Security management device using security log data analysis and method thereof

Abstract

To provide a security management device using security log data analysis and a method thereof.SOLUTION: In a security management system 100, a security management device includes: a communication unit which receives, from the outside, security log data or security log data determined to be an attack event; a log analysis unit which analyzes security log data and extracts field information from each security log data; a log shaping unit which shapes the extracted field information into a standard format; and a security event danger degree determination unit which determines whether or not security log data shaped by the log shaping unit is an attack event by using an artificial intelligence learning model for determining a danger degree of security log data learned in advance by using security log data of the standard format shaped by the log shaping unit, and provides, as an output value, the danger degree with respect to the security log data determined to be the attack event.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] This embodiment relates to a security operation device and method that uses security log data analysis to convert security log data from different models into a defined standard format, making it easier to respond to attack events that occur in a variety of situations. [Background technology]

[0002] The material described in this section merely provides background information about the present embodiment and does not constitute prior art.

[0003] As most of the work in modern society is done through the internet, various security threats targeting institutions, companies, industrial organizations, banks, etc. are gradually increasing. In addition, new variants and various threats using complex attack techniques have emerged due to the development of IT, and the number of threats from hackers and information theft attacks is also increasing. There are an increasing number of cases where institutions are unable to prevent damage despite introducing many security solutions, and the security field is facing the limits of its capabilities due to these threats. As a result, security event monitoring that detects attacks attempting to cross network boundaries using firewalls, intrusion prevention and detection systems, DDoS devices, L7 firewalls, web firewalls, and vaccines is absolutely necessary, and full-scale security operations have begun.

[0004] The Security Operations Center (SOC) is an operation center that collects and processes security event information due to the spread of such intelligent threats. Security analysts at the SOC are responsible for detecting abnormal signs and analyzing and resolving various tasks that occur in the security system. Security analysts mainly monitor the network to detect and analyze threats and respond to incidents, and then prepare reports on the incidents. In the detection step, abnormal behavior and risk factors are identified using security tools. The next step is analysis, in which the data contained in the logs that record the detected events is analyzed to understand the level and cause of the threat. In the response step, a response strategy is created and implemented based on the results of the analysis. Finally, security analysts record and report the process of handling security incidents, the results of handling, and future measures. To do this, security analysts must use various security tools and systems, monitor the network in real time to detect abnormal behavior, and investigate the causes, results, and effects of attack events that have already occurred in order to prepare for the next one. Security analysts go through all the above mentioned processes to raise the security level and enable institutions, companies, industrial entities or banks to protect their assets and stabilize their working environment.

[0005] In the conventional security operation center, security analysts respond to every attack event and take measures one by one. However, this response method causes the following problems:

[0006] First, because attack events have various scales, patterns, and complexities, security analysts had to check and respond to every single event in the past. However, there are times when no attack events are received, and when they are received, there are times when thousands to tens of thousands of attack events are received within a few minutes, making it physically impossible for security analysts to concentrate and understand all attack events and respond appropriately. When monitoring security events, the security operation center only analyzes the security log data contained in the logs that record the detected attack events to understand the level and cause of the threat, but it cannot show security analysts how dangerous each security log data is or whether there is a correlation between the security log data. Therefore, security analysts have difficulty not only accurately recognizing the current state of the security risk, but also at a glance which attack event to respond to first. In addition, security analysts have had to look back on how they responded to the same attack in the past and deal with it, but it is physically difficult to find past attack events that match various attack events, and it is also very difficult to check the processing process and processing results.

[0007] Second, it takes a long time to respond to an attack event. For a novice security analyst, it usually takes a long time to analyze complex attack patterns and take appropriate countermeasures, and more damage occurs in the meantime. For example, a DDoS attack can paralyze the entire network within a few minutes, so a response to such a security event must be made very quickly. However, the timing at which security analysts respond to an attack event may differ depending on the individual's capabilities, which can make it difficult to respond appropriately, and there is also a problem of insufficient consistency in judgments and response methods for the same event due to differences in knowledge and experience among security analysts.

[0008] The biggest challenge is the issue of expanding personnel and increasing workload. Security event monitoring must be done continuously, so many security analysts are needed. Normally, a security operation center of a certain size expands the number of security analysts and monitors security events continuously through shift work, but since security analysts have to perform the above-mentioned tasks for every attack event, there is a problem that their judgment and concentration are greatly hindered.

[0009] Meanwhile, in the conventional security operation center, security log data for security devices including many different types of hardware security devices and software security programs have different formats, which makes it inconvenient to analyze and respond to each attack event one by one. In addition, when learning security log data of different types with an artificial intelligence-based algorithm, the data format of each security log data is not unified, so many algorithms must be used depending on each data format. That is, in order to automate the classification, processing, and analysis of different types of logs that use different logs for each security device, different algorithms and artificial intelligence learning models must be used for each type of log, which makes it difficult to apply learning using different types of logs.

[0010] Currently, different log structures are used for each security program and development company, and security log data needs to be unified into one standard format in order to learn, verify, and realize using an artificial intelligence learning model. For example, in the case of a vaccine, the security log data includes information such as the target PC, serial number, log ID, malicious code generation path, treatment status, inspection method, user, connection status, and infected person, in the case of a firewall, the security log data includes information such as the target address, source port, target port, cause, link tag, NAT source port, NAT source address, NAT target address, and NAT link tag, in the case of DDoS response, the security log data includes information such as date, protocol, source IP, source port, target IP, and target port, and security log data for web firewalls, DRM, etc. also uses various formats for each device.

[0011] Therefore, in order to automatically analyze security log data using an artificial intelligence learning model, it is necessary to apply security log data from various security devices as learning data, and it is necessary to unify the security log data obtained from multiple security devices to enable efficient operation. Summary of the Invention [Problem to be solved by the invention]

[0012] One embodiment of the present invention aims to provide a security management device and method that converts and processes heterogeneous security log data contained in logs recording detected attack events into a defined standard format during security event monitoring, efficiently processes the security log data based on a rule base that reflects the feedback results of countermeasures for the attack events, analyzes the attack pattern of security attack events performed from an external device to calculate the risk level of the security log data, and then visualizes the analysis results of the security log data in different manners depending on the calculated risk level, and visualizes the attack area in which the attack event occurs, and the type and frequency of the security attack events, and provides them to a security analysis device. [Means for solving the problem]

[0013] According to one aspect of this embodiment, the system includes a communication unit that receives security log data or security log data that has been determined to be an attack event or has been determined to be an attack event and processed from the outside; a log analysis unit that analyzes the security log data received by the communication unit to detect each data and event contained in each security log data and extract field information from each security log data; a log formatting unit that formats the field information extracted from the log analysis unit into a standard format; and a security event risk determination unit that uses the security log data in the standard format formatted by the log formatting unit to determine whether the security log data formatted by the log formatting unit is an attack event based on an artificial intelligence learning model that determines the risk level of security log data that has been pre-learned, and provides the risk level of the security log data determined to be an attack event as an output value.

[0014] According to one aspect of this embodiment, the standard format formatted by the log formatting unit is characterized by including one or more of the following: log source, event name, source IP address, target IP address, MAC address, security log data importance, status code, requested data, requested data length, protocol, file name, and original file.

[0015] According to one aspect of this embodiment, when there is no data in each security log data that corresponds to a data field in the standard format, the log formatting unit fills the data with either a null or a padding value, thereby integrating and processing security log data from different models into one standard format.

[0016] According to one aspect of this embodiment, the system further includes a visualization unit that visualizes the current state of security risk based on information regarding the risk level or attack status for the security log data determined by the security event risk determination unit.

[0017] According to one aspect of this embodiment, the visualization unit is characterized in providing risk table information including IP information obtained from the security log data, attack time and attack type corresponding to the IP information, risk level, and processing status.

[0018] According to one aspect of the present embodiment, the visualization unit displays attack events whose risk level determined by the security event risk determination unit is below a preset reference value in a low risk table, and displays attack events whose risk level determined by the security event risk determination unit exceeds the preset reference value in a medium / high risk table.

