Data management device, data management method and a computer-readable recording medium storing a computer program for executing the data management method on a computer

Abstract

One embodiment of the present invention provides a data management method comprising: a step of obtaining a search condition based on user input in a data management platform that controls at least one engine or module included in a data management software package; a step of searching for log data based on the search condition; and a step of providing the search result according to a user type.

Description

Technology Field

[0001] The present invention relates to a data management device, a data management method, and a computer-readable recording medium storing a computer program for executing the data management method on a computer. Background Technology

[0003] As the volume and diversity of data increase due to technological advancements, the importance of data management is becoming increasingly prominent. Data management refers to the effective collection, storage, analysis, and utilization of data by companies or organizations.

[0004] Enterprise Resource Planning (ERP) systems, which comprehensively manage a company's core functions, are widely used as tools to efficiently manage critical corporate data. They allow for the effective operation of major corporate functions—such as budget management, production management, inventory management, and purchasing management—by integrating them into a single system. In this context, SAP products can be cited as a representative example of an ERP system.

[0005] However, in existing systems, it can be difficult to directly understand the meaning of packets generated during communication with a server using general analysis methods. In particular, when data is exchanged using complex data structures and specific protocols, such as in SAP systems, it is even more difficult to extract or interpret meaningful values ​​from packets; therefore, specific measures for packet analysis are required.

[0006] Furthermore, log data originates from various sources. For example, log data is recorded to monitor the behavior of systems or applications, used to monitor the security status of systems and track user activities, and utilized to track and debug errors occurring in applications.

[0007] Furthermore, log data is utilized in business analysis to aid in decision-making. For instance, it can be used for customer behavior analysis, marketing effectiveness analysis, and quality control. For these reasons, large volumes of log data are generated, making the efficient processing and analysis of this data a critical task. The problem to be solved

[0009] Accordingly, the present invention aims to provide a data management device, a data management method, and a computer-readable recording medium storing a computer program for executing the data management method on a computer, for solving the problems of existing technology. means of solving the problem

[0011] A disclosed embodiment provides a data management method comprising: a step of obtaining a search condition based on user input in a data management platform that controls at least one engine or module included in a data management software package; a step of searching for log data based on the search condition; and a step of providing the search result according to a user type.

[0012] The above-mentioned search step is characterized by including: a step of generating a search query corresponding to the above-mentioned search condition; and a step of searching for log data based on the above-mentioned search query.

[0013] The step of providing the above is characterized by including the step of providing a search result including the log data separated by at least one field when the user type is a general user type.

[0014] The above-mentioned step is characterized by including, when the user type is an advanced user type, a step of providing at least one of a search result corresponding to a selection field selected by user input among a plurality of interest fields of the log data and statistical data regarding the selection field and the interest field.

[0015] One disclosed embodiment provides a data management device comprising: a database for storing data; and a processor for processing said data, wherein the processor obtains a search condition based on user input, searches for log data based on said search condition, and provides said search results according to a user type in a data management platform that controls at least one engine or module included in a data management software package.

[0016] The processor is characterized by generating a search query corresponding to the search condition and searching for log data based on the search query.

[0017] The processor is characterized by providing a search result including log data separated by at least one field when the user type is a general user type.

[0018] The processor is characterized by providing at least one of a search result corresponding to a selection field selected by user input among a plurality of interest fields of the log data and statistical data regarding the selection field and the interest field when the user type is an advanced user type.

[0019] One disclosed embodiment provides a computer-readable storage medium that stores a data management program in a data management platform that controls at least one engine or module included in a data management software package, wherein the data management program performs the steps of obtaining a search condition based on user input, searching for log data based on the search condition, and providing the search result according to a user type. Effects of the invention

[0021] According to one embodiment of the present invention, the requirements for corporate data security and monitoring can be met by providing an innovative technology for data management in an ERP system.

[0022] In addition, according to one embodiment of the present invention, there is an advantage in that all connection records to the server are generated as logs, thereby ensuring the stability of the log records.

[0023] In addition, according to one embodiment of the present invention, there is an advantage in that the accuracy of personal information extraction can be improved through a multidimensional extraction method using personal information metadata and an exception handling list.

[0024] In addition, according to one embodiment of the present invention, there is an advantage that user behavior can be mapped to all log data containing personal information.

[0025] In addition, according to one embodiment of the present invention, there is an advantage that a large amount of personal information data can be decrypted and re-encrypted in real time.

[0026] In addition, according to one embodiment of the present invention, convenience can be provided to users who have difficulty inputting regular expressions by partially assisting with the input of regular expressions so that they can complete the entire regular expression.

[0027] In addition, according to one embodiment of the present invention, a convenience function for scanning previously registered parsers can be provided to increase the reusability of registered parsers.

[0028] In addition, according to one embodiment of the present invention, there is an advantage of being able to simultaneously search a large amount of data and check results in real time.

[0029] In addition, only the block containing at least one log data requested by a user / client among the entire compressed log data can be decompressed.

[0030] In addition, according to one embodiment of the present invention, the entire log data can be queried without decompression by using compression information and block offset information, thereby significantly shortening the export / import process. Brief explanation of the drawing

[0032] FIG. 1 is a drawing disclosing hardware for explaining the data management device of the present invention. FIG. 2 is a drawing disclosing an embodiment of a data management device of the present invention. FIG. 3 is a drawing disclosing an embodiment of the data management platform of the present invention. FIG. 4 is a drawing disclosing an embodiment of the data management method of the present invention. FIG. 5 is a drawing disclosing an embodiment of extracting personal information from data included in an analyzed packet of the present invention. FIG. 6 is a drawing disclosing an embodiment of the present invention that visualizes data included in an analyzed packet. FIG. 7 is a drawing disclosing an embodiment of the present invention for retrieving data included in an analyzed packet. FIG. 8 is a diagram illustrating an embodiment in which the data management platform of the present invention stores and monitors audit logs. FIG. 9 is a diagram illustrating an embodiment of the data management method of the present invention distributing collected packets. FIG. 10 is a diagram illustrating an embodiment in which the data management platform of the present invention analyzes HTTPS-based packets. FIG. 11 is a diagram illustrating an embodiment of the data management method of the present invention analyzing HTTPS-based packets. FIG. 12 is a diagram illustrating an embodiment of extracting and storing personal information in the data management platform of the present invention. FIG. 13 is a diagram illustrating an example of personal information metadata defined in the data management platform of the present invention. FIG. 14 is a diagram illustrating an example of extracting personal information by distinguishing architecture types in the data management platform of the present invention. FIG. 15 is a diagram illustrating an embodiment of generating personal information extraction rules in the data management platform of the present invention. FIG. 16 is a diagram illustrating an embodiment of generating a personal information exception processing list in the data management platform of the present invention. FIG. 17 is a diagram illustrating an embodiment of generating an exception filter for the data management platform of the present invention. FIG. 18 is a diagram illustrating another embodiment of the data management method of the present invention for extracting and storing personal information. FIG. 19 is a diagram illustrating an embodiment of collecting and mapping user behavior in the data management platform of the present invention. FIG. 20 is a diagram illustrating an embodiment of generating user behavior metadata in the data management platform of the present invention. FIG. 21 is a diagram illustrating an embodiment of mapping user behavior metadata and log data in the data management platform of the present invention. FIG. 22 is a diagram illustrating an embodiment of encrypting personal information in the data management platform of the present invention. FIG. 23 is a diagram illustrating an embodiment of encrypting personal information in the data management platform of the present invention. FIG. 24 is a diagram illustrating the mapping information table and the work table of the present invention. FIG. 25 is a diagram illustrating an embodiment of generating a new encryption key in the data management platform of the present invention. FIG. 26 is a diagram illustrating an embodiment of adding new business data in the data management platform of the present invention. FIG. 27 is a diagram illustrating an embodiment in which the data management platform of the present invention normalizes log data. FIG. 28 is a diagram illustrating an embodiment of the data management method of the present invention that generates a parser. FIG. 29 is a drawing illustrating an embodiment of the parser generation screen of the present invention. FIG. 30 is a diagram illustrating an embodiment of the data management method of the present invention that generates conversion rules. FIG. 31 is a diagram illustrating an embodiment of the data management method of the present invention that generates collection path rules. FIG. 32 is a diagram illustrating an embodiment of the data management method of the present invention for searching event logs. FIG. 33 is a diagram illustrating an embodiment of searching for logs in the data management platform of the present invention. FIG. 34 is a diagram illustrating an example of the external merge sort algorithm of the present invention. FIG. 35 is a diagram illustrating an embodiment of analyzing data in the data management platform of the present invention. FIG. 36 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention. FIG. 37 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention. FIG. 38 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention. FIG. 39 is a diagram illustrating an embodiment in which the data management platform of the present invention stores and retrieves log data. FIG. 40 is a diagram illustrating another embodiment in which the data management platform of the present invention stores and retrieves log data. FIG. 41 is a conceptual diagram disclosing layer-by-layer elements of a data management device according to an embodiment. FIG. 42 is a diagram illustrating an embodiment in which a data management device according to an embodiment monitors an agent. FIG. 43 is a flowchart of a data management method according to an embodiment. FIG. 44 is a diagram illustrating an embodiment in which a proxy server according to one embodiment is connected to another cloud service. FIG. 45 is a diagram illustrating the function of a proxy server according to one embodiment. FIG. 46 is a diagram illustrating other functions of a proxy server according to one embodiment. FIG. 47 is a diagram illustrating an embodiment of separating services within a proxy server according to one embodiment. FIG. 48 is a diagram illustrating an embodiment of scaling out a proxy server according to one embodiment. FIG. 49 is a diagram illustrating an embodiment in which a proxy server processes the NI protocol according to one embodiment. FIG. 50 is a diagram illustrating a proxy data collection process of a data management device according to one embodiment. FIG. 51 is a diagram illustrating an embodiment in which a proxy server according to one embodiment is connected to another cloud service. FIG. 52 is a flowchart illustrating a data management method according to one embodiment. FIG. 53 is a drawing illustrating a data management device according to an embodiment. FIG. 54 is a diagram illustrating an example of the structure of WEBGUI data according to an embodiment. FIG. 55 is a diagram showing the HTML analysis results within WEBGUI data according to an embodiment. FIG. 56 is a diagram showing the HTML analysis results within WEBGUI data according to an embodiment. FIG. 57 is a drawing showing the original WEBGUI data according to an embodiment. FIG. 58 is a diagram showing XML data with unnecessary information removed according to an embodiment. FIG. 59 is a diagram illustrating a data management method according to an embodiment. FIG. 60 is a drawing disclosing an example in which a data management platform according to an embodiment performs access control for a computing system. FIG. 61 is a drawing disclosing another example in which a data management platform according to an embodiment performs access control to a computing system. FIG. 62 is a drawing disclosing an example of an access control information input screen according to an embodiment. FIG. 63 is a drawing disclosing an example of an event processing rule screen according to an embodiment. FIG. 64 is a drawing disclosing an example of a correlation rule input screen according to an embodiment. FIG. 65 is a drawing disclosing an example of a correlation rule activation screen according to an embodiment. FIG. 66 is a drawing disclosing an example of a control data setting screen according to an embodiment. FIG. 67 is a flowchart disclosing an example of a data management method according to an embodiment converting a data format. FIG. 68 is a drawing disclosing an example in which a data management platform according to an embodiment performs log data-related indexing and log data compression. FIG. 69 is a drawing disclosing another example in which a data management platform according to an embodiment performs log data-related indexing and log data compression. FIG. 70 is a flowchart disclosing an example in which a data management method according to an embodiment performs log data-related indexing and log data compression. FIG. 71 is a drawing disclosing an example in which a data management platform according to an embodiment performs statistical query generation and statistical data visualization. FIG. 72 is a drawing disclosing an example of a query generation screen according to an embodiment. FIG. 73 is a drawing disclosing an example of a TopN query setting screen according to an embodiment. FIG. 74 is a drawing disclosing an example of a Time Series query setting screen according to an embodiment. FIG. 75 is a drawing disclosing an example of a Group By query setting screen according to an embodiment. FIG. 76 is a drawing disclosing an example of a statistical search screen according to an embodiment. FIG. 77 is a drawing disclosing an example of a visualization chart selection screen according to an embodiment. FIG. 78 is a drawing disclosing an example of a field mapping screen according to an embodiment. FIG. 79 is a flowchart disclosing an example in which a data management method according to an embodiment performs statistical query generation and statistical data visualization. FIG. 80 is a drawing disclosing an example in which a data management platform according to an embodiment performs time window-based correlation analysis. FIG. 81 is a drawing disclosing another example in which a data management platform according to an embodiment performs time window-based correlation analysis. FIG. 82 is a drawing disclosing an example of a correlation analysis rule registration screen according to an embodiment. FIG. 83 is a drawing disclosing an example of exceeding the number of times a target field is not used according to an embodiment. FIG. 84 is a drawing disclosing an example of exceeding the number of times a target field is used according to an embodiment. FIG. 85 is a drawing disclosing an example of a inhibition condition according to an embodiment. FIG. 86 is a drawing disclosing an example of non-occurrence detection according to an embodiment. FIG. 87 is a drawing disclosing an example of a continuous condition according to an embodiment. FIG. 88 is a flowchart disclosing an example in which a data management method according to an embodiment performs time window-based correlation analysis. FIG. 89 is a drawing disclosing an example in which a data management platform according to an embodiment performs a log data search based on a user type. FIG. 90 is a drawing disclosing an example of a search condition setting screen according to an embodiment. FIG. 91 is a drawing disclosing an example of a search condition UI according to an embodiment. FIG. 92 is a drawing disclosing an example of a search query according to an embodiment. FIG. 93 is a drawing disclosing an example of a general search result display area according to an embodiment. FIG. 94 is a drawing disclosing an example of a search option setting screen according to an embodiment. FIG. 95 is a drawing disclosing an example of an advanced search result display area according to an embodiment. FIG. 96 is a flowchart disclosing an example in which a data management method according to an embodiment performs a log data search based on a user type. Specific details for implementing the invention

[0033] Various embodiments are described in detail below with reference to the drawings. The embodiments described below may be modified and implemented in various different forms. In order to explain the features of the embodiments more clearly, detailed descriptions of matters widely known to those skilled in the art to which the following embodiments belong are omitted.

[0034] Meanwhile, when a configuration is described in this specification as being "connected" to another configuration, this includes not only cases where they are "directly connected," but also cases where they are "connected with another configuration in between." Furthermore, when a configuration is described as "including" another configuration, this means that, unless specifically stated otherwise, it does not exclude other configurations but may include additional configurations.

[0035] Additionally, terms including ordinal numbers, such as “first” or “second” as used herein, may be used to describe various components, but said components should not be limited by said terms. Such terms are used solely for the purpose of distinguishing one component from another.

[0036] Furthermore, since the function units included in each module are logical structures intended to describe the functions performed by the module, it goes without saying that the module can perform the functions performed by each function unit. In other words, each module does not need to include all the function units contained within it, but may include at least one function unit to perform a function.

[0037] Hereinafter, embodiments will be described in detail with reference to the attached drawings. In the embodiments, the framework, module, application program interface, etc., may be implemented as a device combined with a physical device or as software. In this case, if the embodiment is implemented as software, it may be stored on a storage medium, installed on a computer, etc., and executed by a processor.

[0039] FIG. 1 is a drawing disclosing hardware for explaining the data management device of the present invention.

[0040] This drawing illustrates an example of data transmission and reception between hardware components related to the data management platform described below.

[0041] The present invention may be provided to a user through a platform. To this end, a user / client (1000) can access a network device (1001) through a web browser, etc., and use data and applications stored in a separate storage / database (1003) under the control of a computing server (1004).

[0042] More specifically, the user / client (1000) can request a service (e.g., operations such as searching, modifying, or deleting data) through a client terminal and output data that is computed through a computing server (1004) and received through a network device (1001) to a screen. In one embodiment, the user / client (1000) may include all targets accessing the data management platform of the present invention. That is, in this drawing, the user / client (1000) can access the data management platform using a network device (1001), and there are no restrictions on the network device (1001).

[0043] A network device (1001) acts as an intermediary for data transmission between a user / client (1000) and a computing server (1004). Here, the network device (1001) may include a router, a TAP, a switch, etc. A router transmits data using an IP address, and a switch transmits data using a MAC address. Here, a network device (1001), such as a router, can transmit packets to a data management platform (10000) by mirroring only a specific port using a SPAN (Switched Port Analyzer) mode. This will be explained in detail below.

[0044] A TAP (Test Access Point) can be used to collect data on a network. More specifically, the TAP is one of the network devices (1001) and corresponds to a device that is added to the back-bone line of the network and specializes in mirroring. That is, packets can be transmitted to the data management platform (10000) of the present invention through the Network TAP (Test Access Point, hereinafter TAP). Accordingly, packets can be copied and transmitted to the data management platform without affecting the flow of data packets transmitted and received on the network.

[0045] Storage / database (1003) can store and manage data. Storage mainly uses hard disks or SSDs to store data, and database can manage structured data and perform operations such as searching and modifying.

[0046] The computing server (1004) is responsible for data processing. It processes tasks requested by the client (1000) and returns the processing results to the client (10000). To this end, it can perform calculation tasks using hardware such as a Central Processing Unit (CPU) and RAM. The computing server (1004) controls the input and output of various data and can store data processed by the data management platform (10000) in a storage / database (1003). At this time, the functions performed by the data management platform (10000) of the present invention can be performed by the processor of the computing server (1004). Additionally, the computing server (1004) may include a system manager that monitors and controls the status of hardware components or modules within the data management platform.

[0047] Hereinafter, the hardware components of the drawings may be used to implement the present invention, and a method for processing data between the hardware components is included.

[0049] FIG. 2 is a drawing disclosing an embodiment of a data management device of the present invention.

[0050] An embodiment of this drawing illustrates a data management device and includes a physical device and a logical component for explaining the data management device.

[0051] In one embodiment, the present invention may be provided to a user through a Software as a Service (SaaS) platform. A SaaS platform refers to software provided to a user as a service over a network using cloud computing technology. To this end, a storage / database (1003), a computing server (1004), and a container platform (1005) may support a user / client (1000) in using a data management platform (10000) and a data management software package (20000) on the cloud.

[0052] The present invention may use a user / client (1000), a storage / database (1003), an application server (1002), a computing server (1004), a container platform (1005), a data management platform (10000), and a data management software package (20000) for data processing.

[0053] At this time, the storage / database (1003) and the computing server (1004) may be hardware, and the application server (1002), container platform (1005), data management platform (10000), and data management software package (20000) may correspond to software. Refer to the above description regarding the hardware, and an embodiment of the data management device is described below with reference to this drawing.

[0054] The user / client (1000) can access the data management software (20000) for data processing.

[0055] A container platform (1005) can provide a virtual environment for data processing, composed of an OS (Operating System), a container, Docker, etc.

[0056] The data management platform (10000) can control at least one engine or module included in the data management software package (20000). To this end, the data management platform (10000) can manage data using technologies such as an internal database (wherein the database refers to an internal database within the data management software package (20000)), storage, and a distributed file system. Additionally, the data management platform (10000) may include a system manager or a management console for managing at least one engine or module included in the data management software package (20000).

[0057] The data management software package (20000) may include at least one of a collection module (20001), an analysis module (20002), a key management module (20003), a personal information management module (20004), a monitoring module (20005), and an AI engine (20006). However, the modules and engines included in the data management software package (20000) are not essential components and correspond to elements for explaining the present invention. Therefore, it is obvious that modules with different names may be included to perform data embodiments.

[0058] The collection module (20001) can collect data from various sources and transmit the data to a processing pipeline. The collection module (20001) can collect data (e.g., packets) from various sources such as logs, events, sensors, and web servers. In particular, the collection module (20001) can centrally manage agents when using agents for log collection.

[0059] The analysis module (20002) can be used to analyze data and derive valuable insights. The analysis module (20002) can extract data by analyzing collected packets. In this case, if the included data is personal information, functions related to personal information protection can be provided through the personal information management module (20004). Additionally, the included data can be mapped to previously collected behavioral information (e.g., including viewing, deleting, adding, changing, outputting, etc.).

[0060] The key management module (20003) can generate, store, and manage keys for data encryption and decryption. The key management module (20003) can manage keys using technologies such as tokens, symmetric keys, public keys, and digital certificates. If the data contains personal information, the key management module (20003) can generate, store, and manage keys for encrypting and decrypting the personal information. Additionally, even if the data does not contain personal information, the key management module (20003) can use technologies such as tokens, symmetric keys, public keys, and digital certificates for the security of the data.

[0061] The personal information management module (20004) can provide functions related to personal information protection. If personal information is included in the data, the personal information management module (20004) can control the collection, extraction, encryption, storage, processing, search, deletion, etc. of the personal information.

[0062] The monitoring module (20005) can perform data search and detection. The monitoring module (20005) can monitor data processing and the data processing environment and identify problems. In addition, the monitoring module (20005) can monitor logs, performance indicators, events, etc., and generate alerts.

[0063] The AI ​​engine (20006) can perform data processing and data analysis tasks using artificial intelligence technology (including machine learning). In particular, if text is included in the collected and stored logs, the AI ​​engine (20006) can classify the collected text based on artificial intelligence.

[0065] FIG. 3 is a drawing disclosing an embodiment of the data management platform of the present invention.

[0066] An embodiment of this drawing illustrates a data management platform (10000) and includes a physical device and a logical component. In particular, the data management platform (10000) in this drawing may correspond to a wider range than the data management platform described above. For example, the data management platform (10000) may include at least one of the modules implemented in the data management software package (20000) described above, and may include an Application Programming Interface (API) that runs on a physical device. For the physical device, refer to the description above.

[0067] The data management platform (10000) can perform the functions of a module included within the data management platform (10000) by utilizing the resources of the computing server (1004) and the storage / database (1003). At this time, the system manager can control at least one of the modules or engines within the data management platform (10000), and the system manager can control the data management platform (10000) by being located within the computing server (1004) or separately.

[0068] The data management platform (10000) may include at least one of a collection module (20001), an analysis module (20002), a key management module (20003), a personal information management module (20004), a monitoring module (20005), and an AI engine (20006). The description of each module is as described above.

[0069] The data management platform (10000) transmits and receives data with a user / client (1000), and can apply at least one function performed by a collection module (20001), an analysis module (20002), a key management module (20003), a personal information management module (20004), a monitoring module (20005), and an AI engine (20006) to the transmitted and received data. At this time, the data management platform (10000) may use individual modules included within the data management platform (10000) exclusively upon the request of the user / client (1000). For example, the user / client (1000) may selectively use only the function of the key management module (20003) or the personal information management module (20004) within the data management platform (10000).

[0070] Additionally, although not shown in the drawing, the data management platform (10000) may use an internal database different from the external storage / database (1003) to perform the functions of the modules included therein.

[0072] FIG. 4 is a drawing disclosing an embodiment of the data management method of the present invention.

[0073] In step (S1010), packets can be collected. In one embodiment, the method for collecting packets may utilize an agent-based cloud-based packet collection method or a packet mirror-based packet collection method. A detailed explanation will be provided later.

[0074] In step (S1020), a filter can be applied to the collected packets. More specifically, the data management method of the present invention can recombine and filter the collected packets and distribute them to an analysis process.

[0075] In step (S1030), the filtered packet can be analyzed.

