[Public Project Zoom-In] KSD to Deploy AI Security Monitoring to Counter "Frontier AI Autonomous Attacks"

The Korea Securities Depository (KSD) is pushing ahead with a project to operate an AI-based security monitoring center to counter frontier AI autonomous attacks. As of Oct. 10 on the Public Procurement Service’s NaraJangteo system, the existing contract for operating the "KSD Cyber Security Monitoring Center" is set to expire on Dec. 31 this year. In response, KSD is working to establish the next monitoring operation system.

The Korea Securities Depository (KSD) operates core IT infrastructure for the capital market. High-level security is required to protect that infrastructure. This project aims to respond to cyberattacks that abuse AI.

The core of the project is to add AI-based automated anomaly analysis to 24-hour security monitoring. KSD believes the emergence of high-risk AI agents has brought AI-driven cyberattack threats into full swing. It also sees the speed and sophistication of cyberthreats rising sharply as AI-enabled attacks increase.

KSD says the existing monitoring system has relied on Rule-based detection and manual analysis. Accordingly, it believes the current approach is insufficient for rapid detection and response to new and variant attacks. To address these limitations, it is pushing ahead with operating the security monitoring center by introducing AI-based automated analysis.

KSD plans to combine AI with its existing dispatched monitoring operations, improve the monitoring process, strengthen cyberattack detection capabilities, maintain the quality of security monitoring, and secure operational stability. To that end, it set the project period from Jan. 1, 2027, to Dec. 31, 2029, pursued a three-year multi-year contract, and budgeted about KRW 8 billion.

The security monitoring operation will run 24/7, analyzing logs from 177 monitored devices and carrying out anomaly detection and response. If an attack above a certain level occurs, it will immediately report to the person in charge and block attacks above a certain level. KSD decided to add two CERT analysts, citing the increase in threats to be analyzed, including AI attacks, and the need for specialized personnel to verify and judge responses to new AI detection events.

The system to be introduced is an AI-based anomaly analysis system. It collects traffic from external users accessing KSD’s public services and trains and analyzes the collected traffic with a dedicated AI model. Using request data content, whether threat factors are included, and access patterns such as access time and frequency as criteria, it distinguishes normal access from abnormal access. Related alerts are automatically correlated and summarized to shorten response times. The anomaly detection results are provided in a way that presents anomaly scores and contributing factors, and KSD included explainability for the basis of detection as a requirement.

KSD will build an AI-based security system inside its organization, including a server for operating an LLM. The system will make it possible to load, infer, and update AI models on an internet-isolated closed network. KSD will also automate analysis work that CERT members previously handled manually. KSD said this is not intended to reduce staff. It also said AI will monitor threats that people may miss, expanding the scope of detection.

KSD will also improve its detection and response system. It will introduce eight DDoS defense devices to build a standing defense system across all connected segments. It will also respond by immediately blocking large-scale or high-risk attacks when detected. In the intrusion incident analysis environment, it will deploy forensic tools and imaging equipment. It will also introduce an ASM service to continuously inspect externally exposed assets and vulnerabilities.

Eligibility to participate in the bid is limited to security monitoring specialist companies under the National Cybersecurity Management Regulations. Subcontracting and joint procurement are both prohibited. KSD cited the need for specialized technology in the information security field and the requirement to secure security as reasons for this project.

KSD has set the goal of this project as preparing for frontier AI autonomous attacks, and it expects to strengthen cyberattack response capabilities by automating the detection of new and variant threats and automating threat analysis and judgment tasks.

Source: IT DAILY · Yang Seung-gap
Original: https://www.itdaily.kr/news/articleView.html?idxno=242817

References

• https://www.itdaily.kr/news/articleView.html?idxno=242817