KR101282297B1 - The apparatus and method of unity security with transaction pattern analysis and monitoring in network - Google Patents

Abstract

PURPOSE: Service network type integrated security device and method thereof through transaction pattern analysis·monitoring are provided to firstly perform control through compulsory blockage and security path with respect to hacker intrusion and abnormal traffic in a network and to secondarily perform compulsory blockage and security filtering access of web server, web application server, general application server and database management system (DBMS). CONSTITUTION: A security management server SMS (300) is connected to N security pattern modules (SPMs) having a mass network environment base and N agent modules (AMs). The SMS receives normal event, abnormal event and pattern analysis result data and analyzes them. The SMS detects hacker intrusion and traffic abnormality. The SMS sets up defense correspondence element for the detected hacker intrusion and traffic abnormality. The SMS outputs a security filtering mode to the N SPMs. [Reference numerals] (100) Agent module; (300) Security management server; (AA) Web server; (BB,GG) Response policy; (CC) Access / edge network; (DD) Subscriber network; (EE,FF) Emergency sign and invasion alert; (HH) Smartphone application server

Description

Service network integrated security device and method through transaction pattern analysis and monitoring {THE APPARATUS AND METHOD OF UNITY SECURITY WITH TRANSACTION PATTERN ANALYSIS AND MONITORING IN NETWORK}

According to the present invention, whether a request for a service that meets the purpose of the service is performed through an effective pattern analysis on a large number of transactions requested by clients different from the conventional method of simply detecting or blocking a network path for existing security violations of existing clients. The present invention relates to a service network-type integrated security device and method through transaction pattern analysis and monitoring to prevent malicious attempts and to effectively operate malicious requests by making judgment criteria.

Recently, the trend of many security accidents is the leakage of customer information aimed at financial gain by hacking through the web system.These accidents mostly show various and vast data in addition to customer information, product information, etc. in DBMS through web server. Aim.

1 is a block diagram of a conventional security system, which allows a plurality of users (1. client) and malicious terminals (2. hackers) to access SEVER and DBMS (5, 6) through a communication network (3. network). In order to manage the access information for the SEVER and DBMS (5, 6) as a log, a security server or a firewall (4) is configured.

These security configurations provide various security functions such as storing the control and usage as a log and setting access policies for each user so that only users authorized by the administrator can access SEVER and DBMS (5, 6).

However, security policies continue to occur even after these policies and security devices are in place.

In other words, the existing security devices can be easily hacked by vulnerabilities of the program itself, and the security flaws are uploaded because harmful packets or hacking modules are uploaded to various new organic smartphone applications and general application servers. As it is being exposed, real-time security defense was difficult.

In addition, since the web server, web application server, general application server, and DBMS (Database Management System) are separated from each other, there is no device that can be managed as one on the network. And it is difficult to know where the abnormal traffic phenomenon occurred, there was a problem that the security filtering consisting of forced blocking and security patch is difficult.

Domestic Patent Publication No. 10-0958250 (announced May 17, 2010)

In order to solve the above problems, the present invention can protect against hacker intrusion using contradiction points for various applications, and based on an agent module connected to a web server, a web application server, a general application server, and a DBMS (Database Management System). The security pattern module and the security management server can form a large-scale service management network, can be applied to all servers, and integrated security management can be performed based on the security management server to collect network traffic information and patterns. It can provide statistical analysis and security patch recommendation through analysis, 128-bit encryption of all data, and above all, pre-control on network through forced blocking and security patch against hacker intrusion and abnormal traffic phenomenon. Secondly, web server, web application server, general application server, DBMS (Database Management Sys) Its purpose is to provide a service network-type integrated security device and method through transaction pattern analysis and monitoring that can forcibly block and secure the access of the system.

Service network-type integrated security device through the transaction pattern analysis and monitoring according to the present invention to achieve the above object

It is installed in web server, web application server, general application server, DBMS (Database Management System), and security pattern module respectively to filter packets while monitoring the status of web server, web application server, general application server, DBMS, and security pattern module. Agent module (AM) that records normal events related to login, resource usage data, traffic flow data, abnormal events related to hacker intrusion, virus intrusion, and sends them directly to the security management server. and,

Web server, web application server, general application server, DBMS connected to form a network, network-formed web server, web application server, general application server, URL requested by the client to access the DBMS, parameter name entered in the URL, After collecting the value and the pattern of the data type, it compares and analyzes with the existing collected pattern, transmits the pattern analysis result data to the security management server, and transmits the data from the security management server (SMS). Security Pattern Module (SPM) to protect in real time on network through forced blocking and security patch against hacker intrusion and traffic abnormality detected in large network environment based on security filtering mode,

After being connected to N security pattern modules (SPM) and N agent modules (AM) having a large network environment base, the normal event, abnormal event, and pattern analysis result data are received and analyzed, This is achieved by configuring a security management server (SMS) that detects hacker intrusions and traffic anomalies, sets up defense response elements, and outputs the security filtering mode to N security pattern modules.