[0076] Here, analysis can be performed differently depending on the type of protocol underlying the packet. More specifically, in step (S1031), packets based on the RFC (Remote Function Call) protocol can be analyzed, in step (S1032), packets based on the GUI protocol can be analyzed, and in step (S1033), packets based on HTTP / HTTPS can be analyzed.

[0077] In step (S1031), RFC protocol-based packet analysis refers to the process of analyzing packets using the RFC protocol in a network. RFC is a protocol and mechanism for performing function calls between different systems or computers in a distributed environment; it operates based on a client-server model and enables a client to call and execute a function of a server located on a remote system remotely. In other words, since the RFC protocol is a communication protocol for remote function calls, packets using the RFC protocol contain information regarding such remote function calls.

[0078] In step (S1032), GUI protocol-based packet analysis is a method of collecting GUI protocol-based packets communicating between a client and an application server and extracting the client IP or port, server IP or port, packet data (byte stream), etc. included in the packet.

[0079] In step (S1033), HTTP / HTTPS-based packet analysis is a method of extracting data contained in packets by mirroring packets transmitted and received between a web browser and a server or by performing SSL processing.

[0080] Detailed analysis methods for each will be described later.

[0081] In step (S1040), personal information can be extracted from the analyzed packet using personal information metadata. In one embodiment, personal information can be extracted using stored personal information metadata to determine whether the analyzed packet contains personal information. This will be described later.

[0082] In step (S1050), logs can be stored. At this time, meaningful information contained in the analyzed packets can be stored as logs. In one embodiment, the data management method may determine whether to store the analyzed information in an audit log. Additionally, if personal information is included, the personal information may be patterned and stored in a database. Finally, the data management method operates in a multithreading manner to increase the log storage speed and may perform memory queuing and file queuing to prepare for cases where the database is temporarily unavailable.

[0083] In step (S1060), abnormal behavior can be detected using the stored log. If abnormal behavior is detected, a new log recording information about the detection of abnormal behavior can be generated, and the log can be saved again through step (S1050). Additionally, the data management method can recreate the screen of the collected data when an audit log is requested by a user. More specifically, the GUI protocol is a protocol used to display and interact with a graphical user interface; by analyzing this protocol, the user's workflow, input, and output can be visually understood, and it can help identify the system's operating status and diagnose problems. This will be explained in detail in the drawings below.

[0085] FIG. 5 is a drawing disclosing an embodiment of extracting personal information from data included in an analyzed packet of the present invention.

[0086] In one embodiment, the data management platform (10000) can extract personal information from an audit log (1033) containing log data and an index using personal information metadata.

[0087] More specifically, the audit log (1033) is a set of logs that record events occurring on the network, and may include log data and an index. Here, the audit log (1033) may be a set of log data for which index processing has been completed.

[0088] A data management platform (10000) may use personal information metadata to extract personal information from audit logs. Here, the personal information metadata defines how the personal information is stored, in which fields it is stored, and regular expression patterns and masking patterns used for each type of personal information. For example, metadata for types of personal information such as name, address, and phone number can be configured. Accordingly, an analysis module can identify and extract personal information from log data based on the personal information metadata.

[0089] In one embodiment, the extracted personal information may be encrypted according to a pre-configured method for each type of personal information and stored again on an audit log (1033) or an internal database of a data management platform (10000). Further details will be described later.

[0090] In one embodiment, the data management platform (10000) can search for log data for a specific period using extracted personal information, and an administrator or user can search or check the searched log data when necessary. This will be described later.

[0092] FIG. 6 is a drawing disclosing an embodiment of the present invention that visualizes data included in an analyzed packet.

[0093] The data included in the packet analyzed through the above-described embodiment is as follows.

[0094] (1) Session Information: Start Time, Duration Time, Log ID, Session ID, Context ID

[0095] (2) Connection Information: Server IP, Server Port, Server Mac, Client IP, Client Port, Client Mac

[0096] (3) SAP Information: SID, Protocol, SAP Instance, Client

[0097] (4) Program Information: OK Code, T-code, Title App, Title Main

[0098] (5) CUA (Central User Administration) information: CUA Name, CUA Status

[0099] (6) User information: User ID, User UID, Username

[0100] (7) Event Information: Event Category, Event Code, Event Name, Event Description, Event Value, Notification Level

[0101] (8) User-defined information: Event, Alert, Event type, Number of events, Number of alerts, Architecture, Presence of personal information, Number of personal information types, Number of personal information items

[0102] In one embodiment, the data management platform can extract such data from the analyzed packet. In this case, if the data extracted from the packet contains personal information, the data management platform can perform encryption on the personal information and store it. In particular, the data management platform can output the personal information to a separate screen.

[0103] Through this, all information required by law and certification (account information, access date and time, access location information, information on the processing subject, and performed tasks) can be collected. More specifically, account information can be determined through the user ID, employee number, and organization name in user information; access date and time through the start time in session information; access location information through the client IP or port in access information; information on the processed data subject through user-defined information (existence of personal information, number of personal information records, resident registration number, alien registration number, passport information, card information, etc.); and performed tasks through program information and user-defined information.

[0105] FIG. 7 is a drawing disclosing an embodiment of the present invention for retrieving data included in an analyzed packet.

[0106] In one embodiment, the data management platform can search the aforementioned data and provide search results to the user.

[0107] To this end, as shown in (a) of the present drawing, the data management platform may provide a search interface to enable users to search easily. The data management platform may search for data based on fields of the analyzed data. For example, data fields may include protocol, system, account, employee ID, server IP, server port, client IP, client port, instance name, transaction name, program name, etc. At this time, the data management platform may search for data based on at least one of the fields input by the user and output the search results.

[0108] In another embodiment, as shown in (b) of the drawing, the data management platform may provide a query search function. For example, if a user enters protocol_type=GUI as the first query and server_ip=175.117.145.125 as the second query, the data management platform may search for data based on the first query and the second query.

[0109] In one embodiment, the searched result may be output in the form of a “screen reproduction” or “data” as described above.

[0111] FIG. 8 is a diagram illustrating an embodiment in which the data management platform of the present invention stores and monitors audit logs.

[0112] In one embodiment, the data management platform (10000) can generate an audit log (1033) by converting and processing the original data extracted according to the above-described embodiment according to defined field rules. Here, the generated audit log (1033) can be stored in a database (20007).

[0113] Additionally, the data management platform (10000) can extract personal information from the processed data using personal information metadata. Accordingly, the data management platform (10000) can store the audit log (1033) and personal information in the database (20007), respectively. To this end, the analysis module (20002) may further include an audit log storage unit (2008).

[0114] Additionally, the analysis module (20003) may further include a correlation analysis rule generation unit (2009). The data management platform (10000) can generate correlation analysis rules through the analysis module (20002). Here, a correlation rule may represent a rule for determining abnormal behavior. For example, the data management platform (10000) may determine normal behavior when 1-2 data entries are input per second, and determine abnormal behavior when 10 or more data entries are input per second. Here, the expression “correlation” may represent the correlation between logs. At this time, the data management platform (10000) may generate another event (log) based on the correlation rule. The log at this time may be defined as an incident. That is, a subject who wishes to monitor through the data management platform (10000) can generate correlation rules, and the data management platform (10000) can analyze logs based on the correlation rules and generate another login incident.

[0115] Additionally, the correlation analysis rule may correspond to a rule previously defined by another platform. Accordingly, the data management platform (10000) can generate an abnormal behavior event by analyzing the audit log (1033) using the generated correlation analysis rule. At this time, information regarding the generated correlation analysis rule and information regarding the abnormal behavior event may be stored in the database (20007).

[0116] The monitoring module (20005) of the data management platform (10000) may further include an abnormal behavior monitoring unit (2010). The abnormal behavior monitoring unit (2010) can search for or monitor stored audit logs (1033), personal information, etc. based on generated abnormal behavior events.

[0117] Accordingly, the data management platform (10000) can extract personal information from the collected, analyzed, and stored data, and can statistically analyze user behavior using the extracted personal information. Subsequently, if a violation occurs among the collected user behaviors, the data management platform (10000) can block the user or provide a warning to the administrator.

[0119] FIG. 9 is a diagram illustrating an embodiment of the data management method of the present invention distributing collected packets.

[0120] In step (S10010), the data management method can collect packets and apply filters. At this time, the data management method can collect packets through network equipment such as a NIC. Afterwards, the data management method can reassemble the collected packets and combine each network packet into an analyzable packet form.

[0121] In one embodiment, the data management method may determine whether to analyze packets based on filtering rules. Here, the filtering rules may be determined by the data management platform. More specifically, the data management method may collect packets through network equipment such as the aforementioned NIC or router. Since analyzing all collected packets may lead to performance issues, packets to be analyzed may be filtered by filtering rules. For example, packets based on HTTP or SAP GUI protocols may need to be analyzed, but packets collected using other protocols may not need to be analyzed. In this case, the data management method may filter the collected packets to analyze only packets based on the desired protocol by port or IP. In this case, the user may directly set the filtering rules using the data management method.

[0122] In step (S10020), the data management method can distinguish protocols based on TCP session information. As described above, the data management method can distinguish and analyze collected packets based on protocols.

[0123] The data management method may analyze packets in different ways based on the protocol distinguished in step (S10020). The analysis method for each is as described above.

[0124] In step (S10030), the data management method can analyze RFC protocol-based packets.

[0125] In step (S10040), the data management method can analyze GUI / SNC protocol-based packets.

[0126] In step (S10050), the data management method can analyze HTTP / HTTPS-based packets.

[0127] In steps (S10030) to (S10050), the data management method may perform processing rules for analysis after parsing the packet. At this time, the data management method may extract various data (account data, SID, screen input data, screen output data, etc.) by analyzing the binary data of the packet. Additionally, the processing rules may represent settings for processing whether to store the data included in the analyzed packet in the audit log (1033), whether to process or log the data included in the analyzed packet, and whether to generate events and warnings. Furthermore, the data management method may additionally perform filter rules for filtering unnecessary logs and loading rules for loading data to process the processing rules.

[0128] In step (S10060), the data management method can generate an audit log (1033) based on the analyzed packets. At this time, the data management method operates in a multi-threading manner to increase the log storage speed and can perform memory queuing and file queuing in preparation for cases where access to the database is temporarily unavailable.

[0129] In step (S10070), the data management method can extract personal information using personal information metadata for the generated audit log (1033).

[0130] In step (S10080), the data management method can store the audit log (1033). At this time, the data management method can store the audit log (1033) and personal information separately.

[0131] In step (S10090), the data management method can monitor abnormal behavior.

[0133] FIG. 10 is a diagram illustrating an embodiment in which the data management platform of the present invention analyzes HTTPS-based packets.

[0134] User behavior in web browsers protected by HTTPS (SSL) cannot be logged using existing network traffic mirroring technologies. In particular, logs cannot be recorded when the Diffie-Hellman algorithm is used for key exchange during an HTTPS connection. Here, the Diffie-Hellman algorithm is one of the algorithms used in symmetric-key encryption and corresponds to a method for securely executing key exchange protocols.

[0135] However, in order to monitor abnormal behavior and the overuse of personal information within the company, there is a need to record and monitor logs of user behavior in web browsers.

[0136] According to one embodiment of the present invention, even when using the Diffie-Hellman algorithm for key exchange, logs of user behavior in a web browser can be recorded to monitor abnormal behavior and excessive misuse of personal information within the company.

[0137] To this end, the data management platform (10000) enables monitoring of user behavior even when using the Diffie-Hellman algorithm.

[0138] More specifically, the analysis module (20002) of the data management platform (10000) may further include a proxy server configuration unit (2011), an SSL configuration unit (2012), an HTTP request / response data analysis unit (2013), and a message data generation unit (2014).

[0139] Here, the proxy server configuration unit (2011) can configure a proxy server (1031) between a web browser (1030) and a web server (1034). Here, the proxy server (1031) is a server that mediates network communication between a client and a server, and when the client uses the proxy server (1031), it can communicate indirectly through the proxy server (1031) without communicating directly with the web server (1034).

[0140] The SSL configuration unit (2012) can configure SSL on the proxy server (1031). More specifically, the SSL configuration unit (2012) can configure the proxy server (1031) and configure an SSL environment between the web browser (1030) and the proxy server (1031) using client SSL settings to perform processing for HTTPS requests / responses. In one embodiment, the SSL configuration unit (2012) can use an SSL certificate for SSL configuration. Here, the SSL certificate may correspond to a certificate different from the certificate used to analyze the packet described above. That is, the SSL certificate at this time corresponds to one that supports SSL configuration.

[0141] A proxy server (1031) that receives HTTPS request data can temporarily suspend the SSL connection, process the HTTP request / response data through the HTTP request / response analysis unit (2013), and re-establish the SSL connection.

[0142] Accordingly, the message data generation unit (2014) can generate message data (1035) by combining HTTP request / response data and can store the generated message data (1035) in a queue (1032). Here, the queue (1032) may include a memory queue and a file queue.

[0143] Afterwards, the data management platform (10000) can transmit message data (1035) stored in the queue (1032) to the outside.

[0144] Finally, the data management platform (10000) can configure an SSL environment between the proxy server (1031) and the web server (1034) using server SSL settings to perform processing for HTTPS requests / responses and transmit HTTPS response data.

[0145] This allows logging of user behavior in the web browser to be recorded even when using the Diffie-Hellman algorithm.

[0147] FIG. 11 is a diagram illustrating an embodiment of the data management method of the present invention analyzing HTTPS-based packets.

[0148] In step (S20010), the data management method may configure a proxy server and set client SSL to collect HTTPS-based packets, and in step (S20020), configure a proxy server and set server SSL. That is, the data management method may configure a proxy server and use the server SSL settings to configure an SSL environment between the proxy server and the web server to perform processing for HTTPS requests / responses and transmit HTTPS response data.

[0149] When a proxy server is configured and SSL is set up, in step (S20030), the data management method may collect HTTPS packets. Unlike the above description, the data management method of the present drawing describes, as an example, the case of collecting HTTPS packets.

[0150] In the case of HTTPS connections, the Diffie-Hellman algorithm is used for key exchange. Since existing network traffic mirroring technology cannot record logs of user behavior when packets are encrypted using the Diffie-Hellman algorithm, the present invention proposes the following method.

[0151] In step (S20040), the data management method can perform processing for HTTPS requests / responses. That is, the data management method can perform processing for HTTPS requests / responses by configuring a proxy server and establishing an SSL environment between the web browser and the proxy server using client SSL settings. Subsequently, the proxy server that receives the HTTPS request data can terminate the SSL connection, process the HTTP request / response data, and then re-establish the SSL connection.

[0152] In step (S20050), the data management method can generate message data (1035) by combining HTTP request / response data. At this time, the data management method can filter out unnecessary data. More specifically, the data management method can generate message data (1035) by combining HTTP request / response data, but may not transmit unnecessary data (e.g., image data) when logging.

[0153] In step (S20060), the data management method may load the generated message data (1035) into at least one of a memory queue or a file queue. More specifically, the data management method may use a memory queue and a file queue as queues for storing the message data (1035). At this time, since there is a risk of reduced performance if only a file queue is used to store the message data (1035), and data loss may occur if only a memory queue is used, the two queues may be used in combination.

[0154] In step (S20070), the data management method can transfer the message data (1035) loaded in the queue to a storage facility for storage. Here, the storage facility corresponds to a database included within the data management platform described above.

[0156] FIG. 12 is a diagram illustrating an embodiment of extracting and storing personal information in the data management platform of the present invention.

[0157] Methods using regular expressions are primarily used to extract personal information. However, there is a risk that methods using regular expressions may result in incorrect extraction.

[0158] To address these issues, the present invention can improve the accuracy of personal information extraction by using a multidimensional extraction method that utilizes personal information metadata and an exception handling list, in addition to a regular expression method for extracting personal information.

[0159] The personal information management module (20004) included in the data management platform (10000) of the present invention may define personal information types to extract personal information from an audit log (1033). Here, the audit log (1033) may include log data for which index processing has been completed. Additionally, the personal information types may include types of personal information such as, for example, a resident registration number, a credit card number, an account number, etc.

[0160] More specifically, the personal information type analysis unit (2019) of the personal information management module (20004) can analyze the personal information types and extraction methods used in the stored audit log (1033) to generate personal information metadata (1036) for extracting personal information. The results of this analysis can be stored in the personal information metadata (1036). At this time, the personal information management module (20004) can define fields included in the personal information metadata (1036) based on the architecture type (wherein the architecture includes an application development environment and a screen user interface (UI)). Here, the architecture type corresponds to information that distinguishes a parser that analyzes variables and values ​​of log data. In one embodiment, the personal information management module (20004) can distinguish the architecture type based on the protocol type and URL for field information within the log data, and accordingly, generate field information of the index. Additionally, personal information metadata (1036) may include an architecture type (screen type), screen information (level 1, level 2) and personal information extraction rules.

[0161] To this end, the personal information pattern storage unit (2020) of the personal information management module (20004) can store patterns used for each type of personal information. The personal information management module (20004) can define types of personal information and store regular expression patterns and masking patterns used for each type of personal information. Here, the reason the personal information management module (20004) defines types of personal information and stores regular expression patterns used for each type of personal information is to generate information included in the personal information metadata (1036).

[0162] In conclusion, the data management platform (10000) can generate personal information metadata (1036) by defining personal information types and storing regular expression patterns used for each personal information type, and can generate personal information extraction rules using the personal information metadata (1036) and the personal information exception handling list (1037) described later, and can extract personal information using the personal information extraction rules.

[0163] Additionally, the personal information exception processing list generation unit (2021) of the personal information management module (20004) can generate a personal information exception processing list (1037), and the personal information extraction rule generation unit (2022) can generate personal information extraction rules to be extracted. At this time, in order to generate the personal information exception processing list (1037), the personal information management module (20004) can identify personal information items virtually extracted from the audit log (1033) using personal information metadata (1036), and can define exception processing rules to be included in the exception processing list (1037) based on the extracted values ​​or analyzed variables.

[0164] In another embodiment, the personal information hash value collection unit (2023) of the personal information management module (20004) can collect hash values ​​by type of personal information and generate a value filter by type of personal information. Here, the value filter corresponds to a filter created using a Bloom-filter data structure for the hash value of the personal information value. The present invention has the advantage of being able to quickly check whether a comparison value is included in a large data set through the value filter.

[0165] More specifically, the personal information management module (20004) can collect hash values ​​for personal information values ​​by type and store them by personal information type. The personal information value filter generation unit (2024) of the personal information management module (20004) can generate a personal information type value filter file based on the collected personal information data.

[0166] Subsequently, the personal information extraction unit (2025) of the personal information management module (20004) can extract personal information, the personal information encryption unit (2026) can encrypt the extracted personal information, and the personal information storage unit (2027) can store the encrypted personal information. More specifically, the personal information management module (20004) can analyze log data included in the audit log (1033) by architecture type to extract variables and values, and can extract personal information using personal information metadata (1036) that includes personal information (extraction) rules in the extracted values.

[0167] In one embodiment, the personal information management module (20004) can verify whether the hash value of the extracted personal information value is included in the value filter. If the hash value is included in the value filter, the personal information management module (20004) can store the extracted personal information in the index of the audit log (1033). On the other hand, if the hash value is not included in the value filter, the personal information management module (20004) can determine that it was incorrectly extracted and remove the extracted personal information.

[0168] Afterwards, when searching for encrypted personal information, the personal information management module (20004) can decrypt the encrypted personal information and then output the personal information processed by the masking rule.

[0169] Hereinafter, the functions performed by the personal information management module (20004) may be referred to as those performed by the data management platform (10000).

[0170] Through this, the accuracy of personal information extraction can be improved. The present invention will be described in detail below with reference to the drawings.

[0172] FIG. 13 is a diagram illustrating an example of personal information metadata (1036) defined in the data management platform of the present invention.

[0173] In one embodiment, the data management platform can extract personal information included in the audit log using personal information metadata (1036). To do this, the data management platform can generate and store personal information metadata (1036).

[0174] The data management platform can define the types and methods of personal information to be extracted for each architecture type and store them in personal information metadata (1036). Here, the architecture type may indicate whether it is GUI data, JSON data, WEBGUI, etc. That is, the data management platform can define the types and methods of personal information to be extracted for each GUI data and store them in personal information metadata (1036), and can define the types and methods of personal information to be extracted for each JSON data.

[0175] More specifically, personal information metadata (1036) may include architecture type, screen information (level 1), screen information (level 2) and personal information extraction rules.

[0176] Here, the architecture type corresponds to the screen type as described above. It includes information about what kind of screen is actually output. In one embodiment, a personal information extraction rule may be determined based on the architecture type. Additionally, the personal information metadata (1036) may include Level 1 screen information and Level 2 screen information corresponding to the architecture type.

[0177] Personal information extraction rules may include extraction methods and values. Examples of extraction methods include value extraction methods, variable extraction methods, value content extraction methods, full text regular expression extraction methods, and complex personal information extraction methods. The extraction methods will be explained below.

[0178] The value extraction method is a method of extracting personal information based on the value of the extracted personal information. In this case, the data management platform of the present invention may use a list of personal information types for the value of the value extraction method.

[0179] The variable extraction method is a method of extracting personal information based on variables included in the architecture type. In this case, the data management platform of the present invention may use both a list of personal information types and a list of variable names for the value of the variable extraction method. Here, the list of variable names corresponds to a list of variable names according to the personal information type. For example, on Screen A (Type A), "Resident" may be included in the list of variable names, and on Screen B (Type B), "SSN" may be included in the list of variable names.

[0180] The full-text regular expression extraction method is a method for extracting personal information based on full text that cannot be parsed when variables do not exist. In this case, the data management platform of the present invention may utilize both a personal information type list and a pattern list for the value of the full-text regular expression extraction method. Here, the pattern list may include not only the regular expression for the value but also patterns added before or after the regular expression. For example, if the regular expression is a resident registration number, the data management platform may include cases where a ":" precedes the resident registration number in the pattern list.

[0181] The complex personal information extraction method is a method of extracting personal information based on two or more pieces of personal information, rather than based on a single piece of personal information. In one embodiment, the data management platform may determine that something is personal information only when both "Name" and "Resident Registration Number" exist for each architecture type. On the other hand, the data management platform may determine that something is not personal information when only one of "Name" or "Resident Registration Number" exists for each architecture type.

[0182] In this way, the data management platform of the present invention can extract personal information based on the information included in the personal information metadata (1036).

[0184] FIG. 14 is a diagram illustrating an example of extracting personal information by distinguishing architecture types in the data management platform of the present invention.

[0185] In one embodiment, the architecture type analysis unit (2029) of the data management platform (10000) distinguishes the architecture type from the audit log (1033) and then extracts personal information using the personal information metadata (1036) defined for each architecture type through the personal information extraction unit (2025).

[0186] More specifically, the data management platform (10000) can define fields included in personal information metadata (1036) based on an architecture type. Here, the architecture type corresponds to information that distinguishes a parser for analyzing variables and values ​​of log data. That is, the parsing method for analyzing variables and values ​​varies depending on the architecture type. Therefore, the data management platform (10000) must define fields included in personal information metadata (1036) based on an architecture type.

[0187] In one embodiment, the architecture type analysis unit (2029) of the data management platform (10000) can distinguish the architecture type based on the protocol type and URL for the field information within the log data included in the audit log (1033), and accordingly, can generate field information of the index.

