SANDS Lab consortium completes KISA cybersecurity AI dataset project

SANDS Lab consortium completes KISA cybersecurity AI dataset project

• Building global-standard datasets on worldwide threat intelligence and attack groups
• Cross-industry demonstrations validate effectiveness, with third-party quality assurance
• AI and big data security expertise contributes to stronger national cyber threat response

Figure 1. Cybersecurity AI dataset construction project visual

A consortium led by cyber threat intelligence specialist SANDS Lab (CEO Kim Ki-hong) announced on the 15th that it completed the cybersecurity AI dataset updating and enhancement project commissioned by KISA in June 2023.

Accelerating digital transformation driven by AI, IoT and other ICT innovations has created a need for national cybersecurity strategies and AI datasets. Intelligent threats and evolving attack methods limit proactive defense with existing systems alone. The project was therefore launched to maintain updated, enhanced threat information, support private-sector sharing and use, establish a virtuous data cycle and intelligent security environment, and provide AI datasets tailored to private-sector demand.

SANDS Lab formed the consortium with KSIGN (CEO Choi Seung-rak) and IGLOO Corporation (CEO Lee Deuk-chun). Kim personally served as overall project manager to update the 2021 and 2022 datasets to global standards and complete validation through incident-response-based demonstrations.

The large project covered broad activities: constructing and enhancing three datasets on recent incidents, threat intelligence and threat hunting; third-party quality verification through the Telecommunications Technology Association (TTA); more than 30 demonstrations to expand use and validate effectiveness; results-sharing events and medium- and long-term utilization plans; and verification of legal rights requirements.

Figure 2. Metadata structure of the latest incident dataset

For the latest incident dataset, the consortium considered the threat data lifecycle and collected more than 100 million current IoCs—file hashes, IP addresses, domains and URLs—and raw records. These were analyzed and processed into labels and metadata for AI training, enabling timely response to new threats and variants and rapid identification of threat types and related variants in emerging AI-based threats.

Figure 3. Threat intelligence dataset structure

For the threat intelligence dataset, the consortium collected more than 100 million records each of indicators related to targets in ten major industries and processed or analyzed data. It built a knowledge-graph dataset explaining attackers’ intent, objectives and methods, curating data to support security practitioners’ decisions.

Figure 4. Rule sets for each threat hunting stage

The threat hunting dataset focuses on information generation and technologies for anticipating and proactively countering future threats. To prevent potential attacks exploiting political and social issues, the consortium created more than 1,000 hunting rules related to current issues and collected and selected over 100 million associated threat records for private-sector use.

The core objective is for government and industry to jointly build and share global-standard threat intelligence and attack group datasets, strengthening incident response and technology development. These technologies promote intelligent defense systems and AI products and services, improving private-sector security. The datasets are also expected to underpin future generative AI cybersecurity development and other applications.

The work went beyond dataset construction, validating effectiveness through demonstrations across industries to improve AI-based threat response. The consortium held results-sharing and demonstration briefings, then provided tailored validation plans and models through consultations with about 30 companies and institutions in finance, energy, supply chains and other sectors.

To track research trends and develop medium- and long-term AI and big data strategies, the consortium also attended major events including VB2023 in the UK, AVAR in Dubai and AIS in Korea. It shared current trends and technical information while promoting dataset use. In recognition of its social contribution, the dataset work received the Minister of Science and ICT Award at the Korea Internet Awards last month.

Overall project manager Kim Ki-hong said, “Our consortium’s shared commitment, building on previous project experience and technical expertise, enabled us to successfully complete the 2023 dataset project as well. We will continue close cooperation with KISA and strengthen development of better AI models and security technologies to improve national cyber threat response.”