In addition, the service network-type integrated security method through the transaction pattern analysis and monitoring according to the present invention

Installing the agent module in any one of a web server, a web application server, a general application server, a DBMS (Database Management System), a security pattern module (S100),

Filtering the packet while monitoring the status of the web server, the web application server, the general application server, the DBMS, and the security pattern module through the agent module (S200);

Logging through the agent module, the normal event regarding the resource usage status data, traffic flow data, and abnormal events related to hacker intrusion, virus infiltration, and then directly transmitted to the security management server (S300),

Connecting to a web server, a web application server, a general application server, and a DBMS through a security pattern module to form a network (S400);

Accessing a web server, a web application server, a general application server, and a DBMS formed through a security pattern module to collect URLs requested by the client, parameter names, values, and patterns of data types in the URL (S500). Wow,

Comparing and analyzing the existing collected pattern through the security pattern module, and transmitting the pattern analysis result data to the security management server (S600),

The security management server is connected with N security pattern modules (SPM) and N agent modules (AM) that have a large network environment base, and receives normal event, abnormal event, and pattern analysis result data. After analyzing, detecting the hacker intrusion and traffic abnormality (S700),

Outputting, to the N security pattern modules, the security filtering mode in which forced blocking and security patches are set as defense countermeasures against hacker intrusion and traffic abnormality analyzed through the security filtering mode output unit of the security management server (S800);

Based on the security filtering mode delivered from the Security Management Server (SMS) in the security pattern module, a step for defending in real time on the network through forced blocking and security patch against hacker intrusion and traffic anomaly detected in a large network environment It is achieved by (S900).

As described above, the present invention can provide a real-time security defense mode 1: 1 for many applications and webs other than a variety of organic new smartphone applications, forced blocking and security patch against hacker intrusion and abnormal traffic phenomenon Through pre-controlling on the network through the network, and secondly forcibly blocking and securing the access of the web server, web application server, smartphone application server, and DBMS (Database Management System), integrated security services can be provided. That has a good effect.

1 is a block diagram of a conventional security system,
2 is a block diagram showing the components of a service network type integrated security device 1 through transaction pattern analysis and monitoring according to the present invention;
3 is a block diagram showing the components of a service network type integrated security device 1 through transaction pattern analysis and monitoring according to the present invention;
4 is a block diagram showing the components of an agent module according to the present invention;
5 is a block diagram showing the components of the security pattern module according to the present invention;
6 is a block diagram showing the components of the security management server according to the present invention;
7 is a block diagram showing the components of the monitoring unit according to the present invention;
8 is a security pattern module is connected to the N agent module (AM: Agent Module) of the authorized IP band and the N agent module (AM: Agent Module) of the internal IP band according to the present invention, security management to the security pattern module In one embodiment, the server is connected to form a large network,
9 is a flowchart illustrating a service network-type integrated security method through transaction pattern analysis and monitoring according to the present invention.

First, a transaction, a web server, a web application server, a general application server, and a database management system (DBMS) described in the present invention will be described.

The transaction refers to a process that is normally processed so that both sides of the transaction can obtain desired results in the transaction.

The web server is a device for providing a file containing a web page to users, the agent module according to the present invention is installed.

The web application server (WAS) is middleware for executing an application to a user computer or a device through HTTP on the Internet, and an agent module according to the present invention is installed.

The app server is composed of http and tcp / udp communication as a server for providing an enterprise enterprise application integration (EAI) system and a smartphone application service, the agent module is installed in accordance with the present invention.

The DBMS (Database Management System) is a device that allows a large number of computer users to quickly and easily add, modify, and delete a large number of data contained in a computer, and an agent module according to the present invention is installed.

In addition, the agent module according to the present invention is delivered to the server analyzing the traffic of the monitoring server as a mirroring port configuration of the server to be monitored and installed in the server.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

2 is a block diagram showing the components of the service network-type integrated security device 1 through the transaction pattern analysis and monitoring according to the present invention, Figure 3 is a service through the transaction pattern analysis and monitoring according to the present invention The configuration diagram showing the components of the network-type integrated security device 1, which is an agent module (AM) (100), a security pattern module (SPM) (200), a security management server (SMS: Security Management Server) (300).