[0019] Meanwhile, according to another aspect of this embodiment, there is provided a communication unit that receives security log data or security log data that has been determined to be an attack event or has been determined and processed from the outside, a security event risk determination unit that determines whether each security log data is an attack event based on an artificial intelligence learning model that determines the risk level of pre-learned security log data, and provides the risk level for the security log data determined to be an attack event as an output value, and a security event automatic processing unit that directly processes an attack event whose risk level determined by the security event risk determination unit is equal to or lower than a preset reference value, based on a predetermined rule base and a processing result for the attack event that has been previously stored, and and a security event processing suggestion unit that, for an attack event whose risk level determined by the security event risk level determination unit is equal to or greater than a preset reference value, provides a countermeasure for the attack event by referring to previously processed attack events and countermeasures for each attack event and receives a satisfaction level for the countermeasure provided from a security analysis device used by a security analyst; and a security event recommendation order management unit that, for an attack event whose risk level determined by the security event risk level determination unit is equal to or greater than a preset reference value, recommends at least one of countermeasures based on a priority order of satisfaction levels for attack events similar to the attack event equal to or greater than a preset reference value within prestored processing results for the attack events, countermeasures based on the number of times used in security processing, or countermeasures recently selected.

[0020] According to one aspect of this embodiment, the security event recommendation order management unit searches for attack events similar to attack events whose risk level determined by the security event risk determination unit is equal to or higher than a preset reference value within pre-processed attack events and countermeasures for each attack event, and then sorts the list of countermeasures provided as a result of the search in order of highest satisfaction to provide a first recommendation list.

[0021] According to one aspect of this embodiment, the security event recommendation order management unit determines whether the difference in satisfaction between the attack event with the highest satisfaction and its countermeasure and other countermeasures is equal to or greater than a predetermined error range, determines whether there is a single countermeasure in the first recommendation list that has a higher satisfaction level than the other countermeasures by equal to or greater than the predetermined error range, and recommends the attack event and its countermeasure as the optimal countermeasure.

[0022] According to one aspect of this embodiment, when there are multiple countermeasures that have a satisfaction level higher than other countermeasures by more than a predetermined error range, the security event recommendation order management unit provides a second recommendation list by arranging the multiple countermeasures in order of the number of times they have been used in security processing, and recommends the countermeasure in the second recommendation list that has the highest satisfaction level and the highest number of times it has been used in security processing.

[0023] According to one aspect of this embodiment, the security event recommendation order management unit is characterized in that, if there is one or more countermeasures in the second recommendation list whose number of times they have been used in security processing is within a predetermined error range, the security event recommendation order management unit recommends the most recently selected countermeasure for that countermeasure.

[0024] According to one aspect of this embodiment, a security management method using analysis of security log data is performed by a security management device including at least one processor, and is characterized by including a communication step of receiving security log data or security log data that has been determined to be an attack event or has been determined to be an attack event and processed from the outside, a log analysis step of analyzing the received security log data to detect each data and event contained in each security log data and extract field information from each security log data, a log formatting step of formatting the field information extracted in the log analysis step into a standard format, and a judgment step of using the security log data in the standard format formatted by the log formatting step to determine whether the formatted security log data is an attack event based on an artificial intelligence learning model that judges the risk level of pre-learned security log data, and providing the risk level of the security log data determined to be an attack event as an output value. Effect of the Invention

[0025] As described above, according to one aspect of this embodiment, during security event monitoring, security log data from different devices contained in logs recording detected attack events is converted into a prescribed standard format, and the security log data is efficiently processed based on rules that reflect the results of feedback on countermeasures for attack events, making it easy to respond to newly occurring attack events in various situations. The current state of security risks is visualized according to the risk level for each security log data calculated using an artificial intelligence learning model, and provided to a security analysis device, allowing security analysts to grasp this at a glance and quickly handle attack events.

[0026] In addition, according to one aspect of this embodiment, it is possible to analyze the attack pattern of security attack events performed from an external device, and visualize the attack area in which the security attack events occur, and the type and frequency of the security attack events. It is also possible to calculate a risk level for each security log data, and visualize interrelated information regarding the current security risk in an adjacent arrangement manner according to the calculated risk level, or visualize and provide information regarding the attack event in table form so that it can be grasped at a glance according to the risk level, thereby allowing security analysts to grasp these at a glance and quickly handle the attack event. [Brief description of the drawings]

[0027] [Figure 1] 1 is a diagram showing the configuration of a security operation system according to an embodiment of the present invention. [Diagram 2] 1 is a diagram showing the configuration of a security operation device according to an embodiment of the present invention. [Diagram 3] FIG. 4 is a diagram showing an example of each security log data. [Figure 4] FIG. 2 is a diagram showing a configuration of a visualization unit according to an embodiment of the present invention. [Figure 5A] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 5B] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 5C] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 5D] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 6] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 7] FIG. 11 is a diagram illustrating an example of the operation of a risk visualization unit according to an embodiment of the present invention. [Figure 8] 11A and 11B are diagrams illustrating an example of the operation of a processing status visualization unit according to an embodiment of the present invention. [Figure 9]11A to 11C are diagrams illustrating an example of the operation of an attack position visualization unit according to an embodiment of the present invention. [Figure 10] 11A to 11C are diagrams illustrating an example of the operation of an attack position visualization unit according to an embodiment of the present invention. [Figure 11] 11A to 11C are diagrams illustrating an example of the operation of an attack position visualization unit according to an embodiment of the present invention. [Figure 12A] 11A to 11C are diagrams illustrating an example of the operation of an attack position visualization unit according to an embodiment of the present invention. [Figure 12B] 11A to 11C are diagrams illustrating an example of the operation of an attack position visualization unit according to an embodiment of the present invention. [Figure 13] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 14A] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 14B] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 14C] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 14D] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 15A] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 15B] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 15C] FIG. 11 is a diagram illustrating an example of the operation of an attack pattern visualization unit according to an embodiment of the present invention. [Figure 16] 1 is a flowchart illustrating a method for visualizing each piece of information by a security operation device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] Although the present invention can have various embodiments with various modifications, a specific embodiment will be described in detail with reference to the drawings. However, it is not intended to limit the present invention to the specific embodiment, and it should be understood that the present invention includes all modifications, equivalents, or alternatives within the spirit and technical scope of the present invention. In describing each drawing, similar reference numerals are used for similar components.

[0029] Terms such as first, second, A, B, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only to distinguish one component from another. For example, a first component may be named a second component, and similarly, the second component may be named a first component, without departing from the scope of the invention. The term "and / or" includes a combination of multiple related listed items or any item of multiple related listed items.

[0030] When a component is referred to as being "coupled" or "connected" to another component, it should be understood that it may be directly coupled or connected to the other component, but that there may be other components in between. In contrast, when a component is referred to as being "directly coupled" or "directly connected" to another component, it should be understood that there are no other components in between.

[0031] The terms used in this application are merely used to describe specific embodiments and are not intended to limit the present invention. A singular expression includes a plural expression unless the context clearly indicates otherwise. In this application, it should be understood that terms such as "include" or "have" do not preclude the possibility of the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification.

[0032] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0033] Terms defined in commonly used dictionaries should be interpreted to have a meaning consistent with the meaning they have in the context of the relevant art, and are not to be interpreted in an idealized or overly formal sense unless expressly defined in this application.

[0034] In addition, the configurations, processes, steps, or methods included in each embodiment of the present invention can be shared within a range that is not technically inconsistent with each other.

[0035] FIG. 1 is a diagram showing the configuration of a security operation system according to an embodiment of the present invention.

[0036] 1, a security management system 100 according to an embodiment of the present invention includes security devices 110a to 110n, a security management apparatus 120, and a security analysis apparatus 130. Furthermore, the security management system 100 may further include a security log management apparatus 140.

[0037] The security operation system 100 analyzes security log data output from each security device 110a to 110n to analyze whether an attack event has occurred in each device, analyzes the risk of each event when an attack event occurs, processes the event, and visualizes information on the risk, processing status, and state of the attack event. Here, an attack event means any action that is performed by an unauthorized device and that violates a security policy (set or defined by a user or administrator of the security operation system). Attack events are classified into external attack events that are performed from outside the system 100 via a network, and internal attack events that are performed inside the system 100, such as theft, modification, and sending of materials to the outside. The security operation system 100 checks all attack events that occur in each device, analyzes the risk of these events, and processes them appropriately. This significantly reduces the hassle of a security analyst having to monitor all attack events. In addition, the security operation system 100 visualizes information on the risk, processing status, and state of the attack event with high visibility, allowing a security analyst to grasp currently occurring attack events and their processing status at a glance.

