Modeling of Cyber-attack Intentions Analysis Reflecting Domestic / International Situations

Recently, the aspect of cyber-attack is closely related to the situation in domestic and international situations. Particularly, cyber-attacks are used as means of subjugating, coercing, and expelling opponents to achieve political goals. A cyber-attack may be a goal in itself, but it may also be used as a means to achieve other goals. In the case of North Korea, it has been used as a means of revenge to prevent Sony Pictures' release of the movie, and it is trying to turn the surveillance of neighboring countries through cyber-attacks in order not to detect the nuclear test. Therefore, when analyzing the cyber-attack's goal or intention, it is expected that it will be able to identify more accurate attack intention considering domestic / international situation. We confirmed the reliability through association analysis to identify the relationship between past cyber-attack cases and the situation. And we proposed an intention analysis indicator and a model that can predict cyber-attack intention reflecting domestic / international situation. The proposed model of cyber-attack intention analysis is composed of two analysis modules; a cyber-attack pattern analysis module and a situation reflected intention analysis module. The cyber-attack pattern analysis module identifies attack techniques and targets to predict the result of the cyber-attack. The situation reflected intention analysis module generates the situation indicators and identifies the attack intention by fusing the attack pattern derived from the cyber-attack pattern analysis module.