First, the agent module (AM) 100 according to the present invention will be described.

The agent module (AM) 100 is installed in a web server, a web application server, a general application server, a database management system (DBMS), a security pattern module, respectively, a web server, a web application server, a general application server, After filtering the packet while monitoring the status of DBMS and security pattern module, it records the normal events related to the login, resource usage data and traffic flow data generated during monitoring, and abnormal events related to hacker intrusion and virus intrusion, and then manages the security. It is used to send directly to the server.

As shown in FIG. 4, the packet filtering unit 110, the intrusion detection unit 120, the access control unit 130, the traffic metering unit 140, and the log unit 150 are configured.

The packet filtering unit 110 classifies network packets and removes and passes packets through a filtering mode.

Here, the filtering mode is a mode for filtering only harmful packets while setting a threshold for the packet.

The intrusion detection unit 120 detects an attack on the packets classified by the packet filtering unit.

When the client accesses the object, the access control unit 130 determines whether to permit authentication according to the role of the client.

The traffic metering unit 140 collects statistical information about network traffic.

The log unit 150 records a normal event related to the login, resource usage data, and traffic flow data transmitted from the traffic metering unit, and an abnormal event related to hacker intrusion and virus intrusion.

At this time, all data related to the normal event and the abnormal event recorded in the log unit are 128-bit encrypted by the first encryption processing unit.

In addition, the agent module (AM: Agent Module) according to the present invention is configured to include a backup execution stop unit because a hacker can invade and attack through a backup file when a backup file is generated by an application developer.

The backup execution stop part plays a role of stopping the backup execution, which is configured to block an executable file attack such as a shell by applying file upload / download security other than the file type (administrator selection) of file upload / download.

Next, a security pattern module (SPM) 200 according to the present invention will be described.

The security pattern module (SPM) 200 is connected to a web server, a web application server, a general application server, a DBMS to form a network, a networked web server, a web application server, a general application server, a DBMS Accesses and collects the URL requested by the client, the parameter name, the value, and the pattern of the data type in the URL, and compares and analyzes the existing collected pattern with the pattern analysis result data to the security management server. Based on the security filtering mode delivered from the security management server (SMS), it protects the network in real time on the network through forced blocking and security patch against hacker intrusion and traffic anomaly detected in a large network environment. .

5, the first network security manager 210, the pattern collector 220, the pre-checker 230, the pattern analyzer 240, the data transmitter 250, and the security command receiver 260. ), And the security filter unit 270.

The first network security management unit 210 is connected to a web server, a web application server, a general application server, a DBMS, a security management server (SMS) to form a service network, and generate harmful packets and alarm data flowing through the network. It plays a role.

The pattern collecting unit 220 is accessed with a web server, a web application server, a general application server, a DBMS formed in a network through a first network security management unit, a URL requested by a client, a parameter name, a value, and It collects patterns about data types.

At this time, the URL collected by the pattern collecting unit, the parameter name, the value, and the data type pattern included in the URL are 128-bit encrypted by the second encryption processing unit.

Hereinafter, a detailed operation process of the pattern collecting unit will be described.

In one example, the URI requested by the client is the same as the first embodiment.

http://test.com/member/login.jsp?userid=admin&passwd=test

The specific URI test.com/member/lonin.jsp above, followed by two parameter values userid and passwd, and each value data type in text are stored in the pattern.

Whenever normal users enter various parameter values into the URI, each pattern information is modified and secured.

The pre-check unit 230 checks a portion of the pattern collected in the pattern collecting unit that is a problem with the basic security pattern of the security module to pre-check.

The pattern analyzer 240 analyzes the normal pattern and the abnormal pattern after comparing the pattern currently collected by the pattern collector and the previously collected pattern.

 The pattern for the login.jsp request so far described in Example 1 has two parameter values and a corresponding value in text form.

In the same URI, the outgoing file name and the number of parameters may be wrong as in Example 2 below.

http://test.com/member/login.jsp?userid=admin&passwd=test&jumin=111111

http://test.com/member/login.jsp.bak?userid=admin2222&passwd=test&

http://test.com/member/login.jsp?userid=admin&passwd=!Canadatest&

If it is different from the existing collected pattern for the request URI as in the second embodiment, the respective contents are transmitted to the security management server through the data transmitter to directly notify the manager and the person in charge of the operation, determine the suitability of the request part, and Determine whether to block the part or register it in a new pattern.

In addition, the pattern analysis unit according to the present invention is configured to automatically update, delete, and add the pattern of incoming data after periodically analyzing the pattern of incoming data from the moment of applying the security filter unit, rather than simply comparing the patterns.