[0038] The security devices 110a to 110n are devices that are installed in various locations such as institutions, companies, industrial entities, or banks, and perform various operations. As described above, the security devices 110a to 110n are realized in various types and include various types of security programs. Mainly used security programs include firewalls, web firewalls, vaccines, DRM (Digital Rights Management), IPS (Intrusion Prevention System), DDoS countermeasure programs, DLP (Data Loss Prevention) solutions, and email security programs. Each security program is realized in various types, and various types of security programs are built into and run in each security device 110. When an attack event occurs, such security programs generate security log data, and the security log data includes various information related to the attack. Each security device 110 transmits the security log data to the security management device 120. When the security management system 100 includes a security log management device 140, the security device 110 may transmit the security log data directly to the security management device 120, or may transmit the security log data preferentially to the security log management device 140, depending on the circumstances.

[0039] The security management device 120 receives all security log data transmitted from each security device 110, judges whether an attack event has occurred and the risk level of the attack event, and processes the data appropriately according to the determined risk level. When the security log management device 140 is included in the security management system 100, the security management device 120 can receive security log data judged as an attack event transmitted from the security log management device 140, judge the risk level, and process the data appropriately according to the determined risk level. Meanwhile, the security management device 120 visualizes information on the risk level, processing status, and state of the attack event during the process of judging and processing the risk level of the attack event. The security management device 120 may directly output the visualized information itself, or provide it to an appropriate security analysis device 130a to 130n so that a security analyst can check it using the security analysis device 130 that he or she uses. A specific configuration and operation of the security management device 120 will be described later with reference to FIGS. 2 to 16.

[0040] The security analysis device 130 is a terminal used by a security analyst, and receives a processing result from the security management device 120 to proceed with processing, analysis, and response to an attack event. The security management device 120 may directly process the attack event or may propose a countermeasure according to the risk level of the attack event, as described below. When the security management device 120 directly processes the attack event, the security analysis device 130 can receive and output a result value indicating that the attack event has been directly processed from the security management device 120. This allows the security analyst to recognize that an attack event has occurred and that the event has been processed. Meanwhile, the security management device 120 can propose a countermeasure for a similar attack event to an attack event with a relatively high risk level, and the security analysis device 130 receives and outputs the countermeasure proposed by the security management device 120. The security analyst can easily process the attack event by considering one or more countermeasures output from the security analysis device 130. Furthermore, the security analysis device 130 can feed back the satisfaction level of the countermeasure used in the processing to the security management device 120. As described later, the security management device 120 can determine the order of priority when proposing countermeasures for each attack event based on the fed back information (satisfaction level).

[0041] Furthermore, the security management system 100 may include a security log management device 140. The security log management device 140 receives security log data from the security devices 110a to 110n and analyzes whether an attack event has occurred in each device. The security log management device 140 may be realized by a security information and event management (SIEM), and receives security log data from each security device 110a to 110n with priority over the security management device 120. The security log management device 140 stores a security policy determined by a user or administrator of the security management system, analyzes received security log data, and analyzes whether the received security log data violates the security policy. The security log management device 140 determines whether the received security log data is an attack event depending on whether each received security log data violates the security policy. The security log management device 140 stores all received security log data, and can transmit only security log data determined to be an attack event to the security management device 120. This allows the security management device 120 to perform the above-mentioned operations only for the attack events received from the security log management device 140 without the need to analyze all the security log data.

[0042] FIG. 2 is a diagram showing the configuration of a security operation device according to an embodiment of the present invention.

[0043] Referring to FIG. 2, the security management device 120 according to one embodiment of the present invention includes a communication unit 210, a log analysis unit 215, a log formatting unit 220, a log learning unit 225, a security event risk determination unit 230, a security event automatic processing unit 235, a security event processing suggestion unit 240, a security event recommended order management unit 245, a visualization unit 250, and a data storage and management unit 255.

[0044] The communication unit 210 receives security log data from each of the security devices 110a-110n, or, if the system 100 includes a security log management device 140, receives security log data determined to be an attack event from the security log management device 140. In some cases, the communication unit 210 may receive information about security log data that has been determined to be an attack event or has been processed accordingly from the security analysis device 130.

[0045] The communication unit 210 transmits the countermeasures for one or more attack events selected by the security event processing proposing unit 240 to the security analysis device 130. In addition, the communication unit 210 can receive a satisfaction level for the countermeasure provided from the security analysis device 130.

[0046] The log analysis unit 215 analyzes the security log data received by the communication unit 210. The security log data is generated and transmitted from various security devices 110. As described above, security programs are classified into various types according to their operations, and various types of security programs exist for each type. At this time, since there is no standard for security log data, security log data in a different format is generated for each security program. The log analysis unit 215 analyzes each security log data received by the communication unit 210 to analyze what information is included in the security log data.

[0047] Meanwhile, the log analysis unit 215 can obtain IP information from the security log data according to the analysis result. If the IP information is fluid, the log analysis unit 215 can extract an attack pattern by a probability value based on the attack time and attack type corresponding to the IP information. The log analysis unit 215 can determine the final attack source according to the analysis result for the extracted attack pattern.

[0048] The log formatter 220 formats, into a standard format, each piece of log data analyzed by the log analyzer 215. An example of the operation of the log formatter 220 is illustrated in FIG.

[0049] FIG. 3 is a diagram showing an example of each piece of security log data.

[0050] 3, as described above, the security log data has different formats for each security program or security device, and it can be seen that the data included or not included in each security log data is different.

[0051] The log analysis unit 215 analyzes what information is contained in each security log data, and the log formatting unit 220 formats each security log data into a standard form based on the information analyzed by the log analysis unit 215.

[0052] The standard format formatted by the log formatter 220 includes pre-defined information as follows, for example, 1. log source, 2. event name, 3. source IP address, 4. target IP address, 5. MAC address, 6. security log data importance, 7. status code, 8. request data, 9. request data length, 10. protocol, 11. file name, and 12. original file.

[0053] First, the log source refers to the device that generated the security log data that is to be converted into a standard format, meaning which security device 110 generated the security log data.

[0054] Second, the event name refers to the occurrence of a specific security log data. The event name includes information that allows one to know which security log data has occurred, and includes all information required for monitoring the security log data, such as the type, occurrence time, location, or cause of the security log data.

[0055] Third, the source IP address refers to the IP address of the device that generates the attack event so that the security device 110 generates security log data. Security analysts can use the source IP address information to know the device that generates the attack event and investigate the event based on the source IP address information.

[0056] Fourth, the target IP address refers to the IP address of the device (security device) that was the target of the attack event.

[0057] Fifth, the MAC address refers to the MAC (Media Access Control) address of the device (security device) that was the target of the attack event.

[0058] Sixth, the security log data importance indicates the degree of urgency of the security log data. Various importance levels are assigned to each security log data depending on its type. Generally, the importance levels may be assigned in categories such as "DEBUG", "INFO", "WARN", "ERROR", and "FATAL" from low to high. The "DEBUG" level indicates log data that contains detailed operation information of the system and is mainly used by security analysts to diagnose code problems. The "INFO" level refers to log data that indicates the general operating status of the system. The "WARN" level log data refers to data that may cause problems in the system, and the "ERROR" or "FATAL" level log data refers to data that may cause fatal problems in the system.

[0059] Seventh, the status code indicates the network connection state when the security device 110 is connected to the network to perform a required operation with the outside. For example, if the security device 110 is connected to the outside (e.g., a server) through the network using the HTTP protocol, the status code may have a value of 200 (success), 404 (not found), or 500 (internal server error). A security analyst can use the status code information to detect the occurrence of an attack event and analyze the cause of the problem to take appropriate action.

[0060] Eighth, the request data refers to data transmitted by the security device 110 after performing a necessary operation with the outside. When the security device 110 performs various operations with the outside (e.g., a server) using a network, the request data refers to data transmitted after performing the operation. For example, methods used for requests between a client and a server include GET, POST, PUT, DELETE, and CONNECT. However, for security reasons, in most cases, only GET and POST are permitted. GET requests data from the web server in URL format and is used for parts that are less related to risk, such as transmitting search terms. At this time, the amount of data cannot exceed 4096 bytes. Meanwhile, the POST method transmits the request data in the HTTP Body. At this time, it is used to transmit personal information including ID and PW. A security analyst can use the request data to check and track the behavior and attack events of the security device and monitor the operation status of the security operation system.

[0061] Ninth, the request data length indicates the size of the request data described above.

[0062] Tenth, the protocol refers to the standard mechanism used when the security device 110 connects to an external network.

