2024.07.26. The Fair Economy — The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) held the "Cybersecurity AI Dataset Development Achievement Sharing Event" on the 26th at the Royal Park Convention in Yongsan-gu, Seoul, to help domestic companies effectively respond, using artificial intelligence (AI), to increasingly complex and intelligent cyberattacks.
A "cybersecurity AI dataset" refers to AI training data gathered by collecting, analyzing, and processing (de-identifying, labeling, etc.) normal and attack data (malicious code, IP addresses, etc.) needed to develop AI-based security products and services.
As AI and digital technology continue to advance and evolve, cyberattacks are also becoming more routine and larger in scale, while new and variant threats that bypass and neutralize existing security technologies continue to increase. Domestic security companies have been striving to introduce AI technology into security in order to respond effectively to cyber threats, but have faced difficulties due to a lack of high-quality AI training data.
In response, the Ministry of Science and ICT and the Korea Internet & Security Agency have been building datasets required for developing security products and services using AI technology since 2021. They are also supporting companies and institutions in demonstrating and utilizing these datasets to promote the application of AI technology and strengthen intelligent capabilities in responding to cyber intrusion incidents.
In 2023, 600 million AI dataset entries were built across three areas—▲latest intrusion incidents, ▲threat hunting, and ▲threat intelligence. Based on these, 40 demand companies and institutions in the public, financial, and security sectors utilized and demonstrated the datasets, yielding improvements such as enhanced detection of attacks like ransomware and greater analysis accuracy.
The threat hunting dataset consists of detection tool (pattern) data that enables preemptive response to potential future attacks (threats), while the threat intelligence dataset is used to analyze and respond to the intent, purpose, and techniques of existing or potential future attacks.
Looking at major demonstration and improvement cases from last year, Gwangju Metropolitan City applied the AI dataset to its employee PC security solution to prevent ransomware infection, becoming the first local government to adopt an AI-based security system. In a mock training exercise against 24 types of ransomware, all 24 were correctly detected, improving detection performance by 40% compared to before.
GC COMPANY Corp implemented AI model support for web log analysis to detect security events (abnormal users, etc.) collected through web page monitoring and to automate the classification of true and false positives. As a result, during the roughly two-month demonstration period, the company automated the classification of about 520,000 attack events detected by its web firewall (achieving a true-positive rate of 99.85%) and cut analysis time from 10 minutes to 1 minute.
Korea Electric Power Corporation received support for a network-based AI model to enable continuous threat analysis for timely response to supply-chain-targeted attacks. During the roughly two-month demonstration period, the corporation diagnosed risks in its internal IT infrastructure—such as security-vulnerable protocols and risky files—based on about 20 million pieces of traffic and about 80,000 files, and was able to reflect the findings in its security policy.
This achievement-sharing event was organized to share dataset development results and best practices with companies and institutions interested in utilizing AI data in the cybersecurity field and related technology development, and to explore ways to make use of them. It featured expert lectures on cybersecurity technology and threats in the AI era (by Professor Kim Ho-won of Pusan National University and Managing Director Lim Wan-taek of KONAN Technology), as well as presentations on AI dataset use cases (by Gwangju Metropolitan City, GC COMPANY Corp, and others).
Jung Chang-rim, Director General for Information Security Network Policy at the Ministry of Science and ICT, said, "We expect that the government's support in building high-quality cybersecurity AI datasets, which are difficult for the private sector to obtain on its own, combined with the private sector's creativity and technical capabilities through demonstration and utilization, will create a significant synergistic effect for the development of our security industry. The Ministry of Science and ICT will continue to build and upgrade cybersecurity AI datasets to strengthen the competitiveness of the domestic cybersecurity market and actively support our companies in leading the world's AI security technology."
0 Comments
No comments yet.