DEFENSE AGENTS APPARATUS BASED ON WHITELIST FOR CYBERSECURITY TRAINING

摘要

The defense agent device for whitelist-based cybersecurity training of the embodiment includes a defense master agent that detects an abnormal behavior based on a whitelist filter and a blacklist filter for cyber behavior in a training environment, and establishes a defense technique according to the abnormal behavior; and a defense slave agent that collects cyber actions in the training environment and transmits them to the defense master agent, and controls the host to perform a defense action according to the defense technique of the defense master agent. The embodiment has the effect of blocking detours that are not defined in advance by adding a threat behavior determination module and a whitelist for blacklist correction to the blacklist-based defense agent used for general defense and training. .