Electronics and Telecommunications Research Institute

Byeongho Kang

Cheolho Lee

A method for sharing security threat information, performed by an apparatus for sharing security threat information, includes downloading a detection rule from a TAXII server and storing the same in a detection rule and result storage unit; performing detection for a detection target, which includes at least one of an Observed Data object, a file that is not in a STIX format, and a PCAP file, using the detection rule; generating a detection result, which is a result of the detection, using at least one of a Sighting object, a File object, and an Artifact object; and uploading the generated detection result to the TAXII server in order to share security threat information including the detection result.

Growing community of inventors

Seoul, South Korea

Byeongho Kang