[0063] Eleventh, the file name refers to, when the security device 110 uses DRM as a security program, device information (such as ID, MAC, or name) that accessed the file managed by DRM, security device information (such as ID, MAC, or name) that manages the file managed by DRM, the name of the original file managed by DRM, whether the file managed by DRM has been modified / operated, and the modified file when modified / operated. The file name is specialized information related to the file managed by DRM among the security programs, and allows security analysts to detect and respond to illegal copying and distribution of the file.

[0064] Twelfth, an original file refers to a file that has a state when a file managed by DRM is created. If a specific file is tampered with or manipulated, a security analyst can use the original file information to restore the file.

[0065] The log formatter 220 formats each piece of log data analyzed by the log analyzer 215 into a standard format including each piece of information described above. As described above, since various security programs produce various forms of security log data, the log formatter 220 may or may not include all information included in the standard format. If data corresponding to a data field in the standard format exists in the log data, the log formatter 220 fills the data field with the data, and if data corresponding to a data field in the standard format does not exist in the log data, the log formatter 220 fills a null or padding value. In this way, the log formatter 220 unifies various forms of security log data produced by various security programs into one standard format. Meanwhile, in FIG. 2, the log analyzer 215 and the log formatter 220 are shown as being realized separately, but this is not necessarily limited thereto, and both components 215 and 220 can be realized as one component to perform all of the above-mentioned operations.

[0066] The log learning unit 225 learns an artificial intelligence learning model that judges the risk of security log data in a standard format shaped by the log shaping unit 220. The log learning unit 225 learns an artificial intelligence learning model in which the security log data in a standard format shaped by the log shaping unit 220 is used as an input value, and the risk level of the security log data is quantified as an output value indicating whether the security log data is an attack event or not, and how much risk there is if it is an attack event. The log learning unit 225 learns the above-mentioned input value and output value in an architecture such as LSTM (Long Short Term Memory), GRU (Gated Recurrent Unit), Vanilla RNN, Bidirectional RNN, or Transformer. The log learning unit 225 learns the above-mentioned learning model, and when security log data shaped by the log shaping unit 220 is input, it is possible to judge whether the security log data is an attack event or not, and how much risk there is if it is an attack event.

[0067] As an example, the log learning unit 225 can learn an artificial intelligence learning model using learning data based on classification criteria for determining whether security log data is an attack event and the risk level of the attack event. In this case, the security log management device 140 can collect multiple security log data according to classification criteria applied to each location, store the analysis results (including the presence or absence of an attack event and the risk level) of each security log data, and then provide the results as learning data.

[0068] The security event risk determination unit 230 uses the artificial intelligence learning model learned by the log learning unit 225 to determine whether the security log data formatted by the log formatting unit 220 is an attack event and, if so, how much risk it has. Here, the classification criteria for whether an event is an attack event and how much risk it has are determined according to the security policy of the place where each security operation system is used. That is, the above-mentioned classification criteria may differ according to various security policies of the place where each security operation system is used. An action that is not problematic in one place may be an attack event in another place, and an attack event with a low risk in one place may be an attack event with a very high risk in another place. In this way, the security event risk determination unit 230 performs learning according to the classification criteria corresponding to the place where the system 100 is used, and determines whether an attack event has occurred and how much risk it has.

[0069] The security event automatic processing unit 235 directly processes attack events whose danger level is equal to or lower than a preset reference value. When an attack event whose danger level is equal to or lower than a preset reference value occurs as determined by the security event danger level determination unit 230, the security event automatic processing unit 235 directly processes such an attack event based on a rule set predetermined by a user or administrator of the security operation system. Many attack events whose danger level is equal to or lower than a preset reference value may occur, and if a security analyst has to directly process all of them, this will hinder the security analyst's concentration and judgment. For this reason, the security event automatic processing unit 235 directly processes attack events whose danger level is equal to or lower than a preset reference value. If an attack event that cannot be automatically processed occurs, the security event automatic processing unit 235 can notify the security analysis device 130 of the event.

[0070] The security event processing suggestion unit 240 provides the security analysis device 130 with countermeasures for attack events whose danger level is equal to or exceeds a preset reference value. An attack event whose danger level is equal to or exceeds a preset reference value is an event that may affect the security device 110 or the entire security operation system 100, and corresponds to an event that a security analyst directly detects and processes. For this reason, the security event processing suggestion unit 240 does not directly process the event, unlike the security event automatic processing unit 235. However, the security event processing suggestion unit 240 operates to assist the security analyst in processing the event, so that the security analyst does not need to grasp the attack event and process it while checking the past details one by one to determine which method to use. The security event processing suggestion unit 240 refers to the countermeasures arranged by the security event recommendation order management unit 245 and proposes countermeasures for attack events whose danger level is equal to or exceeds a preset reference value, which are currently of concern. There may be only one countermeasure proposed, or multiple countermeasures may be proposed together with a set order.

[0071] The security event recommendation order management unit 245 formulates appropriate countermeasures for each attack event by referring to various pre-processed attack events and their corresponding countermeasures stored in the data storage and management unit 255. In order to allow security analysts to perform effective processing with satisfaction, the security event recommendation order management unit 245 selects appropriate attack events from the pre-processed attack events for various attack events and formulates countermeasures.

[0072] As described above, the security management device 120 provides countermeasures to the security analysis device 130 and receives the satisfaction level for the countermeasures provided from the security analysis device 130. The security event recommendation order management unit 245 searches the data storage and management unit 255 for attack events similar to a (specific) attack event for which a countermeasure is to be established, the risk level of which is equal to or higher than a preset reference value, and then arranges the list obtained by the search in order of the degree of satisfaction for the countermeasures. The security event recommendation order management unit 245 judges whether the difference between the satisfaction level of the most satisfied attack event and its countermeasure and the satisfaction levels of other countermeasures is greater than a preset error range. In other words, it judges whether there is a single countermeasure that has a higher satisfaction level than the other countermeasures by a preset error range or more. If there is a single such countermeasure, the security event recommendation order management unit 245 establishes the attack event and its countermeasure as the optimal countermeasure. However, when there are multiple countermeasures with a satisfaction level higher than the other countermeasures by more than a preset error range, the security event recommendation order management unit 245 arranges the countermeasures in order of the second highest number of times (ratio) used in processing. That is, the security event recommendation order management unit 245 prioritizes countermeasures with high satisfaction and high number of times used as countermeasures. However, there may be countermeasures whose number of times (ratio) used in processing is also within a preset error range. For this reason, the security event recommendation order management unit 245 prioritizes the countermeasure that was selected more recently as the third countermeasure as the countermeasure. Since the security environment is constantly changing and new threats, attacks, technologies, or policies are emerging, it is very important to promptly reflect security trends and concerns. For this reason, the security event recommendation order management unit 245 prioritizes the countermeasure that was selected more recently as the third countermeasure as the countermeasure. As a result, the security event recommendation order management unit 245 can prioritize the countermeasure that has a high satisfaction level for each attack event, is frequently used, and has been selected more recently as the countermeasure for the attack event.The security event recommendation order management unit 245 may select the priority order based on the above-mentioned criteria and set only one countermeasure with the highest priority, or may rank multiple countermeasures based on the above-mentioned criteria and set them as countermeasures. Therefore, based on the provided information, the security analyst may process the attack event in question by referring to the countermeasure with the highest priority, or may select any countermeasure from the provided countermeasures and process it.

[0073] Although the security event risk assessment unit 230, the security event automatic processing unit 235, the security event processing proposal unit 240 and the security event recommended order management unit 245 are shown to be realized separately, this is not necessarily limited to this, and they may be realized in the configuration of a single risk calculation module 260 and be able to perform all of the operations described above.

[0074] That is, the risk calculation module 260 calculates a risk level for each security log data based on the analysis results of the log analysis unit 215, and performs processing of the security log data in accordance with the risk level calculated by a predetermined rule-based processing logic based on the processing results for the pre-stored attack events.

[0075] At this time, the risk calculation module 260 may calculate a risk level for each security log data using a pre-trained artificial intelligence learning model, but may also calculate a risk level for each security log data by applying various algorithms that compare and analyze currently acquired information with previously acquired information other than the artificial intelligence algorithm. As an example, the risk calculation module 260 may derive an analysis result for similarities and / or differences by comparing the acquired security log data with a processing result including the type, risk level, processing status and result, and countermeasure of an attack event that is pre-stored in the data storage and management unit 255 through an algorithm that performs a comparative analysis process of the security log data. The risk calculation module 260 may calculate a risk level for each security log data using the analysis result derived in the comparative analysis process of the security log data.

