Device, system, method, and computer program for inferring attacker group

A device for inferring an attacker group by analyzing malicious code, the device comprising:

• a processor;
• and
• a memory storing computer-readable instructions,
• wherein the processor is configured to execute the instructions to:
• acquire analysis target files for inferring the attacker group;
• allocate the analysis target files to one or more nodes,
• control the one or more nodes to separately execute the analysis target files in one or more malicious code analysis environments implemented in each of the nodes,
• monitor state information of the one or more malicious code analysis environments by using an event message bus, wherein the state information comprises a pending state (Pending), a running state (Running), a completed state (Completed), and a reported state (Reported) in which events and logs recorded in a malicious code analysis environment are transmitted to an event storage after running of the malicious code analysis environment is completed,
• record events and logs occurring in the one or more malicious code analysis environments,
• transmit events and logs related to the analysis target files to the event storage based on the state information of the one or more malicious code analysis environments being in the completed state,
• receive the state information from the event message bus in real time,
• determine in real time whether all the events and the logs related to the analysis target files have been collected in the event storage based on the state information,
• infer the attacker group by analyzing the collected events and logs when all the events and the logs related to the analysis target files have been collected in the event storage, and
• provide information on the inferred attacker group to a user.

A non-transitory computer-readable recording medium storing a computer program to perform, in combination with a computing device, a method of inferring an attacker group by analyzing malicious code, wherein the method comprises:

• acquiring analysis target files for inferring the attacker group;
• allocating the analysis target files to one or more nodes;
• controlling the one or more nodes to separately execute the analysis target files in one or more malicious code analysis environments implemented in each of the nodes;
• monitoring state information of the one or more malicious code analysis environments by using an event message bus, wherein the state information comprises a pending state (Pending), a running state (Running), a completed state (Completed), and a reported state (Reported) in which events and logs recorded in a malicious code analysis environment are transmitted to an event storage after running of the malicious code analysis environment is completed;
• recording events and logs occurring in the one or more malicious code analysis environments;
• transmitting events and logs related to the analysis target files to the event storage based on the state information of the one or more malicious code analysis environments being in the completed state;
• receiving the state information from the event message bus in real time;
• determining in real time whether all the events and the logs related to the analysis target files have been collected in the event storage based on the state information;
• when all the events and the logs related to the analysis target files have been collected in the event storage, inferring an attacker group by analyzing the collected events and logs;
• and
• providing information on the inferred attacker group to a user.