Method for analysing cyber threat intelligence data and apparatus thereof

A cyber threat intelligence data analyzing apparatus, comprising:

• a processor;
• and
• a memory storing one or more instructions executed by the processor,
• wherein the one or more instructions includes:
• acquiring a first CTI graph including a first vertex composed of first CTI data classified based on a first classification item and a second CTI graph including a second vertex composed of second CTI data classified based on the first classification item;
• classifying the first CTI data and the second CTI data based on a second classification item determined depending on the first classification item;
• outputting a graph similarity of the first CTI graph and the second CTI graph determined based on a first CTI similarity between the first CTI data and the second CTI data when the first CTI data and the second CTI data belong to the same classification as a result of the classification;
• setting the first CTI graph and the second CTI graph to be included in one group when the graph similarity is equal to or greater than a threshold value;
• and
• outputting CTI information including the first CTI data and the second CTI data for each group.

A computer program stored in a non-transitory computer-readable storage medium, wherein instructions of the computer program, when executed by a processor of a cyber threat intelligence data analyzing apparatus, cause the system to perform:

• acquiring a first CTI graph including a first vertex composed of first CTI data classified based on a first classification item and a second CTI graph including a second vertex composed of second CTI data classified based on the first classification item;
• classifying the first CTI data and the second CTI data based on a second classification item determined depending on the first classification item;
• outputting a graph similarity of the first CTI graph and the second CTI graph determined based on a first CTI similarity between the first CTI data and the second CTI data when the first CTI data and the second CTI data belong to the same classification as a result of the classification;
• setting the first CTI graph and the second CTI graph to be included in one group when the graph similarity is equal to or greater than a threshold value;
• and
• outputting CTI information including the first CTI data and the second CTI data for each group.

A cyber threat intelligence analysis system, comprising:

• a threat information storage/management platform recording first CTI data collected through a first channel in a first vertex of a first CTI graph and recording second data through a second channel in a second vertex of a second CTI graph;
• a database storing the first CTI graph and the second CTI graph;
• a threat information classification module classifying the first CTI data and the second CTI data based on a first classification item;
• and
• a cyber threat intelligence data analyzing apparatus classifying the first CTI data and the second CTI data based on a second classification item determined depending on the first classification item, outputting a graph similarity of the first CTI graph and the second CTI graph determined based on a first CTI similarity between the first CTI data and the second CTI data when the first CTI data and the second CTI data belong to the same classification as a result of the classification, setting the first CTI graph and the second CTI graph to be included in one group when the graph similarity is equal to or greater than a threshold value, and outputting CTI information including the first CTI data and the second CTI data for each group.