[0076] The visualization unit 250 visualizes the security log data analyzed by the log analysis unit 215 or information related to the risk level, processing status, and attack state of an attack event, and provides the visualized information to the security analysis device 130. The visualization unit 250 can visualize the above-mentioned information of an attack event analyzed or processed by the above-mentioned components 230 to 245, and can also visualize the above-mentioned information of an attack event determined to be an attack event by the security analysis device 130 or processed thereby. The visualization unit 250 can be realized as shown in FIG. 4 and can operate as illustrated in FIGS. 5 to 15.

[0077] FIG. 4 is a diagram showing a configuration of a visualization unit according to an embodiment of the present invention.

[0078] 4, the visualization unit 250 according to an embodiment of the present invention includes a danger level visualization unit 410, a processing status visualization unit 420, an attack position visualization unit 430, and an attack pattern visualization unit 440.

[0079] The risk visualization unit 410 visualizes the risk of an attack event applied to each of the security devices 110a to 110n. An example of the operation of the risk visualization unit 410 is shown in FIGS.

[0080] 5 to 7 are diagrams showing an example of the operation of a risk visualization unit according to an embodiment of the present invention. Here, Fig. 5A is a diagram showing an example screen in which the risk visualization unit according to an embodiment of the present invention visualizes information related to security log data acquired in a network structure of each security device, Fig. 5B is a diagram showing an example screen in which the visualization unit according to an embodiment of the present invention visualizes and provides a processing status according to the risk level of security log data, Fig. 5C is a diagram showing a processing status according to the risk level of security log data according to an embodiment of the present invention, and Fig. 5D is a diagram showing an example screen in which a processing status according to the risk level of security log data according to an embodiment of the present invention is executed.

[0081] Referring to FIG. 5A, the risk visualization unit 410 visualizes the risk of an attack event applied to each of the security devices 110a to 110n. The risk visualization unit 410 classifies the risk levels into a plurality of levels, and outputs the number of attack events applied corresponding to the risk of each level. As illustrated in FIG. 5A, the risk visualization unit 410 may classify each level with a different color or saturation, and output the frequency of attack events corresponding to each level. The risk visualization unit 410 may generate a bar chart in which the relevance and risk of security log data are adjacent to each other. The order of the bars may be reversed starting from the security log data with the highest risk, or may be arranged from the left side in order of importance. In this way, the risk visualization unit 410 may visualize the data with the highest risk on the left side, and may guide the security analyst or the security analysis device 130 to process it with priority. The condition for the security log data reflected in the bar chart may be when the risk exceeds 50%.

[0082] In addition, the risk visualization unit 410 can visualize the bar chart in three dimensions. The thickness of each bar can be updated according to the number of security events of relevance and risk, and the risk visualization unit 410 can dynamically update the three-dimensional chart area according to the total event occurrence amount.

[0083] 5B and 5C, the risk visualization unit 410 can visualize and display the risk level of the security log data calculated by the risk calculation module 260 and the processing status of the attack event. Specifically, the risk visualization unit 410 visualizes the status in which the attack event is processed by the security event automatic processing unit 235 and the security event processing suggestion unit 240.

[0084] In other words, the risk calculation module 260 classifies attack events having a risk level below a preset standard value as low risk, the automatic security event processing unit 235 takes countermeasures based on a predetermined rule-based processing logic, and the risk visualization unit 410 visualizes and provides the processing record and efficiency of the countermeasures so that the process record and efficiency can be visually understood.

[0085] The risk calculation module 260 classifies attack events having a risk level exceeding a preset standard value as medium or high risk, the security event processing proposal unit 240 refers to the countermeasures arranged by the security event recommendation order management unit 245 and proposes countermeasures for attack events whose risk level is equal to or exceeds a preset standard value, and the risk visualization unit 410 visualizes the processed results and provides a visualization of the current processing status to the security analysis device 130.

[0086] In the unlikely event that the security log data containing a low-risk attack event is new security log data and not an attack event pre-stored in the data storage and management unit 255, a selection input for the processing logic for the new security log data can be obtained from the security analysis device 130 to handle the situation.

[0087] Meanwhile, in the case of an attack event of a medium or higher risk level, the risk level calculation module 260 can digitize and store the processing result and the satisfaction level received from the security analysis device after automatic processing, and when the countermeasure recommended by the security event recommendation order management unit 245 is selected and processed, the risk level calculation module 260 can obtain feedback on the countermeasure and store the evaluation result in the data storage and management unit 255. In the event that the evaluation result of the countermeasure recommended by the security event recommendation order management unit 245 is evaluated to be equal to or higher than a preset score, the security operation device can adjust the priority of the countermeasure upward and provide it. That is, the risk level calculation module 260 can store the processing result of the countermeasure recommended by the security event recommendation order management unit 245 together with information on the satisfaction level, success / failure, processing time, and risk level, periodically calculate statistics on the processing result of the countermeasure, and reflect the calculated statistical results in the security event recommendation order management unit 245 to update the recommendation list.

[0088] 5, the security event recommendation order management unit 245 proposes appropriate countermeasures for security log data with medium and high risk among attack events, and can automatically or manually process the attack events according to the selection of the security analysis device. At this time, the screen of the security analysis device may be divided and displayed into daily statistics, automatic processing rates by risk level, real-time attack status, and selection of processing measures.

[0089] Daily statistics allow you to check the number of attack events that occurred, the number of times they were automatically processed (percentage), the percentage of medium and high risk events, and the percentage of events that were automatically processed. The automatic processing rate by risk level is displayed in a graph and you can select the period option, which can be displayed in units of weeks (past 7 days), months (past 4 weeks), etc.

[0090] On the screen of the security analysis device, attack events may be listed in a real-time attack status table, and when a specific attack event is selected, countermeasures for that attack event and the weighting of the countermeasures may be displayed.

[0091] As described above, the security device 110 can be realized in various types and can be operated with various software-based security programs and hardware-based security programs built in. The risk visualization unit 410 can display the software-based security programs and the hardware-based security programs by classifying them into different colors or shapes.

[0092] For example, in the case of an attack event occurring due to the combination of information on at least one security program, the risk visualization unit 410 may display the security device 110 within a figure corresponding to the color of the security program in which the attack event occurred. In addition, in the case of an attack event occurring due to the combination of information on multiple security programs, the risk visualization unit 410 may adjust and display the color, size, and ratio of the figure according to the degree of involvement of the security program based on the log data recorded in the detected event.

[0093] In addition, the risk visualization unit 410 may express the movement process of the situation in which the attack event is transmitted from the security device 110 to the risk calculation module 260 using a figure having the same color as the security program.

[0094] The risk visualization unit 410 can provide risk table information including IP information acquired from security log data, attack time (or occurrence time) and attack type corresponding to the IP information, risk level, and processing state. At this time, the risk table information may be provided by dividing it into a low risk table and a medium / high risk table.

[0095] The risk visualization unit 410 displays the security log data in a low risk table when the risk level calculated by the risk calculation module 260 is equal to or lower than a preset reference level, and displays the security log data in a medium / high risk table when the risk level exceeds the preset reference level. At this time, the reference level may be set to a risk level of "3", but may be set differently by a user or administrator of the security operation system according to a classification standard corresponding to a place where the security operation system 100 is used. Also, the risk visualization unit 410 may configure the color of the row for the attack event in the same color system as the color of the security program in which the attack event occurred in the risk table information.

[0096] The risk visualization unit 410 may configure a risk table by varying the color, line shape, line type, or line thickness for each row according to the risk level, and may include at least one icon indicating that the attack event is being processed or that the attack event is completed in a column corresponding to a processing state. Here, the icon may be composed of at least one of a symbol, a character, or a figure, and may be visualized in the form of an image or text. Therefore, the risk visualization unit 410 may intuitively express the processing status, such as processing, processing speed, and completion, by combining at least one of a loading icon, an arrow, text, a figure, and the like.

[0097] As an example, in the case of an attack event with a high risk level, a loading icon may be arranged in a column corresponding to the processing state of the risk table information, and the higher the risk level or the higher the processing priority, the faster the loading icon such as an arrow, a loading bar, or a radial dot may rotate. A column with a high processing priority in the risk table information may be a column having the same IP as a column with a high risk level, or a column having the attack type when the same attack occurs continuously at the same time.