[0188] Accordingly, the personal information extraction unit (2025) of the data management platform (10000) can extract personal information by utilizing at least one of the personal information metadata (1036) defined by architecture type and the aforementioned exception handling list (1037).

[0189] Subsequently, the data management platform can encrypt the extracted personal information and store the encrypted personal information.

[0191] FIG. 15 is a diagram illustrating an embodiment of generating personal information extraction rules in the data management platform of the present invention.

[0192] In one embodiment, a data management platform can generate personal information extraction rules. To this end, a user interface for generating personal information extraction rules is described herein. To generate personal information extraction rules, the user interface may include at least one of basic information, value regular expression extraction information, and variable-based extraction information.

[0193] More specifically, the basic information indicates the target to which the personal information extraction rule is to be applied. Here, the basic information may include at least one of a log type, Level 1 (screen, transaction), and Level 2 (program, service). Accordingly, the user may input at least one of a log type (e.g., SAP GUI log), Level 1, or Level 2 as the target to which the personal information extraction rule is to be applied.

[0194] In addition, the value regular expression extraction information may include personal information to be extracted according to the personal information extraction method. More specifically, all personal information exists, and the data management platform may receive a selection of personal information to be extracted from the user. Accordingly, the data management platform can determine personal information by extracting values ​​from logs according to the personal information extraction method and comparing them with regular expression patterns. To this end, the data management platform may utilize regular expression pattern files stored by personal information type, as described in the above-described embodiment.

[0195] In addition, the data management platform can generate personal information extraction rules using the values ​​of variables analyzed by log type. To this end, the data management platform can receive variable-based extraction information from the user.

[0197] FIG. 16 is a diagram illustrating an embodiment of generating a personal information exception processing list in the data management platform of the present invention.

[0198] In one embodiment, the data management platform may generate a personal information exception processing list (1037). More specifically, the data management platform may identify personal information items that are virtually extracted using personal information metadata (1036) from an audit log (1033). That is, the data management platform may virtually extract personal information using items included in the personal information metadata (1036) (e.g., the aforementioned key / value, screen name / field name, etc.). Here, the virtually extracted personal information items correspond to candidate data output based on the items of the personal information metadata (1036) generated according to the embodiment of the present invention from the original log data.

[0199] The data management platform can generate an exception handling list (1037) based on extracted values ​​or analyzed variables. More specifically, the data management platform can generate an exception handling list (1037) based on items included in personal information metadata (1036).

[0200] At this time, the data management platform may generate an exception handling list (1037) for at least one of the architecture type, screen information, and personal information extraction rule included in the personal information metadata (1036). For example, when generating the exception handling list, the data management platform may register, for instance, “in the first architecture (UI) type, the corresponding key is not extracted because it is not personal information” or “in the second architecture (UI) type, the corresponding value is not extracted because it is not personal information.”

[0201] For example, the data management platform can extract “account number” as virtual personal information from the audit log (1033). Here, the “account number” corresponds to candidate data. Additionally, the screen name / field name of the personal information metadata (1036) may include A product / serial number. Here, it is assumed that the serial number of A product does not correspond to personal information. In this case, if the serial number of A product is identical to the “account number” which is personal information, the data management platform may determine that the extracted “account number” is not personal information and register it in the exception handling list (1037).

[0202] That is, the data management platform can verify the personal information that is virtually extracted by referring to the personal information metadata (1036) defined according to the above-described embodiment. Since the personal information at this time is candidate data rather than accurate personal information, an exception processing list (1037) can be generated for the candidate data based on the items included in the personal information metadata (1036).

[0203] In one embodiment, when the data management platform extracts personal information from the audit log (1033), it may extract personal information excluding items included in the exception handling list (1037).

[0204] Accordingly, this has the advantage of lowering the probability of extracting incorrect personal information.

[0206] FIG. 17 is a diagram illustrating an embodiment of generating an exception filter for the data management platform of the present invention.

[0207] In one embodiment, the data management platform can generate an exception handling list using the method described above. The present drawing describes an exception filter user interface for generating an exception handling list. The exception filter user interface may include at least one personal information item.

[0208] In one embodiment, the data management platform may receive exception filter information for personal information items from a user. Here, the exception filter information may include at least one of an architecture type (UI type), a level 1 (screen, transaction), a value, a level 2 (program, service), and a variable.

[0209] To explain using the example of this drawing, the data management platform can receive exception filter information from the user, such as “Architecture Type=SAP GUI”, “Level 1=SE16”, “Level 2=SAPMF02D-7230”, “Variable=RDTMS_VAL2”, and “Value=8201301037329”.

[0210] Accordingly, the data management platform can generate an exception handling list using exception filter information received from the user.

[0212] FIG. 18 is a diagram illustrating another embodiment of the data management method of the present invention for extracting and storing personal information.

[0213] In addition, there is a risk that personal information extracted using a regular expression pattern method may be extracted incorrectly. Accordingly, in addition to the embodiments described above, the present invention may apply a Bloom filter to personal information actually present in the logs to reduce the risk of incorrect extraction of personal information. That is, by applying a Bloom filter to the extracted personal information, the accuracy of personal information extraction can be improved by extracting only when it is determined to be personal information. This will be explained in detail below.

[0214] In step (S50010), the data management method may collect hash values ​​for personal information. More specifically, the data management method may collect hash values ​​for various types of personal information values ​​from a system / platform that manages personal information, such as a personal information encryption solution. Here, the system / platform that manages personal information may exist on an external server. In one embodiment, the data management method may store the collected hash values ​​by type of personal information.

[0215] In step (S50020), the data management method can create a value filter for each type of personal information. Here, the value filter corresponds to a filter created using a bloom filter data structure for the hash value of the personal information value.

[0216] In step (S50030), the data management method can extract personal information. In one embodiment, log data within the audit log is analyzed by architecture type to extract variables and values, and personal information can be extracted by applying personal information extraction rules to the extracted values. This is as described above.

[0217] In step (S50040), the data management method can verify the personal information value. That is, in addition to the above, a value filter can be used to verify the extracted personal information value.

[0218] In step (S50050), if the hash value of the personal information is included within the value filter, in step (S50060), the data management method may store the extracted personal information in an index. More specifically, if the hash value of the extracted personal information is included within the value filter created using a Bloom-filter data structure, the data management method may determine that the extracted personal information is real personal information. Accordingly, the data management method may store an index indicating that the extracted personal information is real personal information within the audit log.

[0219] In step (S50070), if the hash value of the personal information is not included within the value filter, in step (S50080), the data management method may remove the extracted personal information. More specifically, if the hash value of the extracted personal information is not included within the value filter created using a Bloom-filter data structure, the data management method may determine that the extracted personal information is fake personal information. Accordingly, the data management method may determine that the extracted personal information was incorrectly extracted and remove the extracted personal information. Here, removing the extracted personal information may mean losing its value as personal information, rather than removing the data itself.

[0220] Accordingly, the present invention allows for rapid comparison of large amounts of managed personal information with values ​​extracted from such personal information using a Bloom-filter data structure. Additionally, it can eliminate errors related to types of personal information that are difficult to verify.

[0222] FIG. 19 is a diagram illustrating an embodiment of collecting and mapping user behavior in the data management platform of the present invention.

[0223] User business activities performed on an application are expressed differently depending on the developer's preferences and development standards. That is, the present invention aims to facilitate the distinction of user activities such as “viewing, deleting, adding, changing, and printing” regarding data based on user business activities.

[0224] Accordingly, the present invention collects text of application menus and icons and automatically classifies them based on artificial intelligence to enable detailed differentiation of legally required user actions.

[0225] In addition, an audit log is a log that records information such as events occurring in the system and user activities, and can be used for security and audit trails. Here, the audit log may include log data and an index corresponding to the log data.

[0226] Log data is generally distinguished by information such as time, event / behavior, user / subject, target / object, and result; each piece of log data forms a single record, and multiple records can be recorded consecutively.

[0227] Furthermore, audit log data is typically managed by indexing it in databases or similar systems. In this context, an index for each log record may also be managed to efficiently search and analyze the log data. Here, the index usually includes information such as fields used for searching and keys designed to improve search speed.

[0228] For example, to search for records of a user deleting a specific file in an audit log containing fields such as time, event / behavior, user / subject, and target / object, an index can be created by combining the time field and the target field. Utilizing such an index has the advantage of significantly reducing search time.

[0229] Furthermore, mapping user behavior to an index allows log data to be classified based on user behavior, which has the advantage of facilitating security analysis or monitoring.

[0230] The data management platform of the present invention indexes log data included in audit logs based on user behavior classified by artificial intelligence, enabling users to search for log data based on user behavior. The present invention will be described in detail below.

[0231] The data management platform (10000) of the present invention can collect user behavior using a collection module (20001), an analysis module (20002), a monitoring module (20005), and an AI engine (20006), map it to log data to perform index processing, and then provide log data indexed by user behavior in response to a log data lookup request.

[0232] More specifically, keys and text corresponding to user actions can be collected using a collection module (20001). At this time, the collection module (20001) can collect user actions by connecting to an application development environment. The application development environment stores keys and text for menus and icons that select user actions. Accordingly, the collection module (20001) included in the data management platform (10000) of the present invention can collect keys and text corresponding to such user actions.

[0233] The AI ​​engine (20006) can classify user actions based on artificial intelligence (AI) in the collected text. For example, user actions may include user business actions such as viewing, deleting, adding, changing, and printing. To this end, the AI ​​engine (20006) may use methods such as machine learning, deep learning, natural language processing (NLP), and rule-based approach.

[0234] The analysis module (20002) can generate user action metadata (1038) by classifying data regarding classified user actions into keys and user actions. At this time, the user action metadata (1038) can be stored in the internal database (20007) of the data management platform (10000).

[0235] The analysis module (20002) can map the stored user behavior metadata (1038) and the log data included in the audit log (1033). At this time, in order to map the log data and the user behavior metadata (1038), the analysis module (20002) can map the key information within the user behavior metadata (1038) to a field that can be used as a key by application development environment type when indexing the log data, and store it in the user behavior field of the index.

[0236] Here, key information represents identification information indicating user behavior. In one embodiment, the data management platform (10000) may not store user behavior as text, but may store it as an abbreviated ID (Identification) to identify user behavior. For example, the data management platform (10000) may store “R” as key information when the user behavior is “view,” store “D” as key information when the user behavior is “delete,” store “U” as key information when the user behavior is “edit,” and store “P” as key information when the user behavior is “print.”

[0237] The user can view logs through the monitoring module (20005). In one embodiment, when the monitoring module (20005) provides log data included in the audit log (1033) within the database (20007), it can provide information to the user by referencing the user behavior field of the index.

[0238] Hereinafter, the functions performed in each module within the data management platform (10000) are described as being performed by the data management platform (10000).

[0240] FIG. 20 is a diagram illustrating an embodiment of generating user behavior metadata in the data management platform of the present invention.

[0241] In one embodiment, the data management platform (10000) can collect keys and text corresponding to user actions through the AI ​​engine described above, and classify the collected text into user actions based on artificial intelligence. Accordingly, the data management platform (10000) can generate user action metadata (1038) for the keys and text corresponding to the collected user actions.

[0242] More specifically, the data management platform (10000) can map a key by application development environment type and a user behavior key to generate user behavior metadata (1038). That is, the user behavior metadata (1038) can have a key by application development environment type, a user behavior key, and a user behavior as fields.

[0243] Here, the application development environment type may include the aforementioned architecture type and screen user interface type. That is, the application development environment type represents an information field that can be used for user business actions within the application development environment. For example, it may include menu icons, OK icons, cancel icons, etc. present on the screen. Additionally, the user action key represents an ID for identifying the aforementioned user actions. Accordingly, the data management platform (10000) can map the key for each application development environment type and the user action key within the user action metadata (1038).

[0244] For example, if the key for the application development environment type is the “del key in the first application,” the data management platform (10000) can generate user behavior metadata (1038) by mapping it to the user behavior key “D” through the AI ​​engine and analysis module described above. At this time, the data management platform (10000) can store together in the user behavior metadata (1038) that the user behavior of the “del key in the first application”, which is the key for the application development environment type, and the user behavior key “D” is “delete.”

[0246] FIG. 21 is a diagram illustrating an embodiment of mapping user behavior metadata and log data in the data management platform of the present invention.

[0247] In one embodiment, the data management platform (10000) can map the stored user behavior metadata (1038) and the log data included in the audit log (1033).

[0248] More specifically, the data management platform (10000) can index the log data to map the log data and the user behavior metadata (1038). Specifically, the data management platform (10000) can map the key field for each application development environment type within the user behavior metadata (1038) to the user behavior key field through the above-described embodiment. Additionally, in one embodiment, the data management platform (10000) can store the user behavior of the user behavior metadata (1038) in the user behavior field of the index.

[0249] Accordingly, if the first log data stored in the audit log (1033) represents a log in which a user presses the del key on the first application screen, the data management platform (10000) can immediately provide the mapped user action, “delete,” when it receives a request to query the first log data.

[0250] Mapping user behavior to an index in this way has the advantage of facilitating security analysis or monitoring, as log data can be classified based on user behavior.

[0252] FIG. 22 is a diagram illustrating an embodiment of encrypting personal information in the data management platform of the present invention.

[0253] Personal information encryption keys must be changed periodically to comply with legal standards. When a key is changed, the existing key must be decrypted and re-encrypted with the new key. In other words, changing a key consumes a significant amount of time to decrypt and re-encrypt tens of millions to hundreds of millions of records. Consequently, despite the need to comply with legal standards, many companies often fail to change their encryption keys.

[0254] The present invention proposes a method for separately storing a token (alternative value) for an encrypted value and a key ID for the encrypted value. Through this, encryption can be performed in real time using a newly generated key value, and the function of decrypting and re-encrypting with the new key value can be provided without affecting the operating server.

[0255] In addition to the points mentioned above, it is necessary to process encrypted data according to the requirements of the application server. In this case, if the database's encryption method is used, the original text can be leaked through various means because it is decrypted and transmitted upon loading. Therefore, encrypted data must be processed within server memory and decrypted only when necessary.

[0256] The data management platform of the present invention has the advantage of preventing the leakage of the original text because data decryption and re-encryption occur internally even if the encryption key is changed.

[0257] The present invention will be described in detail below.

[0258] In one embodiment of the present invention, the data management platform (10000) can generate an encryption key and a key ID through a key management module (20003), encrypt personal information using the generated encryption key, and generate a token value corresponding to the encrypted personal information.

[0259] To this end, the key management module (20003) of the data management platform (10000) may include an encryption key and key ID generation unit (2015), a personal information encryption unit (2016), a token value generation unit (2017), and a mapping information storage unit (2018). Here, the key management module (20003) may use Java and RFC and may be responsible for the encryption and decryption of personal information.

[0260] Here, the encryption key and key ID generation unit (2015) can generate and manage encryption keys and key IDs for personal information encryption. In one embodiment, the encryption key and key ID generation unit (2015) can generate new encryption keys and key IDs based on user control. At this time, the encryption key may be changed by issuing a new key ID.

[0261] For example, the user may select a batch encryption key change function provided by the data management platform (10000), and accordingly, the encryption key and key ID generation unit (2015) may generate the encryption key and key ID as new values. Additionally, in another embodiment, the encryption key and key ID generation unit (2015) may update the encryption key and key ID based on a preset cycle even without user control.

[0262] The personal information encryption unit (2016) can encrypt personal information using an encryption key. The personal information encryption unit (2016) can encrypt personal information using the most recent encryption key stored in the data management platform (10000).

[0263] The token value generation unit (2017) can generate a token value (alternative value) corresponding to the encrypted personal information.

[0264] The information storage unit (2018) can store the generated token value, the ciphertext corresponding to the encrypted personal information, and the key ID in the mapping information table (1039). Additionally, the information storage unit (2018) can separately store the token value in the business table (1040).

[0265] That is, even if the encryption key is changed through the encryption key and key ID generation unit (2015), the value stored in the business table (1040) does not change, so the encryption key can be changed without interrupting system operation.

[0267] FIG. 23 is a diagram illustrating an embodiment of encrypting personal information in the data management platform of the present invention.

[0268] In one embodiment, the data management platform may collect personal information. The data management platform may extract personal information from data analyzed from collected packets or from data received directly. Additionally, the data management platform may receive the personal information itself (e.g., Resident Registration Number “730101-1******”).

[0269] In one embodiment, the data management platform can encrypt personal information using an encryption key and a key ID generated through the encryption key and key ID generation unit described above.

[0270] To explain using the present drawing as an example, the data management platform can encrypt personal information using the generated first encryption key and key ID “KEY001”. Here, the encryption key can be generated in a binary form. For example, the first encryption key can correspond to “01001010 00110001 00110001 00110011 00111000 00110000 00110001 01011010 00111101 00111101”. To explain using the example described above, the personal information, such as the resident registration number “730101-1******”, can be encrypted by the generated encryption key.

[0271] In one embodiment, encryption may be performed by encrypting the entire personal information or by encrypting a part of it. In particular, the present invention is characterized by encrypting a part of the personal information. In this case, the key ID is mapped to an encryption algorithm. In one embodiment, available encryption algorithms may include SEED, ARIA128, ARIS192, ARIA256, AES128, AES192, DES, and TDES as bidirectional algorithms, and SHA-256 as a unidirectional algorithm. In this case, the encryption algorithm may be determined based on the key ID.

[0272] After personal information is encrypted, the data management platform can generate a token value corresponding to the encrypted personal information. In the example of this drawing, the token value corresponds to “abcxxf”. At this time, the token value can maintain the number of digits and format of the encrypted personal information. For example, if the last 6 digits of the personal information, such as the Resident Registration Number “730101-1******”, are partially encrypted, the token value replacing them can correspond to “abcxxf”, which has the same number of digits and format.

[0273] In one embodiment, the data management platform may store the generated token value, the ciphertext corresponding to the encrypted personal information, and the key ID in a mapping information table, and store the token value in a business table. The mapping information table and the business table will be described later.

[0275] FIG. 24 is a diagram illustrating the mapping information table and the work table of the present invention.

[0276] This drawing illustrates a mapping information table (1039) and a task table (1040). In this drawing, the mapping information table (1039) and the task table (1040) represent only the fields related to the present invention, but it is understood that they may include additional fields.

[0277] In one embodiment, the mapping information table (1039) may include a token value, a ciphertext, and a key ID. The token value, the ciphertext, and the key ID each consist of a field, and the mapping information table (1039) may include a mapping value corresponding to each field. To explain the above-described embodiment as an example, if personal information can be encrypted using the key ID “KEY001”, the ciphertext corresponding to the encrypted personal information is “HJ113801Z==”, and the corresponding token value is “abcxxf”, the mapping information table (1039) may store the token value, the ciphertext, and the key ID by mapping them to the same row.

[0278] In one embodiment, the task table (1040) may include a token value. Here, since the task table (1040) cannot directly store the ciphertext or key ID because the field length is fixed, the data management platform may separately store the ciphertext and key ID mapped to the token in the mapping information table (1039).

[0279] At this time, in order for an authorized user to verify personal information, they may use the encrypted version included in the mapping information table (1039). To explain the example described above, when an authorized user requests the decryption of personal information from the data management platform, the data management platform can extract the encrypted version “HJ113801Z==” in the mapping information table (1039) using the token value “abcxxf” included in the business table (1040), and decrypt the personal information using the encrypted version. In particular, the present invention is characterized by having a storage unit where the mapping information table (1039) and the business table (1040) are stored, and a storage unit where the encryption key and key ID are stored, separately. Furthermore, the data management platform of the present invention may separately provide a system where the mapping information table (1039) and the business table (1040) are stored, and a system where the encryption key and key ID are stored. Through this, legal security requirements can be satisfied.

[0280] According to the above-described embodiment, the data management platform can store a token value in the business table (1040). Here, the data management platform can maintain the token value in an unchanged state even if the key ID or personal information encryption value is changed.

[0281] Through this, the encryption key and key ID can be changed to new ones while the token value remains unchanged.

[0283] FIG. 25 is a diagram illustrating an embodiment of generating a new encryption key in the data management platform of the present invention.

[0284] In one embodiment, the encryption key and key ID generation unit (2015) can generate a new encryption key and key ID. For example, the encryption key and key ID generation unit (2015) can generate a second encryption key and key ID “KEY002”. Here, the second encryption key can be represented in binary, as in the embodiment described above.

[0285] Accordingly, the data management platform can update the ciphertext and key ID included in the existing mapping information table (1039) with the new ciphertext and key ID.

[0286] More specifically, the data management platform can determine an encryption algorithm based on a newly generated key ID and change the encrypted value of personal information using a new encryption key. To this end, the data management platform can decrypt the personal information using the existing ciphertext and key ID, and then re-encrypt the personal information using the newly generated encryption key and key ID.

[0287] Accordingly, the token value included in the mapping information table (1039) is maintained, but the personal information encryption value and key ID are changed to newly generated values. At this time, the token value included in the business table (1040) remains unchanged.

[0289] FIG. 26 is a diagram illustrating an embodiment of adding new business data in the data management platform of the present invention.

[0290] This drawing describes an embodiment in which new personal information is added to a data management platform. When the data management platform collects or receives new business data (e.g., personal information), it can encrypt the new personal information using the most recent encryption key and key ID.

[0291] For example, if new personal information, such as account number “114-910224-12345”, is received, the data management platform can encrypt the personal information using the second encryption key, which is the most recent encryption key, and key ID “KEY002”. Subsequently, the data management platform can generate a token value corresponding to the personal information. For example, the token value corresponds to “hijklm”.

[0292] The data management platform can store the token value, ciphertext, and key ID in the mapping information table (1039) and store the token value in the business table (1040).

[0293] The mapping information table (1039), which reflects the most recent encryption key and key ID before new personal information is added, stores the token value “abcxxf”, ciphertext “29AB3801Z==” and key ID “KEY002” in the first row. When new personal information is added, the mapping information table (1039) may additionally include the token value “hijklm”, ciphertext “AQ348701Z==” and key ID “KEY002” in the second row.

[0294] Likewise, the work table (1040) stores “abcxxf” in the first row before new personal information is added, and when new personal information is added, it can store “hijklm” in the second row.

[0295] That is, the data management platform of the present invention can update the information included in the mapping information table (1039) based on the most recent encryption key and key ID, and since decryption and re-encryption of personal information is performed by changing only the key ID, tens of millions of records of data can be changed in real time.

[0297] FIG. 27 is a diagram illustrating an embodiment in which the data management platform of the present invention normalizes log data.

[0298] Some users may find it difficult to input regular expressions to extract necessary information from log data. This invention aims to solve this problem through the normalization of log data. By doing so, user convenience can be increased by easily generating a parser that includes a regular expression for extracting a meaningful portion of data from the log data.

[0299] The data management platform (10000) of the present invention can normalize log data through a collection module (20001), an analysis module (20002), and a monitoring module (20005), and can search for log data according to an event log search request from a user / client (1000).

[0300] Specifically, the collection module (20001) may include a log collection unit (2040). The log collection unit (2040) can acquire at least one log data transmitted from the outside.

