METHOD AND APPARATUS FOR CLASSIFYING CYBER KILL CHAIN IN GRAPH DATABASE CORRESPONDING INCIDENT

摘要

The cyber kill chain classification method in the infringement accident graph database according to an embodiment of the present invention is characterized in that the cyber kill chain (CKC) classification apparatus includes all the nodes (nodes) constituting the infringement accident graph database Generating a CKC attribute on the cyber kill chain and initializing the generated CKC attribute value, the cyber kill chain classifier selecting a single infringement incident for CKC classification in the infringement accident graph database, The classifying device selects one or more of the first to third CKC classification criteria with respect to a connection which is an attribute given to all the nodes constituting the selected single infringement accident and all the edges connecting the nodes Performing the CKC classification using the CKC classification result, And updating the initialized CKC attribute value for all the nodes constituting the selected single infringement accident.