[0098] The risk visualization unit 410 may display a higher risk level with higher saturation and thicker contour lines, and as an example, a low risk table may be displayed with lower saturation and thinner contour lines than a medium / high risk table.

[0099] In addition, the risk visualization unit 410 may erase a column including an attack event by gradually blurring the column for a preset time after a preset time has elapsed since the processing of the attack event occurring in the security log data is completed. That is, the risk visualization unit 410 may erase the column from the risk table information by using a sliding motion while lowering the saturation of the column after a certain time has elapsed since the column corresponding to the processing status of the risk table information is changed to an icon indicating "completed."

[0100] At this time, when information regarding an attack event is received from one side (e.g., the left side) of the risk table information, the risk visualization unit 410 can display the column corresponding to the attack event that has been processed sliding and disappearing to the other side (e.g., the right side) of the risk table information.

[0101] On the other hand, as shown in FIG. 6, the risk visualization unit 410 can output the frequency of occurrence of attack events that occurred in each security program for each security program used by each security device 110a to 110n by classifying them. When visualizing the attack events that occurred in each security program, the risk visualization unit 410 can output the frequency of occurrence of each attack event by classifying them. On the other hand, an attack event may be added to only one security program, or may be added to several security programs in conjunction with each other. For example, an attack event may occur in conjunction with both a firewall and a web firewall, or an attack event may occur in both a web firewall, a vaccine, or a DRM. Alternatively, when a confidential document that is rarely viewed is unlocked in a corporate DRM, this does not correspond to any attack event, and only a log record remains in the DRM security device. However, if an email security program responsible for email security sends an email to an external address, for example, an email address of a competitor company, after unlocking the document, it can be determined that an (internal) attack event, which is a leak of confidential internal information, has occurred. There are cases where actions that would not be found as attack events when analyzing security log data for each security program may be found as attack events when analyzing security log data by linking several meaningful security programs. The same is true when a Web Firewall (WAF) detects a Credential and Configuration Discovery event that attempts to search for a file containing an internal account password, API key, or credential, and then an Intrusion Prevention System confirms an event attempting to log in or access using the searched password / resource from the outside or the first connected IP.Although it is impossible to know or confirm whether an attack event is an attack event from the security log data of a single security program alone, the risk visualization unit 410 can analyze the security log data of linked security programs to confirm the pattern and type of the attack event and visualize this information. A security analyst (or a security analysis device) can use this to confirm and respond to hidden and complex attacks. In other words, if an attack event is added in conjunction with various security programs so that a security analyst can confirm it, the risk visualization unit 410 can match the security programs to which the attack event is added in conjunction, classify the attack event, and output it together with the frequency.

[0102] FIG. 7 is a diagram in which the risk visualization unit according to an embodiment of the present invention visualizes information on security log data acquired within the network structure of each security device. As shown in FIG. 7, the risk visualization unit 410 can classify and output the occurrence frequency of attack events that occurred in each security program for each network structure for the security programs used by each security device 110a to 110n. The risk visualization unit 410 determines an attack type based on security log data acquired from the network of the security device 110, and when the determined attack type is a first attack type, if the relevance with a second attack type is equal to or greater than a preset relevance, can adjacently arrange and visualize the first attack type and the second attack type. For example, the risk visualization unit 410 can adjacently visualize attack events for each attack type based on the relevance between the first attack type and the second attack type of the firewall, can adjacently visualize attack events based on the risk level for the firewall and the web firewall, and can adaptively determine the position arrangement of each of the web firewall, vaccine, DRM, etc. according to the situation.

[0103] 4 again, the processing status visualization unit 420 visualizes the status of an attack event being processed by the security event automatic processing unit 235 and the security event processing suggestion unit 240. An example of the operation of the processing status visualization unit 420 is shown in FIG.

[0104] FIG. 8 is a diagram illustrating an example of the operation of the processing status visualization unit according to an embodiment of the present invention.

[0105] As described above, the security event automatic processing unit 235 directly processes attack events whose danger level is below a preset reference value, and the security event processing suggestion unit 240 performs the above-mentioned processing for attack events whose danger level is above a preset reference value.

[0106] 8, the processing status visualization unit 420 can visualize information (which may be in a standard format) of attack events processed by the security event automatic processing unit 235 and their processing status, and can similarly visualize information and processing status of attack events processed (countermeasures proposed) by the security event processing proposal unit 240. The processing status visualization unit 420 can output information related to attack events processed by the security event automatic processing unit 235 and information related to attack events processed by the security event processing proposal unit 240, with these information spatially and / or visually separated from each other.

[0107] The processing status visualization unit 420 can provide the visualized information to the security analysis device 130 in a modifiable state, and the security analyst can receive the visualized information and modify it appropriately as necessary.

[0108] 4 again, the attack position visualization unit 430 visualizes the attack position and / or attack statistical information of the device that caused the attack event. The attack position visualization unit 430 can exclude attack events processed by the security event automatic processing unit 235 and proceed with visualization only for attack events (with a relatively high risk) processed by the security event processing suggestion unit 240. Operation examples of the attack position visualization unit 430 are shown in FIGS. 9 to 12.

[0109] 9 to 12 are diagrams illustrating an example of the operation of the attack position visualization unit according to an embodiment of the present invention.

[0110] 9, the attack location visualization unit 430 subdivides and visualizes the attack location of the device that has generated the attack event. The attack location visualization unit 430 does not simply output countries, but subdivides and outputs cities and smaller administrative districts. Based on the source IP address in the standard format, the attack location of the device that has generated the attack event can be confirmed down to the administrative district. For this reason, the attack location visualization unit 430 subdivides and visualizes the attack location of the device that has generated the attack event.

[0111] The attack position visualization unit 430 may visualize the attack position of the device that has generated the attack event in a different manner depending on the occurrence risk and number of attack events. For example, the attack position visualization unit 430 may display a first type of attack event in a first color and a second type of attack event in a second color, and may update the saturation of the first color or update the size of the attack occurrence area for an attack event whose risk is equal to or higher than a preset reference value. In addition, the attack position visualization unit 430 may display the attack position according to the attack grade, risk level, etc.

[0112] Furthermore, the attack location visualization unit 430 can visualize the attack location of the device that generated the attack event by mapping it on a map of the area as shown in FIG. 10 when visualizing it by dividing it into smaller parts. If only the attacking country is displayed as information about the IP, there is no detailed information about the attacking device or the attacking area, and it is difficult to take detailed measures such as responding to and preparing for the attack, and the information remains meaningless. When various attacks are performed simultaneously, the areas without attacks are larger and more numerous than the areas where attacks occur on the overall map, so there is no need to graphically represent them according to the size of the overall map. As a result, when the attack location visualization unit 430 maps and visualizes the area or shape of the area according to the frequency of occurrence of the attack event regardless of the actual area of ​​each area, it can adjust or deform the area or shape of the area and visualize it. In addition, the attack location visualization unit 430 can provide information in real time by creating a 2D map using only the current attack area. This can be more advantageous for grasping the overall flow and preparing for the current situation. Furthermore, by providing color changes of attack areas according to the real-time attack volume or frequency, it is possible to check the overall attack flow, the current state of attack processing, or the real-time response capacity of the security center to respond to attacks, and to make changes and preparations for increasing or decreasing security personnel, operating the relevant attack experts, and managing the security center. Security analysts can more easily check which area is experiencing an attack event, and can take measures such as blocking the entire IP address of the area. In addition, the attack location visualization unit 430 allows security analysts to make policies such as adding security devices or strengthening security when visualizing the breakdown of attacks for each security device, and to allocate or respond to security experts for each attack type.

[0113] As shown in FIG. 11, the attack location visualization unit 430 can visualize attack statistics information for each security program. The attack location visualization unit 430 can visualize the attack events applied to each security program by averaging them over a period of a day, a month, or a year, and can also visualize the monthly or yearly average. Thus, the attack location visualization unit 430 allows a security analyst to check the increase or decrease in comparison with the monthly or yearly average for each day or month. In addition, the attack location visualization unit 430 can implement a security policy in which security analysts suitable for a particular attack are assigned and the number of personnel can be increased or decreased according to the flow of attacks. This can be of great help in the operation of the security center and in the creation of alternatives, preparations, and policies.