[0301] The analysis module (20002) may include a parser generation unit (2043), a transformation rule generation unit (2044), and a collection rule generation unit (2045). The parser generation unit (2043) can extract matching blocks for regular expression patterns that are used more than a certain frequency in the selected text. Here, the regular expression patterns may include regular expression patterns that are used more than a certain frequency, such as dates, times, and strings. Additionally, the matching blocks may represent text information that matches the regular expression patterns.

[0302] The parser generation unit (2043) can generate a parser including a regular expression for extracting text from log data based on a matching block selected by user input among a plurality of extracted matching blocks. In one embodiment, the parser may include a field name based on user input.

[0303] In one embodiment, the parser generation unit (2043) can verify the regular expression by testing the regular expression in the log data. That is, the parser generation unit (2043) can use the regular expression to test whether the field value corresponding to each field is properly extracted from the log data.

[0304] The transformation rule generation unit (2044) can generate a transformation rule that includes a parser based on a regular expression and an event type corresponding to the parser. The transformation rule generation unit (2044) can scan for a parser based on a regular expression among the previously generated parsers that matches the log data based on user input. The transformation rule generation unit (2044) can apply the parser based on user input among the parsers available for the log data to the transformation rule and save it. That is, the transformation rule can represent a rule on how to process and save the extracted field when saving log data.

[0305] Accordingly, according to the present invention, convenience can be provided to users who have difficulty inputting regular expressions by partially assisting with the input of regular expressions, thereby enabling them to complete the entire regular expression. In addition, according to the present invention, convenience can be provided for scanning pre-generated parsers to increase the reusability of registered parsers.

[0306] The collection rule generation unit (2045) can generate a collection path rule by selecting a conversion rule to be used for the log data of the log collection device.

[0307] The monitoring module (20005) may include a search request processing unit (2041), a user input processing unit (2042), and an event log search unit (2046).

[0308] The search request processing unit (2041) can receive an event search request for an event type from a user / client (1000). Subsequently, the search request processing unit (2041) can transmit a search result extracted from at least one previously stored log data to the user / client (1000). In this case, the transmitted search result can be displayed on the screen of the user / client (1000).

[0309] The user input processing unit (2042) can obtain information based on user input from the user / client (1000). That is, the user input processing unit (2042) can obtain information selected by user input through the user / client (1000).

[0310] In one embodiment, information based on user input may include at least one of log data for generating and testing regular expressions, text included in the log data, a match block selected from a plurality of match blocks representing text information, a field for the text, an event type for the parser, registration information of the log collection device, and a collection path rule.

[0311] The event log search unit (2046) can output a search result extracted from at least one pre-stored log data based on at least one of a parser, a collection path rule, and a transformation rule in response to receiving an event search request for an event type.

[0313] FIG. 28 is a diagram illustrating an embodiment of the data management method of the present invention that generates a parser.

[0314] In step (S18010), the data management method can obtain log data. In one embodiment, the data management method can obtain log data entered by the user through the user / client (1000).

[0315] In step (S18020), the data management method can obtain text included in log data based on user input. That is, the data management method can obtain text selected by the user from the original log data to be converted into a regular expression. In one embodiment, the regular expression may be referred to as a 'regular expression' or a term having an equivalent technical meaning.

[0316] In step (S18030), the data management method may generate a matching block representing text information for text. For example, the text information may represent various text information, such as one number, one or more numbers excluding spaces, one character, one or more characters excluding spaces, and all characters between double quotes.

[0317] In step (S18040), the data management method can generate a regular expression for extracting text from log data based on a matching block. In one embodiment, a regular expression is generated for each text included in the log data, and a whole regular expression including each regular expression can be generated.

[0318] In step (S18050), the data management method can obtain a field for text based on user input. That is, the data management method can obtain field name information for setting the field name for the text.

[0319] In step (S18060), the data management method can generate a parser including a regular expression and a field.

[0321] FIG. 29 is a drawing illustrating an embodiment of the parser generation screen of the present invention.

[0322] In one embodiment, a parser generation screen may be displayed by a user / client (1000). The parser generation screen may include log data (1042), text (1043), a matching block (1044), a regular expression (1045), and a field (1046).

[0323] Log data (1042) is entered by the user, and text (1043) included in the log data (1042) can be selected and entered. For example, the text can be composed of a string and can represent 16.

[0324] When input log data (1042) and text (1043) are transmitted to the data management platform (10000), a number of matching blocks corresponding to the text (1043) generated by the data management platform (10000) can be displayed on the parser generation screen of the user / client (1000).

[0325] In this case, each of the multiple matching blocks can be distinguished by color, and each matching block can represent different text information. Subsequently, when one matching block (1044) representing text information of text (1043) among the multiple matching blocks is selected by user input, a regular expression (1045) corresponding to the selected matching block (1044) can be automatically generated. For example, the regular expression (1045) is (? <replacegroupname>It can be expressed as / d+).

[0326] Additionally, a field (1046) corresponding to the text (1043) is entered by the user, and a parser containing the entire regular expression and the field can be generated.

[0328] FIG. 30 is a diagram illustrating an embodiment of the data management method of the present invention that generates conversion rules.

[0329] In step (S19010), the data management method can obtain log data. In one embodiment, the data management method can obtain log data entered by the user through the user / client (1000).

[0330] In step (S19020), the data management method can determine a parser corresponding to the log data. That is, a parser corresponding to the log data can be determined through scanning the log data input by the user, and the parser name, version, and parser type for the parser can be determined. In this case, as described above, if it is a parser based on a regular expression, the parser type may represent a regular expression.

[0331] In step (S19030), the data management method can determine the event type for the parser based on user input. For example, the event type may include, but is not limited to, personal information search logs and firewall logs, and may consist of various types.

[0332] In step (S19040), the data management method may determine at least one field corresponding to a parser and an event type. In one embodiment, the data management method may perform batch registration of fields of each parser of the transformation rule. For example, during batch registration, a field, field name, field type (number or string), and data type may be determined.

[0333] In step (S19050), the data management method may generate a transformation rule including a parser, an event type, and at least one field. That is, according to the present invention, the data management method may determine whether to store which field values ​​are to be stored and which are not to be stored among the field values ​​actually extracted through the transformation rule. In other words, the data management method may extract field values ​​from log data using a parser including a regular expression, and determine which of the extracted field values ​​to store and how to store them through the transformation rule.

[0335] FIG. 31 is a diagram illustrating an embodiment of the data management method of the present invention that generates collection path rules.

[0336] In step (S11110), the data management method may register a log collection device for collecting log data. In one embodiment, when registering the log collection device, the device name, device IP, device type, OS (operating system), and collection type for the log collection device may be set through the user / client (1000) by user input.

[0337] In step (S11120), the data management method can generate a collection path rule by selecting a transformation rule to be used for the log data of the log collection device based on user input. In one embodiment, the collection path rule may include at least one of a collection path, a collection type, and an equipment name.

[0338] In one embodiment, the collection type may include an agent method and a system log method. Here, the agent method includes a method of installing an agent program on systems and equipment to transmit necessary log data, and the system log method may include a method of collecting logs from various security devices and network equipment such as switches, routers, and firewalls.

[0339] In step (S11130), the data management method can apply a transformation rule to the collection path rule.

[0341] FIG. 32 is a diagram illustrating an embodiment of the data management method of the present invention for searching event logs.

[0342] In step (S12110), the data management method may receive an event log search request for an event type from a user / client (1000). In one embodiment, an event log search request for an event type selected by the user among a plurality of event types may be received.

[0343] In step (S12120), the data management method may output a search result extracted from at least one pre-stored log data based on a collection path rule, a transformation rule, and a parser in response to an event log search request. In one embodiment, the at least one log data may correspond to an event type and may include log data collected over a certain period and pre-stored.

[0344] In other words, according to the present invention, by parsing and distinguishing information (i.e., field values) embedded in log data using a regular expression, the user can more easily identify the information embedded in the distinguished log data when analyzing the log data.

[0345] In step (S12130), the data management method may transmit search results to the user / client (1000). In this case, the search results may include field values ​​parsed from log data, and in response to an event log search request by the user, the field values ​​parsed by the parser may be displayed in the form of a dashboard on the screen of the user / client (1000).

[0347] FIG. 33 is a diagram illustrating an embodiment of searching for logs in the data management platform of the present invention.

[0348] For large-scale log searches, technology is required to retrieve sorted and filtered results in real time without loading the entire search result into memory. Additionally, it must be possible to check portions of the results in real time even during the search.

[0349] The data management platform of the present invention enables efficient processing of large amounts of data and allows only necessary results to be retrieved in real time.

[0350] The monitoring module (20005) of the data management platform (10000) of the present invention may further include a coordinator control unit (2047) to support log search.

[0351] Here, the coordinator control unit (2047) can control the coordinator (2048) of the server (1002) based on the log search request of the user (1000).

[0352] Here, the coordinator (2048) can manage a list of available instances (2049a, 2049b, 2049c) among multiple instances (2049a, 2049b, 2049c) in the distributed system and distribute search requests.

[0353] Additionally, instances (instance, 2049a, 2049b, 2049c) are independent units that run in a computing environment and can operate by being allocated resources such as processors, memory, and disks through hardware or virtualization technology. Instances (2049a, 2049b, 2049c) can run through a specific operating system and application, and can generally be implemented in the form of a server, virtual machine, container, etc.

[0354] The present invention will be explained in detail below.

[0356] FIG. 34 is a diagram illustrating an example of the external merge sort algorithm of the present invention.

[0357] The External Merge Sort algorithm is used for sorting large amounts of data and operates efficiently, particularly when sorting data that exceeds memory capacity. The External Merge Sort algorithm can sort data by primarily utilizing secondary memory, such as disks or external storage devices.

[0358] In step (S16110), an index file can be created to store offset information of the data based on the value of the sort field. Here, the value of the sort field may represent an item included in the data. For example, the item included in the data may include a username, email address, time, etc. Accordingly, the external merge sort algorithm can sort the data based on the item included in the data. Additionally, the offset information may include the reference value of the sort field, a location within the data file (e.g., the location of the first log within the data file), and length information (e.g., length information of the first log within the data file). Additionally, the index file is characterized by having an already sorted data order in an offset list in units of a specific number (e.g., 1000 items).

[0359] In step (S16120), if the number of data included in the sort result file for the merge sort is greater than or equal to the first number, the sort result file for the merge sort can be combined to generate.

[0360] More specifically, when creating an index file, if the number of files included in the index file is greater than or equal to the first number, a new index file can be created. For example, if the number of files included in the first sorting result file is greater than or equal to the n-th number, a second sorting result file can be created.

[0361] In step (S16130), if the search is finished or the number of files included in the merge sort file is n or more, the newly created second sort result file can be merged to create a new third sort result file.

[0362] In other words, utilizing the external merge sort algorithm has the advantage of optimizing overall performance because it performs sorting operations by repeatedly splitting and merging data.

[0364] FIG. 35 is a diagram illustrating an embodiment of analyzing data in the data management platform of the present invention.

[0365] Systems that analyze log data require a User Interface (UI) for users to process stored data. However, from the perspective of users seeking various analyses, the UI provided by the developer has limitations. In other words, a user interface is required to perform more complex data analysis or searches, or to manipulate data and derive meaningful results by inputting query commands in the form of scripts. To this end, the present invention aims to provide a function that allows data manipulation using scripts within the UI without the need for UI development programming.

[0366] The present invention enables a user to perform various data analysis and data manipulation using scripts through an analysis task editor (2056).

[0367] To this end, the analysis module (20002) of the data management platform (10000) of the present invention may include an analysis task execution unit (2054) and an analysis task management unit (2055).

[0368] Here, the analysis task execution unit (2054) may include an analysis engine that executes information entered into the analysis task editor (2056). In one embodiment, the analysis task execution unit (2054) may execute an analysis task based on a command to execute a first analysis task entered by a user through the analysis task editor (2056). Specifically, when a user executes a code cell within the analysis task editor (2056), a Lua script is transmitted to the analysis engine within the analysis task execution unit (2054), and the analysis engine may interpret and execute the Lua script and return a result. To this end, the analysis task execution unit (2054) may utilize log data and statistical data from the database (20007).

[0369] The analysis task editor (2056) may include at least one cell as an editor executable through an application, software, or web browser, etc. Herein, the cell includes a Markdown cell for adding descriptive data for an execution script and a code cell for adding Lua script information for analysis.

[0370] The analysis task management unit (2055) can register the written Lua script. More specifically, the user can add a Lua script through the analysis task editor (2056) and register the added Lua script to the analysis task management unit (2055). The registered Lua script can be executed periodically by the analysis task scheduler included in the analysis task management unit (2055).

[0371] Afterwards, the monitoring module (20005) can output the results of the analysis work managed through the analysis work management unit (2055) being executed periodically.

[0372] Through this, users can analyze the desired data without using the user interface provided by the developer.

[0374] FIG. 36 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention.

[0375] The analysis task editor (2056) of the present invention may include a Markdown cell (2057) and a Code cell (2058). The analysis task editor (2056) may correspond to a unit that stores multiple scripts and text blocks.

[0376] Here, the Markdown cell (2057) corresponds to a description block, and the code cell (2058) corresponds to a script block.

[0377] In one embodiment, the user may enter text into at least one of the markdown cell (2057) and the code cell (2058). For example, the user may write a description of the code cell (2058) in the markdown cell (2057). Additionally, the user may enter code to be executed in the code cell (2058). Accordingly, the analysis task editor (2056) may execute the code contained in the code cell (2058).

[0378] In one embodiment, when the user presses the "button (2059)" provided by the analysis task editor (2056), the analysis task editor (2056) may additionally output a Markdown cell add button and a code cell add button (2060a, 2060b). In one embodiment, the analysis task editor (2056) may output a + button (2059) both above and below the Markdown cell (2057), and accordingly, the user may determine the location of the Markdown cell (2057) or code cell (2058) to be added.

[0379] Accordingly, the user can add multiple Markdown cells (2057) and likewise request multiple code cells (2058) from the analysis task editor (2056).

[0381] FIG. 37 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention.

[0382] In one embodiment, as the user requests the execution of the output code cell (2058), the analysis task editor can execute the analysis task included in the code cell (2058) through the analysis task execution unit.

[0383] For example, the user can input "view statistical data and visualize it as a line chart" into the first markdown cell (2057) and input a Lua script corresponding to this description block into the first code cell (2058).

[0384] Afterwards, as the user requests the execution of the output first code cell (2058), the analysis task editor can visualize the first line chart (2061) as shown in the drawing.

[0385] As another example, the user can enter "query a resource usage table from an external database and visualize it as a line chart" in the second Markdown cell, and enter a Lua script corresponding to this description block in the second code cell.

[0386] Subsequently, as the user requests the execution of the output second code cell, the analysis task editor can visualize the second line chart as a drawing.

[0388] FIG. 38 is a diagram illustrating the user interface of an analysis task editor provided by the data management platform of the present invention.

[0389] Afterwards, referring to FIG. 95 (a), the user can save a first analysis task containing a first markdown cell, a first code cell, a second markdown cell, and a second code cell. At this time, the user can set a name for the first analysis task for identification purposes.

[0390] Additionally, referring to FIG. 95(b), the stored first analysis task can be retrieved by the same user or a different user. The first analysis task can be executed by running the analysis task editor on the first analysis task retrieved by the user. To this end, the data management platform of the present invention may provide at least one previously stored analysis task list (2062).

[0392] FIG. 39 is a diagram illustrating an embodiment in which the data management platform of the present invention stores and retrieves log data.

[0393] In one embodiment, the data management platform (10000) can compress log data through a collection module (20001), an analysis module (20002), and a monitoring module (20005) and store it in at least one of a database (20007) and an archive storage (20009), and can retrieve log data in response to a log inquiry request from a user / client (1000).

[0394] Specifically, the collection module (20001) may include a data collection unit (2035). The data collection unit (2035) may collect the log data when new log data is input. In one embodiment, the data collection unit (2035) may transmit the collected log data to the analysis module (20002) when the log data has been input and accumulated for a certain period. The analysis module (20002) may include a compression processing unit (2036) and an archiving execution unit (2037). That is, the analysis module (20002) may analyze the log data received from the collection module (20001).

[0395] More specifically, the compression processing unit (2036) can store input multiple log data in segments of a predefined period unit (e.g., a day unit). Additionally, the compression processing unit (2036) can store the stored segments in chunks of a predefined first size. That is, according to the present invention, by storing a file containing multiple log data in chunks into multiple files, log data can be compressed in the shortest possible time (Near Real-time), and the reason for not compressing log data on a per-item basis may be that compression efficiency is significantly reduced when compressed on a per-item basis.

[0396] Additionally, the compression processing unit (2036) can compress the stored chunk into blocks of a predefined second size. That is, according to the present invention, by dividing the chunk into blocks and performing compression, the query performance can be improved when decompressing to retrieve actual log data without reducing compression efficiency. In this case, the block size may be smaller than the chunk size.

[0397] In one embodiment, a segment containing a compressed block may be stored in a database (20007). In this case, the database (20007) may include a storage for storing segments that can be queried online.

[0398] The archiving execution unit (2037) can determine the segments to be archived among the segments stored in the database (20007) to be stored in the archive repository (20009). The details regarding the determination of the segments to be archived will be explained in detail below. Subsequently, the archiving execution unit (2037) can transfer and store the segments to be archived in the archive repository (20009).

[0399] The monitoring module (20005) may include a decompression unit (2038) and a log inquiry unit (2039). The decompression unit (2038) may decompress only the block containing at least one log data requested by a user / client (1000) among the total compressed log data included in at least one of the segments stored in the database (20007) and the archiving target segments stored in the archive storage (20009). The details of decompressing the said block will be explained in detail below.

[0400] The log inquiry unit (2039) can receive a log inquiry request for log data from a user / client (1000), and among multiple log data, can send uncompressed log data to the user / client (1000) through the monitoring module (20005) below according to the log inquiry request.

[0402] FIG. 40 is a diagram illustrating another embodiment in which the data management platform of the present invention stores and retrieves log data.

[0403] In one embodiment, the compression processing unit (2036) stores a plurality of newly input log data into segments of a predefined period unit, and when storing the new log data, checks whether segment access information of the segment exists, and if not, can generate segment access information of the segment. Here, the segment access information may include metadata for the segment. For example, the segment access information may include at least one of information indicating whether the segment is storable, information indicating whether the segment is archived, and location information where the segment is archived within the archive storage (20009).

[0404] The compression processing unit (2036) can store the segments in chunks of a predefined first size. In one embodiment, the compression processing unit (2036) can generate an index for each chunk based on a stored offset. This may be to indicate where each chunk is located within the compressed file, since the chunks are created in a compressed file format.

[0405] The compression processing unit (2036) can compress the stored chunks in units of a predefined second size block at a time when there is no change in the log data, and generate block offset information and compression information.

[0406] Here, the compressed block may include compressed data, which is a file in which chunks are compressed in block units. Additionally, the block offset information may include position information within the chunk of the block compressed in block units and compressed length information. Furthermore, the compression information may include the size of the compressed block and the size information of the original file before compression.

[0407] The archiving execution unit (2037) can distinguish archive target segments when performing archiving, transfer and store the distinguished archive target segments in the archive repository (20009), and generate access information for the archive target segments in the archive repository (20009).

[0408] The decompression unit (2038), upon receiving a log inquiry request for at least one log data among a plurality of log data from a user / client (1000), uses at least one of segment access information, block offset information, and compression information among at least one of a segment and an archive target segment to decompress only the block where the requested at least one log data is located among the entire compressed log data, thereby enabling the user / client (1000) to query at least one log data.

[0409] To store log data stored in a general database for a long period, archiving may be performed in a separate location (e.g., archive storage (20009)). At this time, an export process for the log data is required, and an import process for the database is required to retrieve the archived log data. During these export and import processes, a significant amount of time may be consumed for compression and decompression. Accordingly, according to the present invention, the export / import process can be significantly shortened by utilizing compression information and block offset information to enable retrieval of the entire log data without decompression.

[0411] FIG. 41 is a conceptual diagram disclosing layer-by-layer elements of a data management device according to an embodiment.

[0412] When collecting network packets, it is common practice in typical intranetwork environments to copy network traffic via network mirroring and transmit it to monitoring equipment. However, in cloud environments where packet collection equipment (such as network taps or switches) cannot be installed, there are difficulties in collecting packets through network mirroring.

[0413] In other words, due to the nature of cloud environments, network topologies are physically separated and virtualized network infrastructure is used, making it difficult to use traditional network mirroring methods. This results in increased packet loss rates or difficulties in accurately monitoring network traffic.

[0414] To solve this problem, the present invention utilizes the Netfilter mechanism of the Linux kernel layer.

[0415] The agent installation server may include an OS kernel area and an OS user area. Additionally, the kernel area may include a packet filtering unit (1051) and a packet loading unit (1052), and the user area may include a transmission distribution unit (1053), a compression processing unit (1054), and a message transmission unit (1055).

[0416] In one embodiment, the agent installation server is characterized as being a cloud server. Accordingly, packets can be collected by directly installing the agent on a cloud server where the installation of packet collection equipment is impossible. A method for running the agent on a cloud server involves setting connection information and processing options of a data management device and running the agent based on the options. At this time, the agent execution options may include the IP address and receiving port information of the data management device, whether to compress transmission, the number of retransmission attempts, the maximum load quantity of the queue, the maximum number of packets per transmission to the engine, the receiving buffer size of the netfilter queue, the maximum kernel queue length of the netfilter queue, the number of engine transmission queues (number of channels), the log level, the log path, the rolling log size, etc.

[0417] As described in the above-described embodiment, the network management device of the present invention can collect packets through network equipment (1001), such as a Network Interface Card (NIC).

[0418] The packet filtering unit (1051) can distinguish target packets using packet filter rules configured based on IP / Port from packets collected through the network equipment (1001) and transmit them to the packet loading unit. In one embodiment, the packet filtering unit (1051) can transmit or skip network packets based on packet filter rules. At this time, the packet filter rules can be changed according to user definition.

[0419] The packet loading unit (1052) can load the packet received through the packet filtering unit (1051) into a packet queue. Here, the packet queue corresponds to a netfilter queue.

[0420] In one embodiment, the netfilter queue configuration method involves installing a netfilter queue and configuring a netfilter for a target port. Subsequently, the netfilter configuration can be verified using the iptables -list command. Since using a netfilter queue allows packets to be processed in the OS user space, user-defined packets can be processed.

[0421] The transmission distribution unit (1053) can distribute packets to the transmission queue based on IP to transmit packet data loaded in the packet queue to the data management device in parallel.

[0422] The compression processing unit (1054) can bundle multiple packet data loaded in the transmission queue into one large transmission unit, compress it, and then transmit it to the message transmission unit (1055). At this time, compressing the packet data by merging it can increase the compression efficiency.

[0423] In one embodiment, the compression processing unit (1054) may compress the packet using the LZ4 algorithm to increase compression efficiency. At this time, the compression processing unit (1054) may compress the packet using the LZ4 algorithm, and subsequently, the decompression unit (1056) may add a compression status field to the protocol to decompress the packet. Specifically, when transmitting data, the header and body of the protocol may be separated; the header may include the length of the body data, whether it is compressed, and the original length, and the body may be compressed using the LZ4 algorithm and transmitted. At this time, when receiving the data, the body data may be decompressed according to the compression status field, and then verified by comparing it with the original length to decompress it.

