[AI Revolution](109) Perfect Analysis of Cyber Threats with AI... Igloo Corporation

Industry's First AI Security Monitoring System Established
Perfect Detection of Abnormal Movements with AI Detection Model 'AiR'

Panorama of the Eglue Corporation Integrated Security Control Center. Photo by Eglue Corporation

As cyber attacks become increasingly sophisticated, companies face growing challenges in analyzing vast amounts of security data within limited timeframes and proactively responding to various new and mutated threats. In particular, security managers are confronted with the critical task of accurately predicting advanced cyber threats to quickly detect and respond to attacks. Amid this, the domestic security company Igloo Corporation is gaining attention by presenting methodologies that simplify and automate security tasks using artificial intelligence (AI).

On the 21st, Jeong Il-ok, head of the Control Technology Research Team at Igloo Corporation, told Asia Economy, "Igloo Corporation, which has made AI its core growth engine, has secured proprietary classification-type and explanatory AI technologies through continuous expansion of research and development investments," adding, "We have launched Korea’s first security service applying ChatGPT and are strengthening generative AI capabilities specialized in security."

The company began AI research and development in 2015, when big data-based SIEM (Security Information and Event Management) technology was gaining prominence. From 2016, when customer demand for AI security began in earnest, it started preparing for the AI business, and in 2018, it completed the construction of the industry’s first AI security control system called the ‘Daegu AI-based Intelligent Security Control System (D-Security),’ proving the efficiency of AI security.

Jeong said, "While striving to maximize the value of accumulated security data and know-how over many years, we became convinced that AI could be a foundational technology to accelerate innovation in security," and explained, "Since then, we have recruited AI experts and devoted efforts to developing algorithms optimized for security."

Jung Il-ok, Head of Control Technology Research Team at Igloo Corporation. Photo by Igloo Corporation

The company’s current flagship service is the hybrid AI detection model service ‘AiR.’ Based on classification-type, explanatory, and generative AI technologies, this service explains the AI model’s prediction results and rationale in natural language. It informs users of the criteria by which AI detected certain behaviors as abnormal or normal and explains AI prediction results based on algorithms or existing pattern-based methods.

The service focuses on providing functions that help security personnel clearly determine and understand whether security logs and events are true or false positives. Users can increase their understanding and trust in AI responses by verifying the AI model’s judgment criteria, enabling more agile responses to attacks.

Jeong stated, "AiR minimizes issues such as generative AI bias, AI algorithm contamination, AI-targeted attacks, and sensitive data leakage," adding, "It also enhances query process stability by applying data anonymization and defense technologies against adversarial AI attacks."

SPiDER TM is another noteworthy service. It offers various tools that allow users to quickly and easily review security event analysis results and related materials. Users can load all logs and full network packet data related to abnormal behavior to verify the validity of attacks more accurately and swiftly. For example, if malware is detected, users can check with just a few clicks what data the malware is sending or receiving, whether other systems are infected, and statistical information and original log evidence to assess the importance of the behavior.

Additionally, the company provides an 'Interactive Dashboard' that intuitively displays meaningful core information that can impact corporate security, known as ‘security intelligence.’ Security managers can instantly check the flow of all information, including real-time failures and threat situations, vulnerable ports, and the progress of detailed log and network packet analysis, allowing them to prioritize tasks. This effectively shortens the attacker’s activity time and prevents greater damage.

Igloo Corporation is also actively expanding its overseas business based on these AI capabilities. It entered the Japanese market by establishing a branch in Tokyo in 2010 and converted the branch into a corporation in early 2017 to conduct active sales activities. The company secured a broad customer network by signing a total distribution and export contract for security control solutions and services with SSK, an information security company located in Osaka, and succeeded in acquiring public institution and large enterprise customers in Japan by partnering with Fujitsu SSL, a subsidiary of Fujitsu Group, Japan’s largest IT company. This year, it plans to expand into Indonesia, Cambodia, and other countries where information security demand is rapidly increasing.

Jeong said, "Based on the AI capabilities accumulated so far, we plan to accelerate the expansion and supply of AI security solutions and services," adding, "We will advance the service by expanding AiR’s functions and improving performance, and also promote overseas exports so that global customers can benefit from the service."