Cyber threats are becoming increasingly diverse, sophisticated, and intelligent, posing significant challenges in various domains. Among these threats, advanced persistent threat (APT) attacks are particularly concerning because of sustained and intelligent assault tactics. These attacks have a tendency to continuously expand the scale of the damage during the attack stage. This study developed novel attack-inference techniques for significantly minimizing cyberattack damage. By proactively identifying potential additional attacks, the impact of APT attacks is mitigated. Cyberattack points are anticipated, and attack types are discerned using the compositional patterns of pretrained threat payloads and the continuous correlations inherent in these attacks. The cyber-threat inference method minimizes damage through early detection and blocking of successive attacks using a threat class sequence system (TCSS). Experiments were conducted using 12,054,842,738,181 extensive real-world security device events collected by more than 420 companies. To assess the efficacy of TCSS in detecting connected attacks, a 39-month threat dataset comprising 27,832,130 instances manually analyzed by real-world security analysts was utilized. The analysis confirmed the necessity of TCSS, revealing it could identify 63.99% of successive attack patterns. Various experimental results demonstrate the superiority of TCSS over comparable methods, achieving an impressive 98.73% post-connection attack detection rate. TCSS outperformed other similar methods in terms of true positive rate by 15.62% to 3.37%. By preemptively blocking persistent cyber threats, TCSS is highly effective in minimizing cyberattack damage. In particular, TCSS shows promising potential for proactive defense of cyberattacks, including APT in security operations center goals.

Deep learning (DL)-based threat classification has been investigated for effective analysis of threat events to minimize the human's resources in security operation centers (SOC). However, human-labeling (HL) by SOC security analysts is still necessary for accurate classification and responses to the unknown threat events or new threat trends. This labeling process consumes significant time and effort, posing limitations in constructing an efficient SOC response system, especially for immediate responses to newly generated large-scale threats. To address this, we propose a new self-training method of threat classification model, PLC-TPA. We present a self-training pipeline based on pseudo-labeling with confidence (PLC) for automatic labeling of newly captured threats. To resolve the class imbalance during self-training, we present a novel threat-payload centric augmentation (TPA) method considering threat-payload characteristics. Through extensive experiments, we show that PLC-TPA achieves a high accuracy of threat classification about 0.973 to 0.988 of F1-score, which improves other self-training methods by 10.9% to 13.4%. Notably, PLC-TPA performs comparable even to HL with significantly faster response times. These findings suggest substantial improvements in DL-based SOC environments with the proposed PLC-TPA. PLC-TPA also outperforms the existing methods by 8.3% to 17.4% in comparative experiments.

Ransomware encrypts targeted files, making recovery difficult using conventional disinfection or deletion methods, unlike other types of malware. In particular, ransomware commonly encrypts important documents as a follow-up action, and existing antivirus programs are fundamentally incapable of preventing them. In this study, we analyzed 97 real-world ransomware behaviors and found that 95.88% of them involved encryption attempts. Consequently, we propose a real-time method for determining whether critical files have been compromised through encryption and for recovering them accordingly. The proposed Simple Format Analysis (SFA) detection technique consists of three methods: Simple Format Analysis–Fixed-structure-based (SFA-F), which analyzes the file format; Simple Format Analysis–Header-based (SFA-H), which focuses on file header information; and Simple Format Analysis—Fixed-structure-and-Header-based (SFA-F-H), a hybrid method that combines both. These techniques achieved detection accuracies ranging from 95.0% (SFA-F) to 97.9% (SFA-F-H), outperforming existing detection approaches. In addition, we introduce a novel real-time recovery approach known as real-time file restoration from damage, which integrates SFA detection with pre-input/output monitoring. We expect the proposed approach to significantly contribute to ransomware mitigation in cybersecurity environments.