[0424] Through this, the compression ratio can be increased to a ratio of 2.101, and benchmarks of compression speed of 780 MB / s and decompression speed of 4970 MB / s can be achieved.

[0425] The message transmission unit (1055) can transmit message information received from the compression processing unit (1054) to the decompression unit (1056) of the data management device using transmission information and TCP communication.

[0426] The decompression unit (1056) can receive compressed data using TCP communication from a cloud server on which at least one agent is installed. The decompression unit (1056) can load packet data into a dispatcher queue based on IP / Port to analyze the received data in TCP stream units after decompression.

[0427] In one embodiment, in order to decompress a packet compressed by the LZ4 algorithm, a compression status field may be added to the protocol between the agent installed on the cloud server of the present invention and the decompression unit (1056) to decompress the packet. This is as described above.

[0428] The packet transmission unit (1057) can transmit packet data loaded in the dispatcher queue to a TCP packet analysis process via a pipe or TCP communication. Here, the TCP packet analysis process corresponds to a process that merges fragmented TCP data and performs analysis processing for each protocol. Refer to the above-described embodiment for the process that performs analysis processing for each protocol.

[0429] This offers the advantage of enabling packet collection even in situations where it is difficult to collect packets via mirroring. Additionally, to enhance the efficiency of packet collection, it is possible to collect only the target packets rather than all packets.

[0431] FIG. 42 is a diagram illustrating an embodiment in which a data management device according to an embodiment monitors an agent.

[0432] In one embodiment, the data management device may include a console (10001, console), a collection module (20001), and a controller (20011).

[0433] The console (10001) can perform the function of a user interface module of a data management device. In one embodiment, the console (10001) may be configured to collect agent status. If the console (10001) is configured to collect agent status, it can collect the agent status through a collection module and a controller and monitor the agent status. At this time, the console (10001) may provide a user interface for monitoring agent status. Here, the user interface for monitoring agent status may include information such as agent IP, agent connection status (on / off), number of receptions, and number of receptions per second.

[0434] When the agent status is configured to be collected through the console (10001), the controller (20011) can process a command to control the collection module (20001) to collect the status of at least one agent. At this time, communication between the controller (20011) and the collection module (20001) can be based on commands. The controller (20011) instructs the collection module (20001) to perform a specific task through a command, and the collection module (20001) can transmit the collected agent status information to the controller (20011) as a command response.

[0435] In one embodiment, the collection module (20001) can process a status inquiry command based on the control of the controller (20011). Accordingly, the collection module (20001) can collect the transmission status per agent. The transmission status per agent may include the agent IP, agent connection status (on / off), total received count, received count per second, etc.

[0436] More specifically, the collection module (20001) can collect the status of the agents (1011, 1012).

[0437] For example, when the first agent (1011) is operating normally, the collection module (20001) can collect the transmission status of the first agent (1011) and transmit it to the controller (20011).

[0438] As another example, if the second agent (1012) is disconnected, the collection module (20001) can update the connection status of the second agent. The collection module (20001) can update the disconnection status of the second agent and transmit it to the controller (20011). For other functions of the collection module (20001), refer to the above-described embodiment.

[0439] The controller (20011) can provide information collected by the collection module (20001) from the agent (1011, 1012) to the client through the console (10001).

[0440] Accordingly, the client can monitor the connection status of the agent installed on the cloud server through the console (10001) of the data management device of the present invention.

[0442] FIG. 43 is a flowchart of a data management method according to an embodiment.

[0443] Packets collected from at least one agent installed on a cloud server can be decompressed (S101).

[0444] In one embodiment, packets collected from at least one agent are loaded into a netfilter queue, then merged into a first unit and compressed. Here, merging into a first unit may mean combining multiple existing loaded packet data into one large transmission unit. That is, the first unit corresponds to a transmission unit larger than the existing loaded packet data.

[0445] In one embodiment, packets collected from at least one agent can be loaded into a netfilter queue and then distributed to a transmission queue, and the packet data distributed to the transmission queue can be merged and compressed into a first unit.

[0446] In addition, the collected packet is compressed by separating the header and body of the packet protocol, the header includes the length of the body data, whether it is compressed, and the original length, and the body may include the merged packet data. For this, refer to the details described in FIG. 41.

[0447] The decompressed packet can be analyzed based on the packet's protocol (S103). For this, refer to the details described in FIGS. 1 to 11.

[0448] In one embodiment, the status of at least one agent can be collected. Additionally, the collected agent status can be provided through a user interface. In this case, the agent status may include at least one of the agent IP, agent connection status (on / off), number of receptions, and number of receptions per second information. For this, refer to the details described in FIG. 42.

[0450] FIG. 44 is a diagram illustrating an embodiment in which a proxy server according to one embodiment is connected to another cloud service.

[0451] Clients can access the SAP system via HTTP, RFC, and SAP GUI protocols.

[0452] The present invention aims to collect and analyze packet data transmitted and received via HTTP, RFC, and SAP GUI protocols by configuring a proxy server (200) between a client and an SAP system.

[0453] More specifically, the client can access a web server corresponding to the SAP system through a user web browser. At this time, a proxy server (200) can be configured between the user web browser and the web server to collect packet data, and then transmit it to an analysis system for log recording. At this time, if the packet data is received via the HTTPS protocol, SSL can be disabled by referring to the above-described embodiment, and then HTTP requests / responses can be extracted and transmitted to the analysis system.

[0454] In particular, the present invention provides a method for the aforementioned proxy server (200) to analyze and extract meaningful packet data not only based on HTTP / HTTPS protocols but also in the case of SAP GUI protocols. That is, the proxy server (200) of the present invention can perform both HTTP proxy and SAP GUI proxy functions within a single proxy server (200).

[0455] In one embodiment, the proxy server (200) may include a proxy client communication unit (210), a proxy data extraction unit (220), a proxy server communication unit (230), and a proxy data transmission unit (240).

[0456] The proxy client communication unit (210) can configure the proxy service with proxy settings, perform processing according to the communication type (e.g., HTTP, GUI, RFC, etc.) between the accessing client and the proxy server (200), and transmit request data to the proxy data extraction unit (220). At this time, the proxy settings may include proxy service port information, OS service file location, transmission queue length, etc.

[0457] In addition, when the protocol is SAP GUI or RFC protocol, the proxy client communication unit (210) can analyze the NI protocol (Network Interface protocol) to extract and transmit a packet of a unit processed by the SAP system. Here, details regarding an embodiment that analyzes and transmits the NI protocol will be described later.

[0458] The proxy data extraction unit (220) can load request / response data received from the proxy client communication unit (210) and the proxy server communication unit (230) into a transmission queue based on packets in the case of SAP GUI and RFC protocols. Additionally, the proxy data extraction unit (220) can load request / response data received from the proxy client communication unit (210) and the proxy server communication unit (230) into a transmission queue by combining them based on requests / responses in the case of HTTP protocols.

[0459] The proxy server communication unit (230) can transmit a client's request to a target system (e.g., an SAP system) within the proxy settings for each proxy service. In one embodiment, the proxy server communication unit (230) can transmit a client request to a service port of the SAP system by identifying the service port in the OS service file using the corresponding string, because the service port for connection within the NI protocol in the case of SAP GUI or RFC protocols is transmitted as a string based on the target SAP system. To this end, the OS service file may include a list of string information referring to port information.

[0460] Additionally, the proxy server communication unit (230) can process requests / responses according to the type of communication between the proxy server and the target system and transmit response data to the proxy data extraction unit (220).

[0461] The proxy data transmission unit (240) can transmit proxy data loaded in the transmission queue to the proxy data reception unit (250) of the data management device by referring to transmission information. Here, the transmission information may include proxy setting information. For example, the proxy setting information may include the IP of the data management device, port information of the proxy data reception unit (250), the number of threads to be used for transmission, the number of proxy data items per transmission, the size of the transmission queue, and the number of retries during transmission.

[0462] In one embodiment, the data management device (100) of the present invention may include a packet data collection and filter unit (110), a TCP packet reassembly unit (120), a proxy data receiving unit (250), a protocol analysis unit (130), an audit log generation and transmission unit (140), an RFC information request unit (150), and a certificate management unit (160).

[0463] At this time, the packet data collection and filter unit (110) can collect packets from the NIC and agent, filter the packets, and transmit them to the TCP packet reassembly unit (120).

[0464] The TCP packet reassembly unit (120) can reassemble fragmented TCP packets and transmit them to the protocol analysis unit (130).

[0465] The proxy data receiving unit (250) can receive data from the proxy server. The proxy data receiving unit (250) can receive and distribute the received data based on the configuration information of the engine server of the data management device (100). For example, the configuration information of the engine server may include the number of analyzers capable of processing the SAP GUI protocol, the number of analyzers capable of processing the SAP RFC protocol, analyzer port information, etc.

[0466] The protocol analysis unit (130) analyzes received data by SAP GUI, RFC, and HTTP protocols, and if the received data is encrypted with SNC / SSL, it can decrypt the data using a certificate. Additionally, if there is no RFC structure information for analyzing data based on the RFC protocol, the protocol analysis unit (130) can generate an RFC information request file. If there is RFC structure information, the protocol analysis unit (130) can analyze data based on the RFC protocol based on the RFC structure information. To this end, the protocol analysis unit (130) may include at least one analyzer.

[0467] The audit log generation and transmission unit (140) can generate an audit log by converting and processing data analyzed by protocol according to defined field rules. The audit log generation and transmission unit (140) can transmit the generated audit log to an analysis system. Here, the analysis system refers to a process of storing the audit log, extracting personal information from the audit log, and performing correlation analysis. At this time, the process of storing the audit log, extracting personal information from the audit log, and performing correlation analysis should be referred to in the above-described embodiment. Here, it goes without saying that the analysis system can be performed through a part module of the data management device (100) rather than a separate system.

[0468] The RFC information request unit (150) can request RFC structure information from the target system when it detects an RFC information request file.

[0469] The certificate management unit (160) can synchronize certificate information so that the operator of the data management device manages the registered certificate and the protocol analysis unit (130) can use it.

[0470] This offers the advantage of collecting logs of users accessing the SAP system via HTTP, RFC, and SAP GUI protocols without the need for separate program installation.

[0471] In addition, there is an advantage that data can be collected and monitored via HTTP, RFC, and SAP GUI protocols using a proxy server (200).

[0473] FIG. 45 is a diagram illustrating the function of a proxy server according to one embodiment.

[0474] In one embodiment, a proxy server (200) having the above-described function may be used when Client A uses a target system. Here, Client A may be exemplified as a user utilizing an SAP system. At this time, Client A may use multiple proxy servers (200) to utilize multiple target systems, rather than using a single target system with a single proxy server (200).

[0475] The proxy server (200) of the present invention may include at least one proxy worker (201) and a proxy watchdog (202) that manages at least one proxy worker (201).

[0476] The proxy worker (201) can act as an intermediary between client A and the target system. The proxy worker (201) can collect data between client A and the target system and transmit the data to the proxy data collection unit (250) of the data management device (100).

[0477] The proxy watchdog (202) receives configuration data of proxy workers (201) from the proxy manager (170) of the console of the data management device (100) and can manage and control the proxy workers (201). In addition, the proxy watchdog (202) can collect and monitor the status and performance metrics of the proxy workers (201). At this time, the proxy manager (170) can manage the configuration of each proxy worker (201) and monitor the status of the proxy workers (201) through the proxy watchdog (202).

[0478] In one embodiment, the proxy data receiving unit (250) of the data management device (100) receives data collected from proxy workers (201), analyzes the data through the protocol analysis unit (130) within the same engine, and transmits it to client B. Here, client B is a user utilizing the data management device (100) and corresponds to a system administrator. At this time, the data can be transmitted to client B through a console via a database manager. Additionally, client B can check the status of the proxy workers (201) through the proxy manager (170) via the console.

[0480] FIG. 46 is a diagram illustrating other functions of a proxy server according to one embodiment.

[0481] In one embodiment, the proxy server (200) having the above-described function may support a bypass mode. Here, the bypass mode may perform only basic proxy functions (e.g., relaying network traffic). Additional functions such as data collection, analysis, and recording are disabled.

[0482] (a) of this drawing describes the automatic bypass mode, and (b) describes the manual bypass mode.

[0483] In automatic forwarding mode, the proxy watchdog (202) can check the status of the proxy worker (201) and notify the proxy manager (170) of the status of the proxy worker (201). Additionally, the proxy watchdog (202) can automatically switch the proxy worker (201) to forwarding mode when a problem occurs in the proxy worker (201) that could threaten the credibility of the system.

[0484] On the other hand, in manual forwarding mode, the proxy worker (201) can be restarted in forwarding mode through the proxy manager (170).

[0485] This ensures system stability and protects the system from potential errors.

[0487] FIG. 47 is a diagram illustrating an embodiment of separating services within a proxy server according to one embodiment.

[0488] In one embodiment, the proxy server (200) having the above-described function can operate the service process within the proxy server (200) by separating it.

[0489] In one embodiment, the proxy server (200) of the present invention may be operated with (a) separation by the proxy itself, (b) separation by service port, and (c) separation by service type.

[0490] More specifically, regarding the separation of the proxy itself, each proxy server (e.g., 200a, 200b, etc.) operates independently, and each proxy server (200a, 200b, etc.) may include an SAP GUI / HTTP proxy. In this case, the SAP GUI / HTTP proxy receives packet data based on the SAP GUI protocol and packet data based on the HTTP protocol, and can collect and analyze them in different ways. This is as described above.

[0491] In addition, in separation by service port, traffic can be separated based on the service port number. For example, the proxy server (200) includes a first SAP GUI / HTTP proxy and a second SAP GUI / HTTP proxy, and can apply different proxy settings or router rules to services using different port numbers.

[0492] Finally, in the separation by service type, traffic can be separated according to the service type (such as SAP GUI or HTTP). For example, the proxy server (200) may include an SAP GUI proxy and an HTTP proxy, respectively.

[0493] Separating processes in this way has the advantage of maintaining overall system availability, as a problem in one process does not affect others, and allows for easy identification and isolation of the problematic process.

[0495] FIG. 48 is a diagram illustrating an embodiment of scaling out a proxy server according to one embodiment.

[0496] You can increase or decrease the size of the proxy server using the platform's extension features.

[0497] In one embodiment, the platform load balancer can distribute network traffic or requests to multiple proxy servers (200a, 200b, 200c) within the system. In this case, the platform load balancer provides a function of distributing packets of traffic received at a specific address to proxy servers to distribute the load per cloud platform.

[0498] For example, the platform load balancer can distribute and deliver incoming data to the first proxy server (200a), the second proxy server (200b), and the third proxy server (200c). Additionally, the platform load balancer can scale out the proxy servers based on the amount of incoming data and the load of the proxy servers (200a, 200b, 200c) using services provided per platform.

[0499] At this time, the proxy manager (170) can manage the proxy watchdog (202a) of the first proxy server (200a), the proxy watchdog (202b) of the second proxy server (200b), and the proxy watchdog (202c) of the third proxy server (200c).

[0500] Through this, it is possible to manage proxy servers (200a, 200b, 200c) that flexibly respond to system loads and scale out.

[0502] FIG. 49 is a diagram illustrating an embodiment in which a proxy server processes the NI protocol according to one embodiment.

[0503] This diagram illustrates the NI protocol processing and client request / transmission / reception processes of the aforementioned proxy server.

[0504] The proxy server can collect service-specific port information based on OS service port information and proxy configuration information. The proxy server can utilize this service-specific port information to process NI protocols and send and receive client requests.

[0505] More specifically, the proxy server can process the NI protocol to send and receive client requests when the protocol the client connects to is SAP GUI or RFC protocol.

[0506] When an SAP GUI / RFC client transmits and receives data to and from an SAP system, the proxy server can identify and transmit the target SAP system by analyzing the client's request within the NI protocol, including the IP address and port information of the system to which the request needs to be forwarded.

[0507] At this time, port information for each OS service is transmitted as a string configured in the client's OS service file, and the proxy server can identify and transmit port information of the target system, the SAP system, by mapping the OS service-specific port information loaded within the proxy server to the string information.

[0508] In addition, when the proxy server sends an NI PING to the SAP GUI / RFC client, it can return an NI PONG to indicate that the network connection is operating normally.

[0509] In addition, the proxy data extraction unit can extract NI protocol request / response data transmitted and received via SAP GUI or RFC protocols and load it into a transmission queue with a threshold set based on the data size. At this time, since data from the same session must be processed within the same process, the proxy data extraction unit can load the data into the transmission queue based on the client IP and port information connected to the proxy server.

[0511] FIG. 50 is a diagram illustrating a proxy data collection process of a data management device according to one embodiment.

[0512] The data management device of the present invention may initiate a process for collecting proxy data. At this time, the proxy data receiving unit (250) and the protocol analysis unit (130), etc., may be implemented so that the proxy data collection process is executed and parameters are transmitted by a controller within the data management device.

[0513] In one embodiment, to execute a proxy data collection process, the controller may execute the proxy data collection process based on the configuration information of the server of the data management device. When the proxy data collection process starts, the proxy server may collect data generated by the client in relation to the target system. In particular, since the data transmitted from the proxy server does not need to undergo a TCP reassembly process, it can be transmitted directly to the protocol analysis unit (130) via socket communication. For this, refer to the above-described embodiment.

[0514] In one embodiment, the proxy data transmission unit (240) can transmit proxy data loaded in the transmission queue to the proxy data reception unit (250) by referring to proxy setting information. In one embodiment, the proxy data transmission unit (240) can retransmit N times if the transmission of proxy data fails. For a detailed description of the proxy data transmission unit (240), refer to the above-described embodiment.

[0515] The proxy data receiving unit (250) can load the data received from the proxy data transmitting unit (240) into an analysis queue. The proxy data receiving unit (250) can transmit the data loaded into the analysis queue to the protocol analysis unit (130).

[0516] More specifically, the proxy data receiving unit (250) can distribute NI protocol data for each TCP stream according to the amount of analysis queues by adding the values ​​of IP and port replaced with numbers and performing a modulo operation. Subsequently, the NI protocol data distributed to the analysis queues can be transmitted to the protocol analysis unit (130). For example, if the value of IP replaced with a number is 15, the value of port replaced with a number is 13, and the amount of analysis queues is 4, the proxy data receiving unit (250) can distribute the NI protocol data for the corresponding TCP stream to the protocol analysis unit (130) by performing a modulo operation of 4 on the sum of 15 and 13, which is 28.

[0517] The protocol analysis unit (130) can distribute the IP / Port according to the number of processes by adding the IP / Port and performing a remainder operation. For example, data with destination ports 3200 to 3299 can be distributed to the SAP GUI protocol analyzer, and data with destination ports 3300 to 3399 can be distributed to the RFC analyzer.

[0518] In addition, the proxy data formats transmitted by the proxy data transmission unit to the proxy data reception unit are as follows. [Table 1] shows the proxy data transmission format, [Table 2] shows the proxy data response format, and [Table 3] shows the message data format.

[0519] item length note Total Length 4 Message Count 4 Message N

[0520] item length note Total Length 4 Type 1 0: SUCCESS, 1: Failed Message N Failure message

[0521] item length note Time 8 Time of occurrence Direction 1 0: Request, 1: Response, 2: Close Source IP 8 IP address in long format Destination IP 8 IP address in long format Source Port 2 Destination Port 2 Source Mac Address 6 Destination Mac Address 6 Data Length 4 Data N Message data

[0523] FIG. 51 is a diagram illustrating an embodiment in which a proxy server according to one embodiment is connected to another cloud service.

[0524] The proxy server of the present invention has the advantage of being easily scalable to other cloud services. For example, a load balancer from Company A, which provides other cloud services, can distribute network traffic or application requests to multiple servers for processing.

[0525] In one embodiment, the State Probe of Company A's load balancer can check the status of the proxy server's service port. Here, the State Probe is a mechanism for checking the status of the proxy server according to specific criteria, and can check whether the server is operating normally by sending a specific request and a TCP connection request to the proxy server.

[0526] In one embodiment, the state probe may fail if, in the case of the HTTP protocol, the HTTP status code responds with a code other than 200. In another embodiment, it may fail if there is no response within a preset time (e.g., 30 seconds). Additionally, if the time for the TCP connection request and response failure exceeds the timeout, the client connection may be terminated, and a new TCP session may not be established. Subsequently, if the state is restored, new TCP session data may be delivered.

[0527] In one embodiment, if the first proxy server is not operating properly, the data management device of the present invention may be controlled to receive proxy packet data from a second proxy server and / or a third proxy server included in the same Virtual Machine Cluster as the first proxy server. Accordingly, the data management device may receive packet data transmitted and received with a server (e.g., an SAP server) on which an ERP system is installed from the second proxy server and / or the third proxy server.

[0528] In addition, the load balancer can distribute using a 2-tuple configuration that combines the source IP and destination IP in order to maintain session persistence.

[0529] In addition, the virtual machine cluster managing the proxy server of the present invention can set thresholds for each virtual machine (VM) on which the proxy server is installed. At this time, the virtual machine cluster needs to perform scale-in / scale-out of the virtual machine when the virtual machine exceeds the threshold. At this time, the virtual machine cluster can define auto-scale rules based on numerical information regarding memory, CPU, and NIC.

[0530] In one embodiment, the present invention can generate a VM image corresponding to the proxy server of the above-described embodiment and deploy the VM image to a virtual machine within a virtual machine cluster. Additionally, the virtual machine cluster can manage the images and versions of the VMs through a VM image gallery.

[0532] FIG. 52 is a flowchart illustrating a data management method according to one embodiment.

[0533] In one embodiment, the data management method may receive first data from a proxy server that processes data transmitted and received from one of the HTTP protocol, the SAP GUI protocol, and the RFC protocol (S105). For this, refer to the details described in FIG. 44.

[0534] At this time, when data is received via the SAP GUI protocol and RFC protocol, the proxy server can process the Network Interface (NI) protocol to transmit and receive client requests. Additionally, the proxy server collects service-specific port information based on OS service port information and proxy configuration information, wherein the OS service port information includes string information configured in the client's OS service file, and is characterized by processing the NI protocol using the service-specific port information. For details regarding this, refer to the details described in FIG. 49.

[0535] In one embodiment, the data management method can analyze the protocol of the received first data (S107). At this time, the data management method can add the values ​​obtained by replacing the IP and port of the received first data with numbers and distribute the first data according to the amount of the analysis queue using a modulo operation. For this, refer to the details described in FIG. 50.

[0536] In one embodiment, the data management method may generate a log from the analyzed first data (S109). The generated log may be used to extract personal information or to generate user behavior metadata according to the above-described embodiment.

[0538] FIG. 53 is a drawing illustrating a data management device according to an embodiment.

[0539] Regarding techniques to reduce stored logs when recording user logs on a web server, removing unnecessary data (e.g., CSS, images, scripts, and patch files) and eliminating irrelevant areas from the HTML body is important for increasing the efficiency of data analysis and saving storage space.

[0540] Below, we propose a technique to reduce the size of the response body by approximately 95% through SAP WEB GUI data conversion.

[0541] This drawing illustrates an example of reducing the volume of a log when analyzing and processing packets collected from the data management platform described above. Here, the network device (1001), the packet collection unit (1058), and the packet analysis unit (1059) refer to the contents described in the data management platform described above.