The data transmitter 250 transmits the pattern analysis result data analyzed by the pattern analyzer to the security management server.

The security command receiving unit 260 serves to receive a security filtering mode transmitted from a security management server (SMS).

The security filter unit 270 acts to defend in real time on the network through forced blocking and security patch against hacker intrusion and traffic abnormality detected in a large network environment based on the security filtering mode received from the security command receiver.

It is cross site scripting function, injection vulnerability support function, malicious file execution function, cross site request forgery function, information leakage and inappropriate error handling function, weak authentication and session management function, URI access control function, download / upload file management function, system The processing function for the / DB command is configured.

Next, a security management server (SMS) 300 according to the present invention will be described.

The security management server (SMS) 300 is connected to N security pattern modules (SPM) and N agent modules (AM: Agent Module) having a large network environment base, and is a normal event. After receiving and analyzing abnormal event and pattern analysis result data, it detects hacker intrusion and traffic anomaly, and sets defense response elements to manage security output mode by N security pattern modules. do.

As shown in FIG. 6, the second network security management unit 310, the monitoring unit 320, the trend / log analysis unit 330, and the security filtering mode output unit 340 are configured.

The second network security management unit 310 connects N security pattern modules (SPMs) and N agent modules (AMs), web servers, web application servers, general application servers, DBMSs, and network networks. It forms a threshold for the pattern, and generates an alarm signal for the harmful packets flowing into the network first and forcibly blocks them.

The monitoring unit 320 accesses a web server, a web application server, a general application server, a DBMS, a security pattern module connected to a network through a second network security management unit, a web server, a web application server, a general application server, a DBMS It monitors the status of the security pattern module.

As shown in FIG. 7, the SQL monitoring unit 321, a report builder 322, and a communication protocol monitoring unit 323 are configured.

The SQL monitoring unit 321 serves to monitor the real-time list and details of the SQL accessed by the DBMS.

The report builder 322 serves to generate a report while changing a search condition for each DB, host, and security viewpoint.

The communication protocol monitoring unit 323 serves to monitor the web server, the web application server, the general application server, the client connected to the DBMS, Telnet, FTP, RCmd logs in real time while changing the search conditions.

The trend / log analysis unit 330 may include a session count, a transaction usage process, and a return row of normal event, abnormal event, and pattern analysis result data transmitted through the second network security management unit. After the first analysis with the trend graph of), it analyzes whether the hacker invasion and the traffic abnormality are secondary through the log analyzer.

It consists of a trend analyzer and a log analyzer.

The trend analyzer is divided into a session count, a transaction usage process, and a return row based on normal events, abnormal events, and pattern analysis result data transmitted through the second network security management unit. The trend graph is used to analyze how the trend line is changed from the reference set value or when an abnormal change occurs.

The log analyzer plays a role of determining whether hackers invade and traffic anomaly through visitor information through analysis of website visitors, visitor information through page views, and cookie value analysis.

The security filtering mode output unit 340 outputs, to N security pattern modules, a security filtering mode in which forced blocking and security patches are set as defense countermeasures against hacker intrusion and traffic abnormality analyzed by the trend / log analysis unit. Play a role.

Here, the security filtering mode is 128-bit encryption processing by the third encryption processing unit.

The security management server (SMS) according to the present invention is configured by being connected to N security pattern modules (SPM) and N agent modules (AM: Agent Module) having a large network environment base. Current status of request statistics by each service, total error status and detailed error contents, status and contents inappropriate to security pattern module, status and contents detected by security pattern module, status of web server, web application server, general application server, DBMS And resource status of the monitoring, web server, web application server, general application server, and DBMS.

In addition, as shown in Figure 8, the security pattern module is connected to N agent modules (AM: Agent Module) of the public IP band and N agent modules (AM: Agent Module) of the internal IP band, the security pattern module Security management server is connected to form a large network.

Hereinafter, a detailed operation process of the network-type integrated security method through transaction pattern analysis and monitoring according to the present invention will be described.

First, the agent module is installed in a web server, a web application server, a general application server, a DBMS (Database Management System), and a security pattern module (S100).

Next, the packet is filtered while monitoring the status of the web server, web application server, general application server, DBMS, security pattern module through the agent module (S200).

Next, after logging the normal event, the hacker intrusion, the virus intrusion abnormal event about the login, resource usage status data, traffic flow data through the agent module, and transmits directly to the security management server (S300).

Next, through the security pattern module is connected to the web server, web application server, general application server, DBMS to form a network (S400).

