# US 12,762,234 B2 · Device, system, method, and computer program for inferring attacker group

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,762,234 B2
- Document ID: US12762234B2
- Status: Granted
- Kind: B2
- Application number: 18/961,974
- Filed: 2024-11-27
- Published: 2026-03-19
- Granted: 2026-10-13
- Earliest claimed: 2024-09-13
- Assignees: S2W Inc.
- Applicants: S2W Inc.
- Inventors: Jae Ki Kim; Hyung Suk Kim; Seung Hoe Kim
- Web page: https://patentgrep.com/patent/US12762234B2

## CPC

- G06F 21/565: {by checking file integrity}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Provided are a device, system, method, and computer program for inferring an attacker group by analyzing malicious code. The system includes a sandbox pool manager configured to allocate analysis target files for inferring an attacker group to one or more nodes and separately execute the analysis target files in separate malicious code analysis environments by controlling each node, an event manager configured to determine in real time whether all events related to the analysis target files have been collected on the basis of running state information of each node and collect events which are recorded in the malicious code analysis environments of each of the nodes and related to the analysis target files, an attacker group inference part configured to infer an attacker group by analyzing the collected events, and an analysis result provider configured to provide information on the inferred attacker group.

## Claims

### Claim 1

A method of inferring an attacker group by analyzing malicious code, the method comprising:
acquiring analysis target files for inferring the attacker group;
allocating the analysis target files to one or more nodes;
controlling the one or more nodes to separately execute the analysis target files in one or more malicious code analysis environments implemented in each of the nodes;
monitoring state information of the one or more malicious code analysis environments by using an event message bus, wherein the state information comprises a pending state (Pending), a running state (Running), a completed state (Completed), and a reported state (Reported) in which events and logs recorded in a malicious code analysis environment are transmitted to an event storage after running of the malicious code analysis environment is completed;
recording events and logs occurring in the one or more malicious code analysis environments;
transmitting events and logs related to the analysis target files to the event storage based on the state information of the one or more malicious code analysis environments being in the completed state;
receiving the state information from the event message bus in real time;
determining in real time whether all the events and the logs related to the analysis target files have been collected in the event storage based on the state information;
when all the events and the logs related to the analysis target files have been collected in the event storage, inferring the attacker group by analyzing the collected events and logs; and
providing information on the inferred attacker group to a user.

### Claim 2 (depends on 1)

The method of claim 1, wherein the inferring of the attacker group comprises inferring the attacker group using an artificial intelligence model that receives the collected events and logs,
the artificial intelligence model is a neural network model that is trained using a plurality of sigma rules stored in a sigma rule storage as training data, and
the plurality of sigma rules represent patterns of attack events of each of attacker groups.

### Claim 3 (depends on 2)

The method of claim 2, wherein the inferring of the attacker group comprises inferring the attacker group based on similarity information derived by comparing the collected events with each of the plurality of sigma rules.

### Claim 4 (depends on 2)

The method of claim 2, wherein the sigma rules comprise one or more predefined attack patterns, and the one or more predefined attack patterns are data consisting of a combination of an order of process generation events, an order of file creation or removal, and information on an action chain.

### Claim 5 (depends on 1)

The method of claim 1, wherein the controlling of the one or more nodes comprises:
allocating a file group including one or more files dependent on each other among the analysis target files to a first node; and
controlling the first node to execute the one or more files in a first malicious code analysis environment implemented in the first node.

### Claim 6 (depends on 5)

The method of claim 5, wherein the allocating of the file group comprises allocating a first execution file among the analysis target files and one or more dynamic libraries or temporary files that are referred to by the first execution file to the first node.

### Claim 7 (depends on 6)

The method of claim 6, wherein the recording of the events and the logs comprises recording events including instructions executed by the first execution file or logs recorded by the first execution file, events related to one or more registries manipulated by the first execution file, and instructions periodically or simultaneously performed by the one or more manipulated registries until running of the first malicious code analysis environment is finished.

### Claim 8 (depends on 5)

The method of claim 5, wherein the controlling of the one or more nodes comprises, based on a manager's scale-out setting, allocating a plurality of file groups to the first node and controlling the first node to simultaneously execute all files in the plurality of file groups.

### Claim 9

A device for inferring an attacker group by analyzing malicious code, the device comprising:
a processor; and
a memory storing computer-readable instructions,
wherein the processor is configured to execute the instructions to:
acquire analysis target files for inferring the attacker group;
allocate the analysis target files to one or more nodes,
control the one or more nodes to separately execute the analysis target files in one or more malicious code analysis environments implemented in each of the nodes,
monitor state information of the one or more malicious code analysis environments by using an event message bus, wherein the state information comprises a pending state (Pending), a running state (Running), a completed state (Completed), and a reported state (Reported) in which events and logs recorded in a malicious code analysis environment are transmitted to an event storage after running of the malicious code analysis environment is completed,
record events and logs occurring in the one or more malicious code analysis environments,
transmit events and logs related to the analysis target files to the event storage based on the state information of the one or more malicious code analysis environments being in the completed state,
receive the state information from the event message bus in real time,
determine in real time whether all the events and the logs related to the analysis target files have been collected in the event storage based on the state information,
infer the attacker group by analyzing the collected events and logs when all the events and the logs related to the analysis target files have been collected in the event storage, and
provide information on the inferred attacker group to a user.

### Claim 10

A non-transitory computer-readable recording medium storing a computer program to perform, in combination with a computing device, a method of inferring an attacker group by analyzing malicious code, wherein the method comprises:
acquiring analysis target files for inferring the attacker group;
allocating the analysis target files to one or more nodes;
controlling the one or more nodes to separately execute the analysis target files in one or more malicious code analysis environments implemented in each of the nodes;
monitoring state information of the one or more malicious code analysis environments by using an event message bus, wherein the state information comprises a pending state (Pending), a running state (Running), a completed state (Completed), and a reported state (Reported) in which events and logs recorded in a malicious code analysis environment are transmitted to an event storage after running of the malicious code analysis environment is completed;
recording events and logs occurring in the one or more malicious code analysis environments;
transmitting events and logs related to the analysis target files to the event storage based on the state information of the one or more malicious code analysis environments being in the completed state;
receiving the state information from the event message bus in real time;
determining in real time whether all the events and the logs related to the analysis target files have been collected in the event storage based on the state information;
when all the events and the logs related to the analysis target files have been collected in the event storage, inferring an attacker group by analyzing the collected events and logs; and
providing information on the inferred attacker group to a user.