[0542] In one embodiment, the data management device may include an SSL protocol processing unit (1060), an HTTP protocol analysis unit (1061), an HTTP script processing unit (1062), a WEBGUI data conversion unit (1063), and an audit log storage verification unit (1064).

[0543] The SSL protocol processing unit (1060) can receive a reassembled packet through the packet analysis unit (1059). More specifically, the SSL protocol processing unit (1060) receives a reassembled TCP packet through the packet analysis unit, extracts fingerprint information of a certificate transmitted during the SSL handshake process from a packet encrypted with the TLS (Transport Layer Security) protocol to identify the loaded SSL private certificate, and uses this to perform decryption of a packet encrypted in the RSA form. At this time, the RSA encryption method is an asymmetric key encryption method that uses a pair of a public key and a private key. The SSL protocol processing unit (1060) can transmit the decrypted packet to the HTTP protocol analysis unit.

[0544] The HTTP protocol analysis unit (1061) analyzes the received packet based on the HTTP protocol to analyze the request-line and status line for each request and response into commands, and analyzes each header and body. In one embodiment, the method of analyzing the HTTP protocol may be described above.

[0545] The HTTP script processing unit (1062) can remove unnecessary information by executing an HTTP processing script with HTTP data analyzed through the HTTP protocol analysis unit as input.

[0546] More specifically, the HTTP script processing unit (1062) can remove unnecessary information by using the content-type of the HTTP data header. For example, if the content-type of the HTTP data header is text / css or text / javascript, this data is data that is transmitted and received on the screen without user intervention and is fixedly displayed on the screen; if the header content-type is application / octet-stream, it is data that uploads / downloads program files and can be determined as unnecessary information in the audit log. Therefore, the HTTP script processing unit (1062) can remove unnecessary information from the data according to the header content-type.

[0547] Additionally, the HTTP script processing unit (1062) can extract extensions within the URLs of the HTTP data and filter them. For example, if the file extensions within the URLs included in the HTTP data are dll, cab, js, swf, or pdf, the extensions can be extracted and filtered. Here, filtering means not storing the corresponding data in the audit log.

[0548] Additionally, the HTTP script processing unit (1062) may not store the HTTP data as an audit log if the HTTP data is for a system that is not a logging target.

[0549] In one embodiment, the HTTP script processing unit (1062) can periodically check whether the HTTP processing script has been changed and update it. At this time, the HTTP processing script can be updated by a user.

[0550] The WEBGUI data return unit (1063) can return the response body data input from the HTTP script processing unit (1062) as converted XML. In this case, since the response body of the WEBGUI data is large, only the data regarding user actions can be extracted from the response body received in XML and converted into XML format.

[0551] At this time, the HTTP script processing unit (1062) can filter the entire log, and the WEBGUI data return unit (1063) can reduce the capacity by removing unnecessary information and storing only the information necessary for the audit log.

[0552] In one embodiment, the operation of the HTTP script processing unit (1062) filtering logs and the operation of the WEBGUI data return unit (1063) performing data conversion cannot occur simultaneously. That is, the WEBGUI data return unit (1063) may not perform WEBGUI data conversion on logs that have been filtered by HTTP script processing by the HTTP script processing unit (1062). Accordingly, the WEBGUI data return unit (1063) may perform data conversion by distinguishing only the logs corresponding to WEBGUI among the HTTP data that have not been filtered by the HTTP script processing unit (1062).

[0553] More specifically, the WEBGUI data return unit (1063) can record the log of the user's query while removing at least one of the parts related to the start script, the parts related to the attributes for each control, and the parts related to the style from the converted XML. This will be explained in detail through the drawings described later.

[0554] The audit log storage confirmation unit (1064) can determine whether to store data in the audit log based on the result processed by the HTTP processing script.

[0555] Through this, unnecessary data can be removed during data analysis.

[0557] FIG. 54 is a diagram illustrating an example of the structure of WEBGUI data according to an embodiment.

[0558] This drawing illustrates, in a DOM tree structure, that HTML data related to the screen is included in the content within control-update in the XML of the WEBGUI response data. The present invention is characterized by extracting only the control information that constitutes the screen from the HTML and deleting the remaining data to reduce the size.

[0559] For example, start-script and initialized-ids generally do not contain information to be extracted as audit logs. On the other hand, Control-update is divided into elements that make up the screen, such as a bottom message (msgarea) and main screen information (userpanel), and the content contains control information for displaying the screen, and the usage of each control can be distinguished according to its attribute.

[0560] For example, the control-update element can contain the following content.

[0561] (1) webguiPopups: HTML content regarding popup screens

[0562] (2) backpackCUA: HTML content regarding context menus

[0563] (3) backpackUA: HTML content regarding system information popup

[0564] (4) webguiKeys: HTML span tag containing shortcut key information

[0565] (5) cuaarea: HTML content corresponding to the top part of the user interface

[0566] (6) msgarea: User interface used for message output

[0567] (7) screenarea / userPanel: User interface of the main screen

[0568] In one embodiment, to reduce the data size of the audit log, only the data constituting the screen in HTML can be extracted and the remaining data can be deleted. For example, among the control-update elements, "msgarea" and "screenarea / userPanel" can be extracted because they are data constituting the screen, and the remaining data can be deleted. However, this is merely an example, and it goes without saying that to reduce the data size of the audit log, data satisfying pre-set conditions can be extracted and the remaining data deleted.

[0570] FIG. 55 is a diagram showing the HTML analysis results within WEBGUI data according to an embodiment.

[0571] Generally, when an HTML element has the ct (content type) or subct (sub content type) attribute, child elements are organized in the same pattern according to the attribute value. In this case, the Isdata attribute can be used to check the ID and the data to be displayed.

[0572] This drawing shows the parts where WEBGUI is displayed on a web browser, extracted from the screen and the response body, and represents Isdata and Isevents when the ct value of the extracted data is R_standards. Here, R_standards means radio buttons, the value of item 4 in Isdata means the label displayed on the screen, and the SID of item 13 means the ID value that can identify the control.

[0573] In one embodiment, the data management device may extract extractable values ​​using the Isdata attribute based on ct or subct in an HTML document, and then delete the remainder as unnecessary information.

[0574] At this time, the extractable values ​​and examples for each ct(content type) / subct(sub content type) type are as follows.

[0575] In one embodiment, based on the example below, only extractable values ​​from the original data can be extracted, and the remaining data can be removed. Additionally, among the extractable values, "ID" can be excluded from extraction because it is an item that is not used, even though it can be extracted.

[0576] (1) When the ct / subct type is CO and the Type is Control, the extractable values ​​are ID and Type, and an example of the value is “wnd[0] / titl, FioriTitleBar”.

[0577] (2) When the ct / subct type is B and the Type is Button Control, the extractable values ​​are ID and Type, and examples of values ​​are “wnd[0] / tbar[1] / btn[7], GuiButton”.

[0578] (3) When the ct / subct type is PHT and the Type is Page Header Title, the extractable value is Title, and an example value is “HR\x20Master\x20Data\x20Query”.

[0579] (4) When the ct / subct type is T and Type is Tool Bar, the extractable values ​​are ID and Type, and examples of values ​​are "wnd[0] / sbar, FioriStatusBar".

[0580] (5) When the ct / subct type is LNC and the Type is Link Choice, the extractable value is Text and the value

[0581] The example is "S42\x20\x28100\x29".

[0582] (6) When the ct / subct type is CBS and the Type is Text Field, the extractable values ​​are ID, Type, and value, and an example of the value is “wnd[0] / usr / ctxtRSRD1-TBMA_VAL, GuiCTextField, MARAX”.

[0583] (7) When the ct / subct type is RL and the Type is Raster Layout, the extractable values ​​are ID, Type, and ModalNo, and an example of the value is “wnd[0] / usr, GuiUserArea, 0”.

[0584] (8) When the ct / subct type is RLI and the Type is Raster Layout Item, the extractable values ​​are X coordinate and Y coordinate, and an example value is “168, 8”.

[0585] (9) When the ct / subct type is R_standards and the Type is Radio Button, the extractable values ​​are ID, Type, Text, and whether or not to check, and an example value is "wnd[0] / usr / radRSRD1-TBMA, GuiRadioButton, Database\x20table, true".

[0586] The items above are a list of some examples, and it goes without saying that the values ​​that can be extracted are not limited to these, depending on the types of ct / subct types and the ct / subct types included in the HTML document.

[0588] FIG. 56 is a diagram showing the HTML analysis results within WEBGUI data according to an embodiment.

[0589] The HTML analysis results within the WEBGUI data may be displayed as shown in the drawing above. In one embodiment, the HTML analysis results may be displayed on the screen in a tree-like structure based on the ct or subct attributes.

[0590] For example, the left side of the drawing shows the WEBGUI SE11 screen. Here, SE11 is a data dictionary transaction code in the SAP system, a tool that can create, manage, and inspect data-related objects such as tables, views, data types, and structures. Accordingly, WEBGUI can provide an interface to access the SAP system through a web browser.

[0591] In one embodiment, when the original response text of the WEBGUI SE11 screen is analyzed according to the ct or subct attribute, a tree-shaped structure having the same structure as the screen data viewed by the user on the WEBGUI SE11 screen is output, as shown in the drawing on the right of this drawing.

[0592] Accordingly, even if the data volume is reduced by removing unnecessary information, it has the advantage of being structurally identical to the data on the screen viewed by the user, which can facilitate analysis when extracting personal information.

[0594] FIG. 57 is a drawing showing the original WEBGUI data according to an embodiment.

[0595] This drawing is an example of a drawing of the aforementioned WEBGUI SE11 screen output as an XML file. The XML data included in this drawing is merely an example, and the actual original XML file may contain all the code for configuring the WEBGUI SE11 screen.

[0596] In one embodiment, the response body of the WEBGUI SE11 screen analyzed within the data management device may be encoded using the MIME (Multipurpose Internet Mail Extensions) format. In this case, an HTTP parser may be used to analyze the HTTP response body encoded in the MIME format.

[0597] Subsequently, the data management device can perform XML conversion tests based on the ct or subct attributes using a parser to analyze the WEBGUI source text. At this time, the data management device can perform the conversion excluding context menus or popover windows.

[0598] In one embodiment, among the XML conversion results of the WEBGUI SE11 screen, only cases where the content-type is userpanel and msgarea can be extracted. This will be described later.

[0600] FIG. 58 is a diagram showing XML data with unnecessary information removed according to an embodiment.

[0601] Based on the above-described embodiment, the data management device can remove unnecessary information based on ct or subct among the converted XML data.

[0602] This drawing can remove information from the converted XML data by determining it as unnecessary, except for cases where the content-type (ct) is userpanel or msgarea. In this case, since msgarea is HTML representing the message output user interface part and userpanel is HTML representing the main screen user interface part, when the content-type is msgarea or userpanel, it can be determined as data necessary to construct the screen and stored in the audit log.

[0603] Based on the above-described embodiment, the XML sizes of the original data and converted data per screen are compared as follows.

[0604]

[0605] Here, T code (Transaction code) represents a short keyword or abbreviation for accessing a specific task or process in the SAP GUI. Also, Dynpro (Dynamic Programming) Name represents the name of the SAP GUI program, and Dynpro number represents the screen number within the SAP GUI program. Referring to the table, it can be seen that, according to one embodiment of the present invention, the size of the XML data is reduced to 8% to 1%.

[0606] Furthermore, since the elements through which data is input and output contain ID information, personal information can be extracted if a parser is implemented that extracts key / value pairs based on ID information.

[0607] For example, the representation of ID information may be expressed in a form such as "wnd[0] / usr / radRSRD1-TBMA", "wnd[0] / usr / ctxtRSRD1-TBMA_VAL - MARAX", or "wnd[0] / sbar_msg - MARAX is missing. Please check the name". In particular, when values ​​with the same meaning are expressed redundantly, they may be expressed in an array form. Accordingly, the present invention can extract personal information by analyzing the representation of ID information.

[0609] FIG. 59 is a diagram illustrating a data management method according to an embodiment.

[0610] In one embodiment, first data can be received (S111). The present invention can receive a packet containing the first data through a network device. For this, refer to the details described in FIGS. 1 to 4 and FIG. 53.

[0611] In one embodiment, the protocol of the received first data can be analyzed (S113). The present invention can analyze the first data based on the protocol of the first data. For example, if the data is encrypted with the TLS protocol, the data can be analyzed after decrypting the key using a certificate. Refer to FIG. 53 for this.

[0612] In one embodiment, if the protocol is an HTTP protocol, the first data can be filtered using an HTTP processing script (S115). For example, unnecessary information can be removed by executing an HTTP processing script with the analyzed HTTP data as input. An example of an HTTP processing script is disclosed in FIG. 53.

[0613] In one embodiment, a fourth data can be generated by deleting the third data included in the second data corresponding to WEBGUI from the HTTP data that is not filtered using an HTTP processing script in the first data (S117). That is, the fourth data can be generated by analyzing the third data included in the second data and deleting unnecessary parts. Here, the third data is characterized as being a value that can be extracted according to a preset condition. In addition, the fourth data may include data necessary to configure a screen corresponding to the protocol among the second data.

[0614] More specifically, the data management method can delete the remaining data, excluding msgarea or userPanel, which are attributes of control-update included in the third data that are necessary for configuring the screen. In this case, even if the control-update attribute within the third data is msgarea or userPanel, the data management method can delete the ID among the extractable values ​​and generate an audit log using only the remaining data. For this, refer to the details described in FIGS. 53 to 58.

[0616] FIG. 60 is a drawing disclosing an example in which a data management platform according to an embodiment performs access control for a computing system.

[0617] In the illustrated example, the data management platform (10000) can perform event-based access blocking and MAC address-based access blocking. In one embodiment, the data management platform (10000) can control access to a user's (1000) computing system through a collection module (20001), an analysis module (20002), and a monitoring module (20005). For example, the computing system may include an SAP system.

[0618] In one embodiment, the collection module (20001) can collect packets. In one embodiment, the collection module (20001) can collect packets transmitted between a user (1000) and an application server (1002). For example, the application server (1002) may include an SAP server that provides an SAP system to the user (1000). In one embodiment, the collection module (20001) can collect packets based on at least one of an IP address and a MAC address through a switch. In one embodiment, the collection module (20001) can collect access information of the user (1000). For example, the access information may include at least one of the user's (1000) IP and MAC address.

[0619] The analysis module (20002) can perform access control by blocking the user (1000) from logging into the computing system. In one embodiment, the analysis module (20002) can generate user account-specific access control information for the computing system and generate event processing rules based on the access control information. Additionally, the analysis module (20002) can determine whether an access control event occurs based on the event processing rules. Here, the access control information may include criteria information for controlling access to the computing system. Additionally, the event processing rules may include rule information for controlling access based on the access control information.

[0620] In one embodiment, the analysis module (20002) can perform access control through the analysis of user behavior of the user (1000). The analysis module (20002) can generate a correlation analysis rule based on at least one event regarding the user's (1000) computing system. Additionally, the analysis module (20002) can determine whether an access control event occurs by performing user behavior analysis based on the correlation analysis rule.

[0621] In one embodiment, the analysis module (20002) can perform access control based on the user's (1000) access information, targeting an application server (1002) on which a program for controlling based on the user's (1000) access information is installed. The analysis module (20002) manages user account-specific access control information for a computing system and synchronizes and reflects this information with the application server (1002) by the monitoring module (20005). The control program installed on the application server (1002) can determine whether to control access by comparing the user's (1000) access information based on this account-specific access control information.

[0622] The monitoring module (20005) can transmit an access control request to the application server (1002) via SAP RFC (Remote Function Call) communication when an access control event based on at least one of an event processing rule and a correlation analysis rule occurs. In one embodiment, the monitoring module (20005) can transmit an access control request to the application server (1002) when access control based on access information is determined.

[0623] In one embodiment, the application server (1002) can block access to the computing system of the user (1000) by performing access control processing upon receiving an access control request via RFC. In one embodiment, the monitoring module (20005) requests synchronization via RFC whenever access control information per user account changes, and the application server (1002) can block access by performing access control information synchronization processing upon receiving access control information per user account, collecting the IP / MAC when the user (1000) accesses the computing system with this information, and comparing it with the access control information per user account.

[0625] FIG. 61 is a drawing disclosing another example in which a data management platform according to an embodiment performs access control to a computing system.

[0626] In the illustrated example, the data management platform (10000) may include a collection module (20001), an analysis module (20002), and a monitoring module (20005). The application server (1002) may include a login information collection unit (30017) and an access control processing unit (30018).

[0627] The collection module (20001) of the data management platform (10000) may include a packet collection unit (30001) and an access information collection unit (30002).

[0628] The packet collection unit (30001) and the collection module (20001) can collect packets transmitted between the user (1000) and the application server (1002) through a Network Switch or a Network TAP (Test Access Point, hereinafter TAP). The access information collection unit (30002) can collect IP and MAC address information of the user (1000) whose computing system GUI is executed by analyzing packets between the computing system and the user (1000). Additionally, the login information collection unit (30017) is installed on the computing system and can collect the IP and MAC address of the user (1000) by utilizing OS commands when the user (1000) logs in.

[0629] The analysis module (20002) may include an event analysis unit (30003), a user behavior analysis unit (30004), and an access information analysis unit (30005). In one embodiment, the event analysis unit (30003) may generate access control information per user account and generate an event processing rule that can add events to an audit log based on the access control information. For example, the access control information may include at least one of an IP and IP range, a system, a day of the week, a time range, a rule validity period, and a blocking message. Further details regarding this are described below.

[0630] The event analysis unit (30003) can analyze packets to generate an audit log and compare them with event rules. If the access is not allowed, the event analysis unit can add an access control event to the audit log and store it. For example, the audit log may include SAPGUI information. In one embodiment, the event analysis unit (30003) can query the audit log and add an access control event.

[0631] The user behavior analysis unit (30004) can accumulate events and generate correlation analysis rules that can analyze abnormal user behavior. For example, the correlation analysis rules may include various user behaviors regarding various computing systems, such as downloading after viewing personal information.

[0632] The user behavior analysis unit (30004) can generate an incident by querying audit logs and detecting abnormal user behavior according to correlation analysis rules.

[0633] The access information analysis unit (30005) can perform access control for a user based on access information regarding the user's (1000) computing system. In one embodiment, the access information analysis unit (30005) manages IP address, MAC address, and validity period information, stores it in a database, and the access control request unit (30006) can synchronize this information with the computing system (1002) and perform user-specific access control through the access control processing unit (30018).

[0634] The access control processing unit (30018) controls user access by comparing access information including at least one of an IP address and a MAC address collected through the login information collection unit (30017) with user account-specific access control information synchronized through the access control request unit (30006) in the data management platform (10000).

[0635] The monitoring module (20005) may include an access control request unit (30006). In one embodiment, if the access control request unit (30006) is checking for an access control event, it may transmit context ID information and a blocking message within the audit log to the application server (1002) using SAP RFC.

[0636] In one embodiment, the access control request unit (30006) can send an access control request to the application server (1002) using notification transmission (Simple Mail Transfer Protocol, SMTP) and RFC for a generated incident. In one embodiment, when the SAP RFC function is called, the application server (1002) can search for and block a user session using the received context ID information and pop up a blocking message to the user (1000).

[0637] In one embodiment, the access control request unit (30006) may transmit stored user-specific access control information to the application server (1002) using the RFC protocol. In one embodiment, the application server (1002) may store the access control information received via SAP RFC in a table within the computing system. In one embodiment, the login information collection unit (30017) may collect access information including at least one of the IP address and MAC address information of the user (1000) whose computing system GUI is executed when the user logs into the computing system. Additionally, the access control processing unit (30018) may compare the access control information with the collected access information and terminate the connection if the access is not permitted. In one embodiment, in the case of event-based access control, since the MAC address cannot be used when passing through multiple network switches, a MAC-based access control function may be used.

[0639] FIG. 62 is a drawing disclosing an example of an access control information input screen according to an embodiment.

[0640] In an illustrated example, the access control information input screen (30007) of the present invention may be provided. Here, the access control information input screen (30007) may represent a screen for inputting access control information that controls the login to a user's computing system.

[0641] In one embodiment, the access control information input screen (30007) may receive access control information including at least one of a user account, organization, blocking message, IP address, MAC address, system information, day of the week, time range, and validity period.

[0642] The blocking message may include a message delivered to the user when access is blocked. For example, the blocking message may include a message such as "Blocked because it is an unregistered IP." The IP address allows setting the IP address to control access, and specific IP addresses and IP ranges may be set. The MAC address allows setting the MAC address to control access, and all MAC addresses or specific MAC addresses may be set. The system allows setting the system to control access, and all systems or specific systems may be set. The day of the week allows setting the day to block access, and at least one day from Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, and Sunday may be set. The time range allows setting the time for controlling access, and all times or specific times may be set. The validity period allows setting the period during which access is controlled, and all periods or specific periods may be set.

[0644] FIG. 63 is a drawing disclosing an example of an event processing rule screen according to an embodiment.

[0645] In an illustrated example, an event processing rule screen (30008) of the present invention may be provided. Here, the event processing rule screen (30008) may represent a screen for inputting event processing rules based on access control information.

[0646] In one embodiment, the event processing rule screen (30008) may include a rule ID, a rule type, a rule setting, and a rule code. Here, the rule code may include a code that defines conditions and rules for controlling access based on access control information.

[0647] For example, rule code can be written to output a CON-MGT event stating "Blocked because it is an unregistered IP" when new_login is true or transaction_code is WEBGUI_SERVICES, the user account (sap_userid) is PT_INSPIEN, the IP address does not include 10.1.1.100, the day of the week is not Monday, Tuesday, Wednesday, Thursday, or Friday, and the time range does not fall between 09000 and 18000. In other words, user login can be controlled according to event processing rules based on this access control information.

[0649] FIG. 64 is a drawing disclosing an example of a correlation rule input screen according to an embodiment.

[0650] In an illustrated example, a correlation rule input screen (30009) of the present invention may be provided. Here, the correlation rule input screen (30009) may represent a screen for inputting correlation rules that perform user behavior analysis-based access control.

[0651] In one embodiment, the correlation rule input screen (30009) may input a correlation rule including at least one of a correlation rule ID, a rule type, a rule name, an applied event, a same target item, and an accumulated item. Here, the rule type may include an accumulation exceedance type that controls access when a specific event accumulates a certain number of times. For example, access may be controlled when the accumulation of personal information exceeds 100 cases.

[0652] The application event can select at least one event to which access control will be applied. For example, Resident Registration Number lookup, Alien Registration Number lookup, Driver's License Number lookup, and Passport Number lookup events can be selected as events entered into the correlation rule to apply access control.

[0653] For identical target items, you can select the criteria items to which access control will be applied. For example, events can be accumulated based on employee ID, system, protocol name, and organization. These can be selected as the criteria items to apply access control.

[0654] Accumulation items may include accumulation time, accumulation items, and excess counts. For example, accumulation time may indicate the time during which events are accumulated. Accumulation items may include fields representing numerical values ​​among event fields. For example, it may include the number of events (n or more). Additionally, excess counts may set a threshold (e.g., 100) for the value that accumulation items are summed up during the accumulation time.

[0656] FIG. 65 is a drawing disclosing an example of a correlation rule activation screen according to an embodiment.

[0657] In an illustrated example, a correlation rule activation screen (30010) of the present invention may be provided. Here, the correlation rule activation screen (30010) may represent a screen for inputting rules that generate events (incidents) by analyzing the correlation between received events in real time.

