US 12,411,946 B2
Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program
Ki Hong Kim, Seoul (KR)
Assigned to SANDS LAB INC., Seoul (KR)
Filed by SANDS LAB INC., Seoul (KR)
Filed on Apr. 24, 2023, as Appl. No. 18/138,447.
Claims priority of application No. 10-2023-0047990 (KR), filed on Apr. 12, 2023.
Prior Publication US 2024/0346135 A1, Oct. 17, 2024
Int. Cl. G06F 21/55 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 21/552 (2013.01); G06F 21/577 (2013.01); G06F 2221/034 (2013.01)] 6 Claims
OG exemplary drawing
 
1. A method of processing cyber threat information, the method comprising:
receiving a file or information on the file from a user through at least one interface,
wherein the file includes either an executable file or non-executable file;
processing cyber threat information on advanced persistent threat (APT) attacks related to the received file or the information on the file,
wherein when the received file is the executable file, a first cyber threat feature being extracted from one or more functions in the file is classified into a first attack technique identifier and a first attack group identifier, and
when the received file is the non-executable file, a second cyber threat feature is extracted from memory data in a suspended state of an application of the non-executable file at the time of executing the application in a kernel area, and the extracted second cyber threat feature is classified into a second attack technique identifier and a second attack group identifier, and
wherein the cyber threat information is generated based on the first or second attack technique identifier and the first or second attack group identifier;
and
performing natural language processing on the cyber threat information and providing a real-time intelligence line feed service on the APT attacks based on the natural language through a user interface.