor executing the computer program, wherein the computer program includes instructions for performing the operations of: collecting network traffic data of a host device that is the target of a security incident; acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment; automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model; and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, the attack infrastructure corresponds to resources utilized by an attacker during the security incident, the predefined classification model includes first attack infrastructure used to attack a network and second attack infrastructure compromised by the attacker, and each of the first attack infrastructure and the second attack infrastructure includes a plurality of attack infrastructures corresponding to different data, and wherein the operation of automatically identifying the attack infrastructure comprises: identifying the first attack infrastructure or the second attack infrastructure; and identifying attack infrastructure corresponding to the first data, the second data, and the third data among the plurality of attack infrastructures included in the identified attack infrastructure.

10 . The system of claim 9 , wherein the attack infrastructure includes the first attack infrastructure, which is a resource owned by the attacker to attack the network that includes the host device.

11 . The system of claim 10 , wherein the first attack infrastructure includes at least one of Virtual Private Network (VPN), The Onion Router (TOR), proxy, Layer 2 Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP), and botnet.

12 . The system of claim 9 , wherein the attack infrastructure includes the second attack infrastructure, which is a resource owned by a third party other than the attacker and compromised by the attacker.

13 . The system of claim 12 , wherein the second attack infrastructure includes at least one of Network-Attached Storage (NAS), malware, web hosting, Domain Name System (DNS), Network Time Protocol (NTP) server, and network equipment.

14 . The system of claim 9 , wherein the computer program further includes instructions for performing the operation of mapping the identified attack infrastructure to Tactics, Techniques, and Procedures (TTPs) in the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework.

15 . The system of claim 9 , wherein the operation of automatically identifying the attack infrastructure further comprises: updating the predefined classification model automatically if the attack infrastructure corresponding to the first data, the second data, and the third data is not defined in the predefined classification model.

16 . The system of claim 9 , wherein the operation of automatically identifying the attack infrastructure further comprises: acquiring an IP address of the attacker who has used the attack infrastructure; collecting first network traffic data associated with the acquired IP address; acquiring, from the first network traffic d

Assignees

• Korea Internet & Security Agency

Inventors

• Jeong Jae Han
• Go Woong
• Shin Sam Shin
• Oh Sung Taek
• Kim Su Jeong

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title