[0658] In one embodiment, the correlation rule activation screen (30010) can input whether to activate the correlation rule entered into the correlation rule input screen (30009) in the correlation rule application area. In one embodiment, the activation status of the rule for accumulating more than 100 personal information cases and correlation analysis rule information can be input. Here, the correlation rule application area may include a rule ID, a rule name, an analysis interval, and an activation status.

[0659] Additionally, the correlation rule application area may include multiple rules, and each correlation rule may include a security score, a security score calculation rule, a risk level, a notification application rule, and an incident storage rule. For example, if the accumulation of personal information exceeds 100 cases, a security score of 30 points and a user access blocking notification application rule may be set, and an incident storage rule may be enabled (ON).

[0661] FIG. 66 is a drawing disclosing an example of a control data setting screen according to an embodiment.

[0662] In an illustrated example, a control data setting screen (30011) of the present invention may be provided. Here, the control data setting screen (30011) may represent a screen for inputting control data settings that perform MAC-based access control.

[0663] In one embodiment, the control data setting screen (30011) may have at least one of an account group, an account group manager, and an account group-specific control set for a computing system (e.g., SAP).

[0664] In one embodiment, an account group may include an account group code and a corresponding account group name. For example, the account group name of account group code FI may be set to Financial Accounting. Additionally, an account group administrator may include system users and account groups. For example, a system administrator may be set to administrator, and an account group may be set to ALL. Additionally, account group controls may include accounts, account groups, and account names for computing systems.

[0666] FIG. 67 is a flowchart disclosing an example of a data management method according to an embodiment converting a data format.

[0667] A data management platform that controls at least one engine or module included in a data management software package detects access to a user's computing system (S30101). In one embodiment, access to a user's computing system may be detected based on at least one of a network switch, a TAP, and a MAC address. For this, refer to the details described in FIGS. 60 and 61.

[0668] Based on pre-stored access control information, an access control request to block the user's access is sent to the application server for the computing system (S30103). In one embodiment, an event processing rule for the user's user account is generated, and based on the event processing rule, an access control request to block the user login corresponding to the detected access can be sent to the application server.

[0669] In one embodiment, a correlation analysis rule for user behavior is generated based on at least one event regarding a user, and an access control request to block the detected access based on the correlation analysis rule can be sent to the application server.

[0670] In one embodiment, access address information for a user is obtained, and an access control request to block the detected access of the user based on the access address information can be sent to an application server. For this, refer to the details described in FIGS. 62 to 66.

[0672] FIG. 68 is a drawing disclosing an example in which a data management platform according to an embodiment performs log data-related indexing and log data compression.

[0673] In the illustrated example, the data management platform (10000) can perform log data compression and log data-related indexing. In one embodiment, the data management platform (10000) can compress original log data in bucket units through a collection module (20001), an analysis module (20002), and a monitoring module (20005), and can perform full-text indexing and bitmap indexing related to the log data.

[0674] In one embodiment, the collection module (20001) may receive log data. Here, the log data may include event data. In one embodiment, the collection module (20001) may receive normalized event data from a broker. In one embodiment, the broker may include a process for loading log data in the middle of each process for distributed processing.

[0675] The analysis module (20002) can compress log data in bucket units. In one embodiment, the analysis module (20002) can determine shards of segments for the log data. In one embodiment, the analysis module (20002) can store log data in buckets in chunk units. In this case, a chunk may represent a unit for storing log data. Additionally, the original log data may be divided into bucket files based on capacity and stored. In this case, according to the present invention, the compression rate can be increased through buckets. In one embodiment, log data compressed based on chunks can be retrieved by decompressing in chunk units without decompressing in segment units.

[0676] In one embodiment, if the log data being stored contains new event field type information, the analysis module (20002) may store field information in the event field type information and store the Log ID of the corresponding log data that is the index target in a queue (20009). Here, the event field type information may represent an event field ID for the event field contained in the corresponding log data and numeric information capable of identifying the event field ID.

[0677] In one embodiment, the analysis module (20002) may generate a log data-related index comprising at least one of a full-text index for the source of the log data corresponding to the log ID and a bitmap index for the event field of the log data.

[0678] In one embodiment, the analysis module (20002) can perform compression on log data stored in chunks in a bucket. Details regarding this are described below.

[0679] The monitoring module (20005) may receive a log lookup request for at least one of a plurality of log data from a user / client (1000). In one embodiment, the monitoring module (20005), in response to the log lookup request, may distinguish a target bucket based on a log ID found based on a log data-related index, and use offset information of the compressed bucket to find a chunk containing log data in the bucket and decompress it. In one embodiment, the monitoring module (20005) may transmit the decompressed log data among the plurality of log data to the user / client (1000) in response to the log lookup request.

[0681] FIG. 69 is a drawing disclosing another example in which a data management platform according to an embodiment performs log data-related indexing and log data compression.

[0682] In the illustrated example, the data management platform (10000) may include a collection module (20001), an analysis module (20002), and a monitoring module (20005).

[0683] The collection module (20001) may include a data collection unit (30012). In one embodiment, the data collection unit (30012) may receive normalized log data through a broker, at least one of storage information where the log data will be stored, and shard information.

[0684] The analysis module (20002) may include a compression processing unit (30013) and an index creation unit (30014). In one embodiment, the compression processing unit (30013) may extract a target segment using time information of an event for the corresponding log data. Additionally, the compression processing unit (30013) may query the shards of the corresponding segment and create a shard if there are no shards.

[0685] In one embodiment, the compression processing unit (30013) can encode the log data into a byte format for storing log data and store it in a bucket in chunks. In one embodiment, for a plurality of log data, at least one log data can be stored in a bucket in chunks. In one embodiment, a log ID can be generated to identify the event location stored in the bucket.

[0686] In one embodiment, the compression processing unit (30013) can perform compression on the remaining buckets, excluding the last bucket among the multiple buckets where log data is stored, based on bucket information in the shards of the segments within the storage. Since log data is being added to the last bucket of the log data for the day during log collection, compression is performed on the last bucket after the collection deadline for the last bucket has ended.

[0687] In one embodiment, the compression processing unit (30013) may generate at least one of data information, offset information, and size information corresponding to each bucket. Here, the data information may include log data compressed in chunk units within the bucket. The offset information may include location information for each chunk within the bucket. The size information may include compression-related information including the size of the bucket and the chunk size.

[0688] If the event for the stored log data includes new event field type information, the compression processing unit (30013) can add the event field type information, which includes an event field ID and numeric information that can identify the event field ID, and encode the log data into bytes using the event field type information. The compression processing unit (30013) can generate a log ID corresponding to the log data after storing it in a bucket and can store the log ID in a queue for index processing.

[0689] The index creation unit (30014) can reference original log data in a bucket using a log ID transmitted through a queue, and create and store a bitmap index corresponding to the field of the event and a full-text index corresponding to the log data of the event, i.e., the original data (Raw Data).

[0690] In one embodiment, the index generation unit (30014) can extract event field IDs and field values ​​that are the target of bitmap indexing from text data of original log data that is the target of full-text indexing based on a pre-stored event conversion rule language.

[0691] In one embodiment, the event transformation rule language may include an event transformation and an expression. Here, the expression may include an expression used in a statement. For example, the expression may include at least one of a variable, a string, NULL, a number, a string concatenation expression, a type, a conversion expression, and a function call expression.

[0692] Additionally, event transformation can be determined based on a statement that includes at least one of a variable assignment statement, a log statement, and a match statement. For example, a variable assignment statement can assign a variable name. Additionally, a log statement can assign a field value based on at least one of the event's field name and storage.

[0693] Additionally, the match statement can execute a desired statement depending on whether the data (string) matches a specific pattern. In one embodiment, the match statement can execute a statement based on at least one of a variable name, a pattern type, a pattern string, and option information. In this case, the variable name may not be specified, and if not specified, it may refer to the original log data.

[0694] Additionally, pattern types may include regular expressions (regx), comma-separated value (comma separated value, csv), tab-separated value (tsv), labeled tab-separated value (labeled tab-separated value, ltsv), and fixed length. For example, comma-separated allows you to transform events by entering comma-separated field names into the pattern expression. Tab-separated allows you to transform events by entering tab-separated field names into the pattern expression. Labeled tab-separated parses the labeled tab-separated value from the event, so the pattern expression may not be used. Fixed length allows you to transform events by identifying the field value based on the length of each field in the case of a fixed-length event.

[0695] Additionally, pattern strings may not be included in the match syntax depending on the pattern type. Furthermore, option information may include encoding options, and the encoding of the log data may be converted based on the encoding options.

[0696] In one embodiment, the event transformation rule language may be determined based on a Lua script. In this case, a function named transform, which is called during the Lua script transformation process, may be defined. For example, the first parameter of the function may represent an input event, and the second parameter may represent an object for log storage. In this case, since a more flexible general-purpose language is used in the case of a Lua script, it is possible to handle complex requirements. A match function may be defined to extract event fields from events input within the Lua script. In one embodiment, the match function may include transformation functions such as regular expression (regx), comma separated value (comma separated value, csv), tab separated value (tsv), labeled tab separated value (labeled tab separated value, ltsv), fixed length, and delimiter separated value (delimiter separated value, dsv). For example, delimiter separated can transform events by inputting character information and field information that separate fields within the text.

[0697] In addition, in one embodiment, a privacy function can be defined to extract personal information regarding an input event. For example, if personal information type information, a regular expression capable of extracting personal information, and a personal information validation expression are defined in the privacy function, personal information can be extracted from the input event using a finder function included in the privacy function.

[0698] The monitoring module (20005) may include a decompression unit (30015) and a log inquiry unit (30016). In one embodiment, the decompression unit (30015) may decompress only the log data corresponding to the log ID of an event searched by at least one of a full-text index and a bitmap index among the log data compressed in bucket units.

[0699] In one embodiment, the log lookup unit (30016) can perform a conditional search for a specific column (e.g., field type) of the log data using a bitmap index. That is, the log lookup unit (30016) can look up a corresponding log ID using a search value corresponding to an event field corresponding to the bitmap index.

[0700] In one embodiment, the log lookup unit (30016) can perform a keyword-based search of log data containing specific text content in the original log data using a full-text index.

[0701] In one embodiment, the decompression unit (30015) can decompress only the chunk containing at least one log data based on a log ID retrieved by the log lookup unit (30016) at the request of the user / client (1000) among the log data compressed in bucket units. That is, according to the present invention, more log data can be stored in the storage through bucket-unit compression. In addition, according to the present invention, compressed log data can be decompressed in chunk units so that real-time lookup can be performed without decompressing the entire segment.

[0702] In one embodiment, the log inquiry unit (30016) may receive a log inquiry request for log data from a user / client (1000), and may transmit uncompressed log data among a plurality of log data to the user / client (1000) in accordance with the log inquiry request.

[0704] FIG. 70 is a flowchart disclosing an example in which a data management method according to an embodiment performs log data-related indexing and log data compression.

[0705] Log data is received in a data management platform that controls at least one engine or module included in a data management software package (S30201). In one embodiment, normalized log data may be received from a broker. For this, refer to the details described in FIGS. 68 and 69.

[0706] Log data is compressed in bucket units (S30203). In one embodiment, log data is encoded and stored in buckets in chunk units, compression is performed on the log data stored in buckets in chunk units, and at least one of data information, offset information, and compression information for the buckets can be generated. For this, refer to the details described in FIGS. 68 and 69.

[0707] Log data included in the bucket is decompressed based on an index related to the log data (S30303). In one embodiment, prior to step S30303, a log data-related index may be created that includes at least one of a full-text index for the log data and a bitmap index for the event field of the log data. In one embodiment, prior to step S30303, log ID information for the log data may be stored in a queue, and the log data stored in the bucket may be identified based on the log ID information. For this, refer to the details described in FIGS. 68 and 69.

[0709] FIG. 71 is a drawing disclosing an example in which a data management platform according to an embodiment performs statistical query generation and statistical data visualization.

[0710] In one example, the data management platform (10000) can generate a statistical query based on user input and provide the search results in the form of a chart or table for visualization. In one embodiment, the data management platform (10000) can automatically generate a statistical search language through a monitoring module (20005) and visualize the statistical data extracted through the statistical search.

[0711] In one embodiment, the monitoring module (20005) may include a user input acquisition unit (30019), a query generation unit (30020), a data search unit (30021), and a data visualization unit (30022).

[0712] The user input acquisition unit (30019) can acquire user input that specifies a query type for a query generation user interface (UI). In one embodiment, the query generation user interface may be provided to and displayed to a user / client in the form of a pop-up. In one embodiment, the user input acquisition unit (30019) can acquire user input that generates a visualization chart.

[0713] The query generation unit (30020) can generate a statistical query that retrieves statistical data based on a specified query type. In one embodiment, the query type may include at least one of a first query that extracts a specific number of top data, a second query that extracts data measured according to a time series, and a third query that extracts data according to a field type. Here, the first query may be referred to as a TopN query or a term having an equivalent technical meaning. Additionally, the second query may be referred to as a Time Series query or a term having an equivalent technical meaning. Additionally, the third query may be referred to as a Group By query or a term having an equivalent technical meaning. Details regarding this are described below.

[0714] According to the present invention, a simpler and more powerful query language can be provided for a statistical metric information repository. In addition, according to the present invention, a UX can be supported that allows simple statistical queries to be created simply through interaction with the user. Furthermore, according to the present invention, simple statistical queries can be created simply by UI manipulation without knowing the syntax of statistical queries in detail.

[0715] The data search unit (30021) can search for statistical data based on a statistical query. In one embodiment, the data search unit (30021) can search for statistical data based on at least one of a data source, a search period, and a query type set by the statistical query.

[0716] The data visualization unit (30022) can visualize statistical data retrieved based on a statistical query. In one embodiment, the data visualization unit (30022) can visualize statistical data by selecting a visualization chart after searching for statistical data. According to the present invention, an analysis chart can be generated by freely interacting with each field of the result set data generated from the statistical search results. Furthermore, according to the present invention, various types of charts can be supported. Additionally, according to the present invention, various types of visualizations can be easily generated and used through the same statistical data.

[0718] FIG. 72 is a drawing disclosing an example of a query generation screen according to an embodiment.

[0719] In the illustrated example, a query generation screen (30023) of the present invention may be provided. Here, the query generation screen (30023) may represent a screen for setting basic information for a statistical query.

[0720] In one embodiment, the query generation screen (30023) can set a data source, a search period, and a query type. Here, the data source includes statistical data to perform a statistical search. For example, the data source can be set to ResourceCheck.

[0721] Additionally, the search period may include information on setting the period for performing a statistical search. For example, the search period may be set from 2024-01-09 00:00 to 2024-01-09 23:59.

[0722] Additionally, the query type allows you to set the type of statistical query to perform the search. For example, the query type can be set to one of TopN queries, Time Series queries, or Group By queries.

[0724] FIG. 73 is a drawing disclosing an example of a TopN query setting screen according to an embodiment.

[0725] In an illustrated example, the TopN query setting screen (30024) of the present invention may be provided. Here, the TopN query setting screen (30024) may represent a screen for setting detailed information of a TopN query that extracts a specific number of top data.

[0726] In one embodiment, the TopN query setting screen (30024) may include a threshold count, a time unit, a dimension, and a metric. Here, the threshold count may include a specific top count to be displayed in the search results among the entire measured data. For example, the threshold count may be set to 10, and the top 10 statistical data among the entire data may be searched.

[0727] Additionally, the time unit may include the time unit in which data is searched. The dimension may include a search criterion representing an attribute of the data being searched. For example, the dimension may be set to device_id, which is a device ID. Additionally, the metric may include a search item and a calculation method that are quantitatively searched. In one embodiment, the calculation method may include at least one of a first calculation method that measures the sum of search item values, a second calculation method that measures the maximum value among the search item values, and a third calculation method that measures the minimum value among the search item values. For example, it may be set so that 10 items are displayed by measuring the sum of Usage based on device_id.

[0729] FIG. 74 is a drawing disclosing an example of a Time Series query setting screen according to an embodiment.

[0730] In an illustrated example, the Time Series query setting screen (30025) of the present invention may be provided. Here, the Time Series query setting screen (30025) may represent a screen for setting detailed information of a Time Series query that extracts data measured according to a time series.

[0731] In one embodiment, the Time Series query setting screen (30025) may include time units and metrics. Here, the time unit may include the time unit in which data is retrieved. Additionally, for example, the time unit may be set to a time series order such as ascending or descending order.

[0732] Additionally, the metric may include quantitatively searched items. For example, it may be set to measure the sum of Usage on an hourly basis.

[0734] FIG. 75 is a drawing disclosing an example of a Group By query setting screen according to an embodiment.

[0735] In an illustrated example, a Group By query setting screen (30026) of the present invention may be provided. Here, the Group By query setting screen (30026) may represent a screen for setting detailed information of a Group By query that extracts data according to a field type.

[0736] In one embodiment, the Group By query setting screen (30026) may include a time unit, a dimension, and a metric. Here, the time unit may include a time unit in which data is searched. The dimension may include a search criterion representing an attribute of the data being searched. For example, the dimension may be set to device_id, which is a device ID. Additionally, the metric may include search items that are searched quantitatively. For example, it may be set to measure the sum of Usage based on device_id per time unit.

[0738] FIG. 76 is a drawing disclosing an example of a statistical search screen according to an embodiment.

[0739] In an illustrated example, a statistical search screen (30027) of the present invention may be provided. Here, the statistical search screen (30027) may represent a screen for searching statistical data based on a statistical query.

[0740] In one embodiment, the statistical search screen (30027) can perform a statistical search including a query area and a search result area. Here, the query area is an area where a set statistical query is entered, and it may be displayed in a code format depending on the query type.

[0741] The search result area may display statistical data based on a statistical search. In one embodiment, the search result area may include dimension and metric values. For example, when searching with device_id as the dimension and calculating the count value corresponding to the metric as LONGMAX, a maximum count value per device_id may be calculated. For example, for device_id b25e1d74-57dd-44dd-a8c0-cbb1143bv4c, a maximum count value of 174 corresponding to it may be calculated.

[0742] In one embodiment, the search results area may include a visualization transition tab for visualizing statistical data after a statistical search. When input to the visualization transition tab is detected by a user, a screen for generating a visualization chart based on the statistical data may be provided in the form of a popup. Further details regarding this are described in detail below.

[0744] FIG. 77 is a drawing disclosing an example of a visualization chart selection screen according to an embodiment.

[0745] In an illustrated example, a visualization chart selection screen (30028) of the present invention may be provided. Here, the visualization chart selection screen (30028) may represent a screen for selecting a visualization chart.

[0746] In one embodiment, the visualization chart selection screen (30028) may include various types of charts. For example, the visualization chart selection screen (30028) may include a line chart, a curve chart, a column chart, and a bar chart, but is not limited thereto and may include various charts.

[0747] In one embodiment, the visualization chart selection screen (30028) may include at least one of a basic chart, a special chart, and a combination chart. For example, the special chart may include a special type of stacked chart that displays two or more variables on one axis, but is not limited thereto and may include various special types of charts.

[0748] Additionally, combination charts may include charts that display two chart types together and charts that compare two consecutive summary values, but are not limited thereto and may include various combination types of charts.

[0750] FIG. 78 is a drawing disclosing an example of a field mapping screen according to an embodiment.

[0751] In an illustrated example, a field mapping screen (30029) of the present invention may be provided. Here, the field mapping screen (30009) may represent a screen for setting detailed information that matches the selected chart specifications.

[0752] In one embodiment, the field mapping screen (30029) may include data series and axis information according to the selected chart type. Here, the data series may include attributes such as data type, label, and legend for the chart.

[0753] In one embodiment, the field mapping screen (30029) can map fields to the X-axis, Y-axis, and data series by dragging and dropping according to the specified chart specifications.

[0754] Additionally, the field mapping screen (30029) may include visualization details including whether the title is used, the title name, the title location, the title font size, and the drill-down address.

[0755] In one embodiment, visualization setting information can be saved by entering a visualization name in a popup activated by clicking a save button by the user and then clicking the confirmation button.

[0757] FIG. 79 is a flowchart disclosing an example in which a data management method according to an embodiment performs statistical query generation and statistical data visualization.

[0758] In a data management platform that controls at least one engine or module included in a data management software package, user input specifying a query type for a query generation user interface (UI) is obtained (S30301). In one embodiment, user input specifying at least one of a data source, a search period setting, and a query type for a query generation user interface may be obtained. For this, refer to the details described in FIGS. 71 to 75.

[0759] A statistical query is generated to search for statistical data based on a specified query type (S30303). In one embodiment, the query type may include at least one of a first query that extracts a specific number of top data, a second query that extracts data measured according to a time series, and a third query that extracts data according to a field type. For this, refer to the details described in FIGS. 71 to 75.

[0760] Statistical data retrieved based on a statistical query is visualized (S30305). In one embodiment, the type of visualization chart for the retrieved statistical data is determined, and the field type of the statistical data can be mapped to the data series and axis information for the visualization chart. For this, refer to the details described in FIGS. 76 to 78.

[0762] FIG. 80 is a drawing disclosing an example in which a data management platform according to an embodiment performs time window-based correlation analysis.

[0763] In one example, the data management platform (10000) can perform time window-based correlation analysis according to correlation analysis rules. In one embodiment, the data management platform (10000) can perform real-time event correlation analysis in a time window manner through a monitoring module (20005).

[0764] In one embodiment, the monitoring module (20005) can generate correlation analysis rules for the correlation between events and incidents based on user input.

[0765] In one embodiment, the monitoring module (20005) can periodically perform correlation analysis by registering correlation analysis rules with a distributed scheduler.

[0766] In one embodiment, the monitoring module (20005) can retrieve events corresponding to search conditions from the event repository. Subsequently, if there is no correlation analyzer for the correlation analysis rule, the monitoring module (20005) can create a correlation analyzer. If a correlation analyzer exists, the monitoring module (20005) can distribute at least one of the retrieved events and previously generated incidents to the correlation analyzer.

[0767] In one embodiment, the monitoring module (20005) can identify that the events and incidents transmitted through the correlation analyzer are subject to analysis and filter them.

[0768] In one embodiment, the monitoring module (20005) can generate a reference field for each correlation analysis rule and store events by time window and reference field. In one embodiment, at least one event in which the value of the reference field is the same during the corresponding time window can be included in one time window context.

[0769] In one embodiment, the monitoring module (20005) can delete the Time Window Context whose analysis period has expired for each correlation analyzer. At this time, events and incidents included in the Time Window Context are also deleted.

[0770] In one embodiment, the monitoring module (20005) can generate an incident for at least one event included in the time window context based on correlation analysis rules. In one embodiment, the generated incident can be stored in an incident repository. Additionally, the generated incident can be recursively input into each correlation analyzer to generate combinations of correlation analysis rules. Through this, according to the present invention, multi-level correlation analysis can be performed based on combinations of correlation analysis rules.

[0771] In one embodiment, the monitoring module (20005) can store events included in the time window context in memory and in a file-based manner using MapDB.

[0773] FIG. 81 is a drawing disclosing another example in which a data management platform according to an embodiment performs time window-based correlation analysis.