[0114] As shown in FIG. 12A, the attack location visualization unit 430 can visualize an attack event in the form of an arrow connecting a source IP address to a target IP address on a two-dimensional or three-dimensional map. The attack location visualization unit 430 can visualize each security program or each attack event type by changing the line form, line type, or line color, and can visualize the frequency (number) of an attack event by the thickness of the line. For example, DDoS attacks can be visualized in red, web exploit attacks in blue, and unauthorized access attacks in yellow. The attack location visualization unit 430 can display all security programs or all attack event types collectively, or can display them separately for each security program or attack event type. This allows a security analyst to collectively grasp how many and what kind of attack events are occurring from which area to which area by the start and end points of the lines, the line form / type / color, and the line thickness.

[0115] Alternatively, as shown in FIG. 12B, the attack position visualization unit 430 may display differently depending on the danger level corresponding to each attack type when visualizing the current attack status of the device that has generated the attack event in real time in the form of animation. For example, the attack position visualization unit 430 may display the attack event of the first attack type in a first color and the attack event of the second type in a second color, and may update the saturation of the first color or update the size of the attack occurrence area for an attack event whose danger level is equal to or higher than a preset reference value. In addition, the attack position visualization unit 430 may display different expression methods such as the color, brightness, thickness, and type of figure for the arrow according to the attack type, number of attacks, attack grade, danger level, etc.

[0116] As an example, the attack location visualization unit 430 may visualize each security program or each attack event type by changing the line shape, line type, or line color, and may visualize the frequency (number) of attack events by the thickness of the line. For example, attack types A and B may be visualized by being expressed differently from each other in red-based colors, attack types C and D such as DDoS attacks may be visualized by being expressed differently from each other in blue-based colors, and attack types E and F such as unauthorized access attacks may be visualized by being expressed differently from each other in gray-based colors. The attack location visualization unit 430 may display all security programs or all attack event types collectively, or may display them separately for each security program or attack event type. In this way, a security analyst can collectively grasp how many and what kind of attack events are occurring from which area to which area by the start and end points of the lines, the line shape / type / color, and the line thickness.

[0117] Referring again to FIG. 4, the attack pattern visualization unit 440 visualizes the pattern of attack events that have occurred. Like the attack position visualization unit 430, the attack pattern visualization unit 440 can also proceed with visualization of only attack events (relatively high risk) processed by the security event processing suggestion unit 240, excluding attack events processed by the security event automatic processing unit 235. The attack pattern visualization unit 440 analyzes and visualizes the attack form and attack time. Operation examples of the attack pattern visualization unit 440 are shown in FIGS. 13 to 15.

[0118] 13 to 15 are diagrams illustrating an example of the operation of the attack pattern visualization unit according to an embodiment of the present invention.

[0119] Referring to FIG. 13, the attack pattern visualization unit 440 visualizes the attack form of an attack event that has occurred. The attack pattern visualization unit 440 can obtain IP information and history information of the attacking IP address according to the analysis result of the log analysis unit 215. The history information of the attacking IP address includes the source IP address, attack location, attack form, response state, and risk level of each attack event, and the attack pattern visualization unit 440 can collectively visualize such history information of the attacking IP address. In the existing security operation system, only responses to attacks were possible, and it was difficult to take any kind of prevention or preparation. However, by providing (visualizing) IP address-based history information to a security analyst or the security analysis device 130 through visualization by the attack pattern visualization unit 440, the security analyst can smoothly proceed with prevention against attacks and preparation according to a specific pattern.

[0120] On the other hand, as shown in Fig. 14A, the attack pattern visualization unit 440 can collectively visualize the time periods in which attack events occurred, and as shown in Fig. 14B, the attack pattern visualization unit 440 can collectively visualize the attack patterns of the attack events by combining the occurrence time periods and attack patterns of the summarized attack events, as shown in Fig. 14C.

[0121] In this case, if the source IP addresses are the same, the attack event may have occurred from substantially the same device, but there may also be a case where the attack event coincides with the source IP address of different devices by using a detouring program. However, if the attack event occurs in the same time period with the same attack pattern, it is highly likely that the two are the same device even if the source IP addresses are different. The attack pattern visualization unit 440 merges and visualizes the time period when the attack event occurs and the attack pattern, so that a security analyst (or a security analysis device) can determine the similarity or the probability of matching between different IPs, as shown in FIG. 14D. If the IPs are different but the two are the same device, the countermeasures can be similar, and it is possible to confirm and prepare in advance what time period and what attack pattern can be prepared for in advance. As a result, when using a VPN or a zombie PC, it is difficult to know who the attacker is, but it is possible to search for similar patterns and confirm attacks by the same person or the same group.

[0122] 15A to 15C, the attack pattern visualization unit 440 can visualize the attack area and time for each attack type. In particular, when visualizing the attack area for each attack type, the attack pattern visualization unit 440 can visualize by mapping on a two-dimensional map, and can output the attack IP address, the risk level of the attack event, and the like together with the attack area to provide them to a security analyst (or a security analysis device).

[0123] In this way, the attack pattern visualization unit 440 allows a security analyst (or a security analysis device) to roughly grasp which device is attacking, and to grasp and prepare for attack patterns and time periods in advance. In addition, the visualization by the attack pattern visualization unit 440 allows a security analyst (or a security analysis device) to analyze attack times and attack time patterns and formulate response methods. Furthermore, an appropriate security analyst to respond to a specific attack event can be located at that time. The attack pattern visualization unit 440 can perform visualization for each attack type, and more specifically, can perform visualization of attack areas or attack time periods.

[0124] Through the visualization by the attack pattern visualization unit 440, a security analyst (or a security analysis device) can proceed with visualization of regions and time periods for each attack type, check the history, and check the trends and patterns of attacks, and can formulate specific security policies such as countermeasures and prevention in preparation for these attacks and manage response operations. When visualizing the response and processing time to attacks, the attack pattern visualization unit 440 can visualize the response time by year, month, and week for each security device, and can visualize the response time by year, month, and week for each attack type. The attack pattern visualization unit 440 enables a security analyst (or a security analysis device) to switch response methods, add personnel, and formulate measures according to the change in response time, and enables prediction of attack trends and attacks and formulation of countermeasures.

[0125] The attack pattern visualization unit 440 can obtain information about the attack source (e.g., determine whether the attack source is identical) and visualize and display the response results to the attack. This allows a security analyst to easily check whether the response results to the attack are appropriate. A security analyst (or a security analysis device) can derive an attack pattern based on information about the attack source through visualization by the attack pattern visualization unit 440, and can obtain information about response methods, response personnel, etc. from the derived attack pattern.

[0126] 2 again, the data storage and management unit 255 stores and manages all data processed by the log analysis unit 215 or the security event recommended order management unit 245. The data storage and management unit 255 can convert data for visualization so that each of the visualization units 410 to 440 in the visualization unit 250 can visualize the stored data. The data storage and management unit 255 stores an artificial intelligence learning model and learning data that judges the risk level of security log data. The data storage and management unit 255 also stores rules that are predetermined by a user or administrator of the security operation system, and matches and stores previously processed attack events and their countermeasures.

[0127] Meanwhile, the above-described configuration of the security management device 120 can operate when the security log management device 140 is not included in the security management system 100. When the security log management device 140 is included in the security management system 100, the communication unit 210 can receive security log data determined to be an attack event from the security log management device 140, and the security event danger level determination unit 230 can determine the degree of danger, excluding the presence or absence of an attack event.

[0128] FIG. 16 is a flowchart showing a method for visualizing each piece of information by a security operation device according to an embodiment of the present invention.

[0129] The communication unit 210 receives security log data from each security device (S1710). When the security operation system 100 includes the security log management device 140, the communication unit 210 can receive security log data determined to be an attack event from the security log management device 140.

[0130] The log analysis unit 215 analyzes the received security log data, and the log formatting unit 220 converts the data into a standard log data format (S1720).

[0131] The security event risk determination unit 230 determines whether the risk of the security log data whose format has been converted is equal to or greater than a preset reference value (S1730). The security event risk determination unit 230 uses the artificial intelligence learning model learned by the log learning unit 225 to determine whether the security log data is an attack event, and if so, whether the risk is equal to or greater than a preset reference value.

[0132] If the risk level of the security log data is equal to or higher than a preset reference value, the risk level calculation module 260 processes the security log data according to the calculated risk level using a predetermined rule-based processing logic based on the processing results for the prestored attack event. That is, the security event processing suggestion unit 240 provides countermeasures for attack events similar to the attack event, or recommends appropriate countermeasures (S1740).

