METHOD AND APPARATUS FOR CALCULATING RISK OF CYBER ATTACK

Provided are a method and apparatus for calculating a risk of cyber attacks, and, more particularly to a method and apparatus for calculating a risk of cyber attacks, by which the risk of cyber attacks is quantitatively calculated by analyzing cyber incident information associated with the cyber attacks. The method of calculating a risk, which is performed by a risk calculation apparatus, the method comprises acquiring cyber incident information associated with a risk calculation target attack, the cyber incident information including a plurality of pieces of individual cyber incident information and the plurality of pieces of individual cyber incident information being hierarchically configured, calculating an individual risk index of individual cyber incident information using a predetermined risk calculation criterion and a standard risk index according to the predetermined risk calculation criterion, calculating a level risk index by summing the individual risk indexes for each level of the cyber incident information and calculating a total risk index for the risk calculation target attack using a weight for each predetermined level and the level risk index.