[0774] In the illustrated example, the data management platform (10000) may include a monitoring module (20005). In one embodiment, the monitoring module (20005) may include a correlation analysis rule generation unit (30030), an event collection unit (30031), an incident generation unit (30032), and a service provision unit (30033).

[0775] The correlation analysis rule generation unit (30030) can generate correlation analysis rules based on user input. In one embodiment, the correlation analysis rule may be used to generate a new incident based on at least one of the occurrence count, cumulative count, condition maintenance, occurrence suppression and non-occurrence, occurrence order, and state change, with at least one of the events and incidents during a time window as input. Details regarding the types of each correlation analysis rule are described below.

[0776] In one embodiment, the correlation analysis rule generation unit (30030) can generate a correlation analysis rule according to either a user interface (UI) type or a code type. Here, the UI type may mean that a correlation analysis rule is entered by inputting items according to user input through the user interface. Additionally, the code type may mean that a correlation analysis rule is entered by inputting a script-type code by the user when complex correlation analysis rules are created. In this case, when changing from the UI type to the code type after selecting an item, the selected item may be converted to the code type.

[0777] The event collection unit (30031) can search for events from the event repository according to search conditions. The incident generation unit (30032) can generate incidents for events based on correlation analysis rules. In one embodiment, when correlation analysis is performed, events may be filtered according to operators and conditions. For example, the operators may include various operators such as AND, OR, NOT, IN, ==, !=, <, <=, >, >=, IN, etc.

[0778] In one embodiment, the incident generation unit (30032) can determine whether to generate an incident and save it as an event, and can specify the field value of the incident.

[0779] The service provider (30033) may provide an incident response service based on the incident. In one embodiment, the incident response service may include a service that detects and responds to cyber threats, security breaches, and cyber attacks. In one embodiment, the incident response service may include a service that blocks access to the service in response to unexpected events or unauthorized access.

[0781] FIG. 82 is a drawing disclosing an example of a correlation analysis rule registration screen according to an embodiment.

[0782] In an illustrated example, a correlation analysis rule registration screen (30034) of the present invention may be provided. Here, the correlation analysis rule registration screen (30034) may represent a screen for registering correlation analysis rules.

[0783] In one embodiment, the correlation analysis rule registration screen (30034) may include a rule name, an incident repository, a search filter, a task type, a task cycle, an execution cycle, an initial period, and a delayed processing period. In one embodiment, the correlation analysis rule registration screen (30034) may enable (ON / OFF) whether the correlation analysis is performed in real-time and whether the log is saved.

[0784] Here, the rule name can represent the name of the correlation analysis rule. For example, the rule name can be set to Firewall Session Correlation Analysis. The incident store can represent the store where incidents resulting from the correlation analysis rule are stored. For example, the incident store can be set to incident. The search filter can represent the search query to be used for correlation analysis. For example, the search filter can be set to eventtype:('syslog1' 'syslog2'). The task type can represent cron and seconds. For example, the task type can be set to seconds.

[0785] The task cycle can represent the time to check whether there are tasks within the execution cycle interval to perform correlation analysis, depending on the task type. For example, if the task cycle is set to 60, it can be executed every 60 seconds by checking the time since the last correlation analysis was run and whether there are any tasks within the execution cycle interval that have not been executed within the delay processing period.

[0786] The execution period can indicate the time unit for performing correlation analysis. For example, the execution period can be set to 10 seconds. The initial period can indicate the period for initially running correlation analysis if there is no history of running correlation analysis. For example, the initial period can be set to 5 minutes.

[0787] The delay period can represent the interval between the current time and the events input into the correlation analysis. For example, if the delay period is set to 10 seconds, only events from 10 seconds prior to the current time can be input into the correlation analysis.

[0789] FIG. 83 is a drawing disclosing an example of exceeding the number of times a target field is not used according to an embodiment.

[0790] In the illustrated example, correlation analysis based on count over due to the non-use of the target field can be performed. Here, count over may mean that an incident occurs when the number of times an event with the same value of the reference field occurs is greater than a threshold.

[0791] In one embodiment, the number of times exceeding the limit due to non-use of the target field may be set based on the accumulation time and the number of times. Here, the accumulation time may refer to the time unit for storing the event to be analyzed when performing correlation analysis. Additionally, the number of times may refer to the reference number of times an incident occurs.

[0792] For example, the correlation analysis rule can be configured with the correlation type exceeding the count, the accumulation time being 30 seconds, the count being 100, and the reference field being srcIp. In this case, if a firewall event with the action field being deny and the destination port (dstPort) being 7080 occurs 100 or more times from the same user IP (srcIp), the external attacker IP suspected of a DDoS attack on port 7080 can be identified and a request to block it can be made to the access control system.

[0794] FIG. 84 is a drawing disclosing an example of exceeding the number of times a target field is used according to an embodiment.

[0795] In the illustrated example, correlation analysis based on count over due to the use of the target field can be performed. Here, count over may mean that an incident occurs when the number of times an event with the same value of the reference field occurs is greater than a threshold.

[0796] In one embodiment, the count limit based on the use of the target field may be set based on the accumulation time, the count, and the target field. Here, the accumulation time may refer to the time unit for storing the events to be analyzed when performing correlation analysis. Additionally, the count may refer to the reference count of an incident occurring. Additionally, the target field may refer to the field to be counted when performing correlation analysis. In this case, cases where the values ​​of the target field are identical are not counted.

[0797] For example, a correlation analysis rule can be configured with the correlation type set to exceed the count, the accumulation time to 1 minute, the count to 100, the reference fields to srcIp and dstIp, and the target field to dstPort. In this case, if firewall events with the action field set to deny occur 100 or more times from the same user IP (srcIp) to different destination ports (dstPort), the port scanning victim IP and the attacker IP can be identified, and a blocking request can be sent to the access control system. At this time, by setting the target field to dstPort, events involving multiple accesses to a single port in the case of port scanning can be excluded from accumulation.

[0799] FIG. 85 is a drawing disclosing an example of a inhibition condition according to an embodiment.

[0800] In the illustrated example, correlation analysis based on a suppression condition can be performed. Here, the suppression condition may mean suppressing the occurrence of new incidents for a certain period of time when an incident is caused by an event having the same value as the reference field.

[0801] In one embodiment, the suppression condition may be set based on the suppression time for suppressing the incident. Here, the suppression time may refer to the time for suppressing a new incident after the incident has been generated.

[0802] For example, if the input data is a memory overuse incident, the correlation analysis rule can be set so that the correlation analysis type is suppression condition, the suppression time is 30 minutes, and the reference field is host. In this case, when a memory overuse incident occurs, a memory anomaly incident is triggered, and the memory anomaly incident is prevented from occurring for 30 minutes.

[0804] FIG. 86 is a drawing disclosing an example of non-occurrence detection according to an embodiment.

[0805] In the illustrated example, correlation analysis based on non-occurrence detection can be performed. Here, non-occurrence detection may mean that an incident occurs when an event having the same value as the reference field does not occur for a certain period of time.

[0806] In one embodiment, non-occurrence detection may be set based on the non-occurrence time. Here, the non-occurrence time may refer to a certain period of time during which the corresponding event does not occur.

[0807] For example, if the input data is an agent PING event and the agent is configured to generate one event every 10 seconds, the correlation analysis rule can be set with the correlation type set to non-occurrence detection, the non-occurrence time set to 30 seconds, and the reference field set to host. In this case, if the PING event that should occur every 10 seconds does not occur for 30 seconds or longer, an incident can be generated to determine that there is an anomaly.

[0809] FIG. 87 is a drawing disclosing an example of a continuous condition according to an embodiment.

[0810] In the illustrated example, correlation analysis based on successive conditions can be performed. Here, successive conditions may mean that an incident occurs when specified events occur in sequence within an accumulation time.

[0811] In one embodiment, the continuity condition may be set based on accumulation time and event sequence. Here, accumulation time may refer to a time unit for storing events to be analyzed during execution. Additionally, event sequence may refer to the order in which events occur.

[0812] For example, if the input data consists of an incident of excessive personal information download and a USB storage device usage event, the correlation analysis rule can be set such that the correlation analysis type is continuous, the accumulation time is 30 seconds, the event sequence is excessive personal information download followed by USB storage device usage, and the reference fields are employee ID and user IP. In this case, it is possible to identify internal personal information leakage suspects and the PCs using the USB storage device within 30 seconds after the excessive personal information download.

[0814] In addition, according to the present invention, correlation analysis can be performed according to various types of correlation analysis. In one embodiment, correlation analysis based on sum over can be performed. Here, sum over may mean that an incident is generated when the cumulative value of the target field of an event having the same value as the reference field exceeds a threshold value.

[0815] In one embodiment, the cumulative exceedance may be set based on the accumulation time, the cumulative exceedance criterion, and the target field. Here, the accumulation time may refer to a time unit for storing the event to be analyzed when performing correlation analysis. Additionally, the cumulative exceedance criterion may refer to a standard cumulative value that triggers an incident. Additionally, the target field may refer to a field to accumulate the value for performing correlation analysis.

[0816] For example, if the input data is a DRM event, the correlation analysis rule can be set so that the correlation type is cumulative exceedance, the duration is 24 hours, the cumulative exceedance threshold is 100,000, the target field is the number of DRM unlocks, and the threshold field is the employee ID. In this case, notifications can be received for employees who are suspected of being APT attackers leaking internal personal information and whose number of unlocks within 24 hours is 100,000 or more per employee ID.

[0818] In addition, according to the present invention, correlation analysis based on condition sustainment can be performed. Here, condition sustainment may mean that an incident occurs when an event having the same value as a reference field satisfies a specific condition for a certain period of time.

[0819] In one embodiment, condition maintenance may be set based on a maintenance time and specific conditions. Here, the maintenance time may refer to the maintenance time of the specific condition in which the incident occurs. Additionally, the specific conditions may refer to various conditions for the corresponding field.

[0820] For example, if the input data is an agent memory measurement event, the correlation analysis rule can be set so that the correlation type is condition maintenance, the maintenance time is 10 minutes, the condition is usage is greater than or equal to 0.9, and the criterion field is set to host. In this case, you can identify equipment that maintains a memory usage of 90 percent or more for 10 minutes.

[0822] In addition, according to the present invention, correlation analysis based on state change detection can be performed. In one embodiment, state change detection can be set based on accumulation time, change detection conditions, target field, and reference field.

[0823] For example, if the input data is an entry / exit gate usage event, the correlation analysis rule can be set such that the correlation analysis type is state change detection, the accumulation time is 1 minute, the change detection condition is IN to IN, OUT to OUT, the target field is the entry / exit direction, and the reference field is the employee number. In this case, if the same entry card is tagged twice in the same direction at the entry / exit gate, it can be recognized as fraudulent use.

[0825] FIG. 88 is a flowchart disclosing an example in which a data management method according to an embodiment performs time window-based correlation analysis.

[0826] In a data management platform that controls at least one engine or module included in a data management software package, an event is searched (S30401). In one embodiment, an event corresponding to a search condition set by a user can be retrieved. For this, refer to the details described in FIGS. 80 and FIGS. 81.

[0827] An incident regarding the event during a time window is generated based on at least one predefined correlation analysis rule (S30403). In one embodiment, at least one predefined correlation analysis rule may be determined based on at least one of the occurrence count, cumulative count, condition maintenance, occurrence suppression and non-occurrence, occurrence order, and state change of at least one of the events and incidents during the time window.

[0828] In one embodiment, prior to step S30403, events for time intervals other than the time window can be filtered. In one embodiment, at least one reference field for each correlation analysis rule for an event is created, and events where the value of the reference field is the same during the time window are created as a Time Window Context, and an incident can be generated by performing correlation analysis on the Time Window Context based on at least one predefined correlation analysis rule. For this, refer to the details described in FIGS. 82 to 87.

[0829] An incident response service is provided based on the generated incident (S30405). In one embodiment, the incident response service may include a service for cyber security and operational state restoration. For this, refer to the details described in FIGS. 80 and FIGS. 81.

[0831] FIG. 89 is a drawing disclosing an example in which a data management platform according to an embodiment performs a log data search based on a user type.

[0832] In the illustrated example, the data management platform (10000) can perform log data search according to user type. In one embodiment, the data management platform (10000) provides a search UI (user interface) according to user type through a monitoring module (20005) and can perform log data search using query search and general search.

[0833] In one embodiment, the monitoring module (20005) may include a search condition acquisition unit (30035), a log search unit (30036), and a search result providing unit (30037).

[0834] The search condition acquisition unit (30035) can acquire search conditions based on user input. In one embodiment, a search condition setting screen can be activated in a popup format through an event log search screen. In this case, search conditions can be set based on user input for the corresponding search condition setting screen.

[0835] In one embodiment, after search conditions are entered, the search conditions may be applied to the event log search screen when the user clicks the apply button on the search condition setting screen. Subsequently, a search of log data may be initiated based on the user's input regarding a search request (e.g., clicking a play icon). In one embodiment, when the user clicks the search start button on the search condition setting screen, the search request may be executed immediately after the search conditions are applied. Thus, according to the present invention, a general user can easily perform a simple search through the UI without knowing the search query.

[0836] In one embodiment, when a user clicks the query generation button on the search condition setting screen, a search query based on the search conditions can be generated. As such, according to the present invention, an advanced user can perform a search with complex conditions using the search query.

[0837] The log search unit (30036) can search for log data based on search conditions. In one embodiment, the log search unit (30036) can search for log data based on a search query. Details regarding this are described below.

[0838] The search result providing unit (30037) can provide search results according to the user type. In one embodiment, the search result providing unit (30037) can display the search results in a scrolling form in a general user view when receiving search results for a search request.

[0839] In one embodiment, the search result providing unit (30037) can switch from a general user view to an advanced user view. In this case, the advanced user view can be displayed in a pagination manner.

[0840] In one embodiment, the search result providing unit (30037) may selectively display only the fields selected by the user through the fields of interest and selection fields in the advanced user view. Additionally, the search result providing unit (30037) may display field-specific search data statistics through user input regarding the field values ​​(e.g., numbers) of the fields of interest and selection fields. Details regarding this are described below.

[0841] According to the present invention, query-based and UI-based search can be provided simultaneously on a single screen, and UI-based search keywords can be linked with search queries.

[0842] In addition, according to the present invention, the UI can be customized according to the user's system usage pattern.

[0844] FIG. 90 is a drawing disclosing an example of a search condition setting screen according to an embodiment.

[0845] In an illustrated example, a search condition setting screen (30039) of the present invention may be provided. Here, the search condition setting screen (30039) may represent a screen for setting search conditions for searching log data. In one embodiment, the search condition setting screen (30039) may be activated in a popup form through an event log search screen (30038).

[0846] In one embodiment, the search condition setting screen (30039) may include a search period, an event type, and search conditions. Here, the search conditions display event field information included in the event type selected by the user. For example, it may include an event type, a host, an original length, and an equipment ID.

[0847] In one embodiment, frequently used events can be selected from the entire event list by user and managed as frequently used event types. For example, event types such as AGENT, DB, and SYSLOG can be displayed as frequently used event types. In one embodiment, the user can add the corresponding event to the event types by clicking on each event type included in the event type list.

[0848] In one embodiment, after setting search conditions, if user input for starting a search is obtained, the search conditions can be applied and the search of log data can proceed through a search request.

[0849] In one embodiment, after setting search conditions, if user input for application is obtained, the search conditions entered by the user may be set and displayed on the event log search screen (30038). Further details regarding this are described below.

[0850] In one embodiment, after setting search conditions, if user input for query generation is obtained, the search conditions may be generated in the form of a search query and displayed on the event log search screen (30038). Further details regarding this are described below.

[0852] FIG. 91 is a drawing disclosing an example of a search condition UI according to an embodiment.

[0853] In the illustrated example, the search condition UI (30040) of the present invention may be provided through an event log search screen. In one embodiment, when user input for application is obtained after the search condition is set, the search condition entered by the user may be set and displayed on the event log search screen (30038). That is, the search condition is displayed in the form of a search condition UI (30040), allowing the user to easily check the search condition.

[0854] In one embodiment, only the corresponding search condition may be selectively deleted based on the user's deletion input for at least one search condition UI (30040).

[0855] In one embodiment, a search request corresponding to the search condition UI (30040) may be performed through user input to the play icon. A search of log data may be performed in accordance with the search request. However, the shape and arrangement of the icon requesting the search may be implemented in various ways and are not limited thereto.

[0857] FIG. 92 is a drawing disclosing an example of a search query according to an embodiment.

[0858] In the illustrated example, the search query (30041) of the present invention may be provided through an event log search screen. In one embodiment, after setting search conditions, if user input for query generation is obtained, the corresponding search conditions may be generated in the form of a search query (30041) and displayed on the event log search screen (30038).

[0859] In one embodiment, the search query (30041) may be generated in the form of a code corresponding to the search conditions. For example, the search period is expressed as time:['2024-01-10T00:00:00'~'2024-01-11T00:00:00'}, the event type as eventtype:'SYSLOG', and the host as host:'10.0.2.7', and each search condition item may be combined with an AND operator.

[0860] In one embodiment, the code of the search query (30041) can be modified according to user input, thereby allowing advanced users to set complex search conditions.

[0861] In one embodiment, a search request corresponding to a search query (30041) may be performed through user input to a play icon. A search of log data may be performed in accordance with the search request. However, the shape and arrangement of the icon requesting the search may be implemented in various ways and are not limited thereto.

[0863] FIG. 93 is a drawing disclosing an example of a general search result display area according to an embodiment.

[0864] In the illustrated example, the general search result display area (30042) of the present invention may be provided through an event log search screen.

[0865] In one embodiment, the general search result display area (30042) may include a search result lookup in a general user view. In this case, the log data included in the search results may be displayed separated by at least one field. For example, if the search condition is that the event type is SYSLOG and the host is 10.0.2.7, log data with the event type being SYSLOG and the host being 10.0.2.7 is searched, and the log data may be displayed separated by fields such as the time of occurrence, event type, host, source length, equipment ID, and source log.

[0866] In this way, according to the present invention, through the general user view, general users can easily identify log data by separating it by column.

[0868] FIG. 94 is a drawing disclosing an example of a search option setting screen according to an embodiment.

[0869] In the illustrated example, the search option setting screen (30043) of the present invention may be provided. In one embodiment, the search option setting screen (30043) may be activated in the form of a popup through the event log search screen.

[0870] In one embodiment, the search option setting screen (30043) may include an event inclusion activation setting, a high-speed search setting, an advanced user view switching setting, an old version search activation setting, and a search result limit setting. In this case, the advanced user view switching setting may mean a search option that switches from a general user view to an advanced user view.

[0871] When the Advanced User View is enabled (ON) by user input, the general search results display area of ​​the event log search screen may switch to the advanced search results display area. Further details regarding this are explained below.

[0873] FIG. 95 is a drawing disclosing an example of an advanced search result display area according to an embodiment.

[0874] In the illustrated example, the advanced search result display area of ​​the present invention may be provided through an event log search screen. Here, the advanced search result display area may include a field setting area (30044) and a search result display area (30045).

[0875] The field setting area (30044) may include field search, selection field, and field of interest. Here, field search may refer to an area where the user directly enters a field name to search. Field of interest may include multiple fields included in the log data. In this case, the field found through field search may be added as a field of interest.

[0876] The selection field may include at least one field selected by the user among a plurality of fields included in the field of interest. In this case, at least one field included in the selection field may be added to the search result display area (30045).

[0877] The search result display area (30045) can display search results of log data corresponding to the selected fields. For example, if the selected fields include device_ip and event type, the search result display area (30045) can display log data for the device_ip and event type fields.

[0878] For example, if the search condition is that the event type is SYSLOG, the host is 10.0.2.7, and the selected fields include device_ip and event type, log data with event type SYSLOG and host 10.0.2.7 is searched, and the log data can be displayed separated by user-selected fields such as time of occurrence, device_ip, event type, and source log.

[0879] In one embodiment, a statistical data display screen (30046) for each field of the field setting area (30044) may be activated in the form of a popup. In one embodiment, the statistical data display screen (30046) may display statistical figures for the top rankings based on the number of types of selected field values.

[0881] FIG. 96 is a flowchart disclosing an example in which a data management method according to an embodiment performs a log data search based on a user type.

[0882] In a data management platform that controls at least one engine or module included in a data management software package, search conditions based on user input are obtained (S30501). In one embodiment, the search conditions may include at least one of a search period, an event type, a host, an original length, and an equipment ID. For this, refer to the details described in FIGS. 89 and 90.

[0883] Log data is searched based on search conditions (S30503). In one embodiment, a search query corresponding to the search conditions is generated, and log data based on the search query can be searched. For this, refer to the details described in FIGS. 91 and 92.

[0884] Search results are provided according to the user type (S30505). In one embodiment, if the user type is a general user type, search results including log data separated by at least one field may be provided. In one embodiment, if the user type is an advanced user type, at least one of search results corresponding to a selected field chosen by user input among a plurality of fields of interest in the log data and statistical data regarding the selected field and the field of interest may be provided. For this, refer to the details described in FIGS. 93 to 95. Explanation of the symbols

[0886] 10000: Data Management Platform< / replacegroupname>

Claims

Claim 1 A data management method comprising: a step of obtaining a search condition based on user input in a data management platform that controls at least one engine or module included in a data management software package; a step of generating a search query in the form of a code for the search condition and displaying it on an event log search screen when user input for generating a query corresponding to the search condition is obtained; a step of changing the code based on user input for the code of the search query displayed on the event log search screen; a step of searching for log data based on a search query including the changed code; and a step of providing a search result for the log data according to a user type. Claim 2 A data management method according to claim 1, wherein the searching step comprises: a step of generating a search query corresponding to the search condition; and a step of searching for log data based on the search query. Claim 3 A data management method according to claim 1, wherein the step of providing includes, when the user type is a general user type, the step of providing a search result including the log data separated by at least one field. Claim 4 A data management method according to claim 1, wherein the step of providing comprises, when the user type is an advanced user type, providing at least one of a search result corresponding to a selection field selected by user input among a plurality of interest fields of the log data and statistical data for the selection field and the interest field. Claim 5 A data management device comprising: a database for storing data; and a processor for processing said data, wherein the processor, in a data management platform that controls at least one engine or module included in a data management software package, obtains a search condition based on user input, and when user input for generating a query corresponding to said search condition is obtained, generates a search query in the form of a code for said search condition and displays it on an event log search screen, changes said code according to user input regarding the code of the search query displayed on said event log search screen, searches for log data based on a search query including said changed code, and provides a search result for said log data according to a user type. Claim 6 In claim 5, the processor generates a search query corresponding to the search condition and searches for log data based on the search query, a data management device. Claim 7 In claim 5, the processor is a data management device that provides a search result including the log data separated by at least one field when the user type is a general user type. Claim 8 In claim 5, the processor provides at least one of a search result corresponding to a selection field selected by user input among a plurality of interest fields of the log data and statistical data for the selection field and the interest field, when the user type is an advanced user type. Claim 9 A computer-readable storage medium storing a data management program that performs the steps of: obtaining a search condition based on user input in a data management platform that controls at least one engine or module included in a data management software package; when user input for generating a query corresponding to the search condition is obtained, generating a search query in the form of a code for the search condition and displaying it on an event log search screen; changing the code based on user input regarding the code of the search query displayed on the event log search screen; searching for log data based on a search query including the changed code; and providing a search result for the log data according to a user type.

Images