[0133] If the risk level of the security log data is equal to or lower than a preset reference value, the risk level calculation module 260 causes the security event automatic processing unit 235 to automatically process the attack event using a preset countermeasure (S1750).

[0134] The communication unit 210 receives an evaluation of the automatic processing or the recommended countermeasure from the security analysis device 130 (S1760). The security management device 120 can update the priority information at preset intervals based on the evaluation received from the security analysis device 130, and can recommend countermeasures based on the updated priority information, thereby improving the promptness of security measures.

[0135] In addition, the security operation device 120 can store in the data storage and management unit 255 not only the success, failure, processing time, and risk level of the recommended countermeasures, but also the processing results such as satisfaction, prognosis, and progress received from the security analysis device 130, and may use the statistical results obtained by digitizing the data stored in the data storage and management unit 255 for its own evaluation.

[0136] The security management device 120 can generate a rule-based processing logic for attack events corresponding to a risk level equal to or higher than a preset reference value at a preset period based on the quantified statistical results, or can weight a particularly significant processing method in the previously applied rule-based processing logic and reflect it in the security event recommendation order management unit.

[0137] The data storage and management unit 255 manages data related to the risk level of an attack event, an attack area, an attack type, processing details, an attack pattern, or attack volume information (S1770).

[0138] The data storage and management unit 255 converts data relating to the risk level of an attack event, the attack area, the attack type, the processing content, the attack pattern, or the attack volume information into data for visualization, and the visualization unit 250 visualizes the converted data (S1780).

[0139] In Fig. 16, each process is described to be performed sequentially, but this is merely an example of the technical idea of ​​one embodiment of the present invention. In other words, a person having ordinary skill in the art to which the embodiment of the present invention belongs can change the order described in each drawing and perform the process without departing from the essential characteristics of one embodiment of the present invention, or perform one or more of the processes in parallel, and thus the order of Fig. 16 is not limited to a chronological order.

[0140] Meanwhile, the process shown in Fig. 16 can be embodied as computer readable code in a computer readable recording medium. The computer readable recording medium includes all kinds of recording devices in which data readable by a computer system is stored. That is, the computer readable recording medium includes storage media such as magnetic storage media (e.g., ROM, floppy disk, hard disk, etc.) and optically readable media (e.g., CD-ROM, DVD, etc.). Also, the computer readable recording medium can be distributed among computer systems connected via a network so that the computer readable code can be stored and executed in a distributed manner.

[0141] The above description is merely an example of the technical idea of ​​the present embodiment, and various modifications and variations are possible within the scope of the essential characteristics of the present embodiment if one has ordinary knowledge in the technical field to which the present embodiment belongs. Therefore, the present embodiment is intended to explain, not to limit, the technical idea of ​​the present embodiment, and the scope of the technical idea of ​​the present embodiment is not limited by such an embodiment. The scope of protection of the present embodiment should be interpreted according to the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present embodiment. [Explanation of symbols]

[0142] 100 Security Management System 110 Security Devices 120 Security Management Device 130 Security Analysis Equipment 140 Security log management device 210 Communications Department 215 Log Analysis Department 220 Log Formatter 225 Log Learning Department 230 Security Event Risk Assessment Department 235 Security event automatic processing unit 240 Security Event Processing Proposal Section 245 Security Event Recommended Order Management Department 250 Visualization Department 260 Data Storage and Management Department 410 Risk Visualization Department 420 Processing Status Visualization Unit 430 Attack Position Visualization Department 440 Attack Pattern Visualization Department

Claims

1. a communication unit for receiving security log data or security log data that has been determined to be an attack event or has been processed from an external device; a log analysis unit that analyzes the security log data received by the communication unit, detects each data and event contained in each security log data, and extracts field information from each security log data; a log formatter that formats the field information extracted from the log analyzer into a standard format; a security event risk determination unit that uses the security log data in a standard format formatted by the log formatter to determine whether the security log data formatted by the log formatter is an attack event based on an artificial intelligence learning model that determines the risk level of pre-learned security log data, and provides the risk level of the security log data determined to be an attack event as an output value.

2. The standard format formed by the log forming unit is The security management device of claim 1, comprising one or more of the following: log source, event name, source IP address, target IP address, MAC address, security log data importance, status code, request data, request data length, protocol, file name, and original file.

3. The log formatting unit The security management device according to claim 2, characterized in that if there is no data corresponding to a data field in the standard format in each security log data, the data is filled with either a null or a padding value, thereby integrating and processing security log data of different models into one standard format.

4. 2. The security management device according to claim 1, further comprising a visualization unit that visualizes a current state of security risk based on information regarding a risk level or an attack state for security log data determined by the security event risk determination unit.

5. The visualization unit is The security management device according to claim 4, providing risk table information including IP information acquired from the security log data, an attack time and attack type corresponding to the IP information, a risk level, and a processing status.

6. The visualization unit is The security management device according to claim 5, characterized in that an attack event whose risk level judged by the security event risk judgment unit is equal to or lower than a preset standard value is displayed in a low risk table, and an attack event whose risk level judged by the security event risk judgment unit exceeds a preset standard value is displayed in a medium / high risk table.

7. a communication unit for receiving security log data or security log data that has been determined to be an attack event or has been processed from an external device; a security event risk determination unit that uses an artificial intelligence learning model that determines the risk level of pre-trained security log data to determine whether each security log data is an attack event, and provides the risk level of the security log data determined to be an attack event as an output value; a security event automatic processing unit that performs direct processing on an attack event whose risk level determined by the security event risk determination unit is equal to or lower than a preset reference value, based on a processing result for the attack event that has been stored in advance, in a predetermined rule base; a security event processing suggestion unit that provides countermeasures to an attack event whose risk level determined by the security event risk determination unit is equal to or higher than a preset reference value by referring to previously processed attack events and countermeasures for each attack event, and receives a satisfaction level for the countermeasures provided by a security analyst from a security analysis device used by the security analyst; A security management device characterized by including a security event recommendation order management unit that, for an attack event whose danger level determined by the security event danger level determination unit is equal to or higher than a preset reference value, recommends at least one of the following countermeasures based on the priority of satisfaction with attack events similar to attack events that are equal to or higher than a preset reference value within pre-stored processing results for the attack events, countermeasures based on the number of times used in security processing, or recently selected countermeasures, for an attack event whose danger level determined by the security event danger level determination unit is equal to or higher than a preset reference value.

8. The security event recommended order management unit includes: The security management device of claim 7, further comprising: searching for attack events similar to attack events whose risk level determined by the security event risk determination unit is equal to or higher than a preset reference value within pre-processed attack events and countermeasures for each attack event; and then sorting the list of countermeasures provided as a result of the search in order of satisfaction level to provide a first recommendation list.

9. The security event recommended order management unit includes: The security management device of claim 8, further comprising: determining whether a difference in satisfaction between the attack event and its countermeasure having the highest satisfaction level and other countermeasures is equal to or greater than a predetermined error range; determining whether there is a single countermeasure in the first recommendation list that has a higher satisfaction level than other countermeasures by equal to or greater than a predetermined error range; and recommending the attack event and its countermeasure as the optimal countermeasure.

10. The security event recommended order management unit includes: The security management device according to claim 9, characterized in that, when there are multiple countermeasures that have a satisfaction level higher than other countermeasures by more than a predetermined error range, the multiple countermeasures are arranged in order of the number of times they have been used in security processing to provide a second recommendation list, and the countermeasure in the second recommendation list that has the highest satisfaction level and the highest number of times it has been used in security processing is recommended.

11. The security event recommended order management unit includes: The security management device of claim 10, wherein if there is one or more countermeasures in the second recommendation list whose number of times used in security processing is within a preset error range, the security management device recommends a countermeasure that has been recently selected as the countermeasure.

12. 1. A method of security management using analysis of security log data, the method being performed by a security management device including at least one processor, comprising: A communication step of receiving security log data or security log data that has been determined to be an attack event or has been determined to be an attack event and processed from an external device; a log analysis step of analyzing the received security log data to detect respective data and events contained within each security log data and extracting field information from each security log data; a log formatting step of formatting the field information extracted in the log analysis step into a standard format; A security management method comprising: a judgment step of using the security log data in a standard format formatted by the log formatting step to determine whether the formatted security log data is an attack event based on an artificial intelligence learning model that judges the risk level of pre-learned security log data, and providing the risk level of the security log data judged to be an attack event as an output value.

Images