Next, a network pattern web server, a web application server, a general application server, and a DBMS are accessed through a security pattern module to collect a URL requested by a client, a parameter name, a value, and a data type in the URL ( S500).

Next, a comparative analysis with the existing collected pattern through the security pattern module, and transmits the pattern analysis result data to the security management server (S600).

Next, the security management server is connected to N security pattern modules (SPM) and N agent modules (AM) having a large network environment base, and includes normal event, abnormal event, and pattern analysis result data. After receiving and analyzing the hacker intrusion and traffic abnormality detection (S700).

In this case, the normal event, abnormal event, and pattern analysis result data are received and analyzed through the trend / log analysis unit to analyze the normal event, abnormal event, and pattern analysis result data in session count, transaction usage process, After the first analysis with the trend graph about the return row, it is the second analysis of hacker intrusion and traffic abnormality through the log analyzer.

Next, in response to the hacker intrusion and traffic abnormality analyzed through the security filtering mode output unit of the security management server, the security filtering mode in which forced blocking and security patches are set as defense countermeasures is output to N security pattern modules (S800). .

Finally, based on the security filtering mode delivered from the Security Management Server (SMS) in the security pattern module, the hacker intrusion and traffic anomaly detected in a large network environment are executed in real time on the network through forced blocking and security patch. Defend (S900).

100: agent module 110: packet filtering unit
120: intrusion detection unit 130: access control unit
140: traffic metering unit 150: log unit
200: security pattern module 210: first network security management unit
220: pattern collecting unit 230: pre-checking unit
240: pattern analysis unit 250: data transmission unit
260: security command receiving unit 270: security filter unit
300: security management server

Claims (8)

It is installed in web server, web application server, general application server, DBMS (Database Management System), and security pattern module respectively to filter packets while monitoring the status of web server, web application server, general application server, DBMS, and security pattern module. Agent module (AM) that records normal events related to login, resource usage data, traffic flow data, abnormal events related to hacker intrusion, virus intrusion, and sends them directly to the security management server. 100,
Web server, web application server, general application server, DBMS connected to form a network, network-formed web server, web application server, general application server, URL requested by the client to access the DBMS, parameter name entered in the URL, After collecting the value and the pattern of the data type, it compares and analyzes with the existing collected pattern, transmits the pattern analysis result data to the security management server, and transmits the data from the security management server (SMS). Security Pattern Module (SPM) (200) to defend in real time on the network through forced blocking and security patch against hacker intrusion and traffic anomaly detected in a large network environment based on the security filtering mode,
After being connected to N security pattern modules (SPM) and N agent modules (AM) having a large network environment base, the normal event, abnormal event, and pattern analysis result data are received and analyzed, It consists of a Security Management Server (SMS) 300 that detects hacker intrusions and traffic anomalies, and manages to output security filtering modes with N security pattern modules by setting defense response elements. Service network type integrated security device through transaction pattern analysis and monitoring.
The method of claim 1, wherein the agent module (AM) (100)
A packet filtering unit 110 for classifying network packets and removing and passing the packets through a filtering mode;
Intrusion detection unit 120 for detecting whether or not to attack the packet classified by the packet filtering unit,
When the client accesses the object, the access control unit 130 to determine whether or not the authentication permission according to the role of the client,
A traffic metering unit 140 for collecting statistical information on network traffic;
Transaction pattern analysis, comprising: a log unit 150 for recording a normal event related to login, resource usage data, and traffic flow data transmitted from the traffic metering unit, and an abnormal event related to hacker intrusion and virus intrusion. Service network type integrated security device through monitoring.

The method of claim 1, wherein the agent module (AM: Agent Module)
Service network-type integrated security device through the transaction pattern analysis and monitoring, characterized in that it comprises a backup execution stop unit for stopping the backup execution.
The method of claim 1, wherein the security pattern module (SPM) (200)
A first network security management unit 210 connected to a web server, a web application server, a general application server, a DBMS, and a security management server (SMS) to form a service network network and generate harmful packets and alarm data flowing through the network network; ,
The first network security management unit collects a URL related to a web server, a web application server, a general application server, and a DBMS formed through a network, the URL requested by a client, and the parameter names, values, and data types included in the URL. Pattern collecting unit 220 and
A pre-check unit 230 for checking a portion of the patterns collected in the pattern collecting unit that is problematic for the basic security pattern of the security module;
A pattern analyzer 240 for comparing the patterns currently collected by the pattern collector and previously collected patterns, and analyzing normal and abnormal patterns;
A data transmitter 250 for transmitting the pattern analysis result data analyzed by the pattern analysis unit to the security management server;
A security command receiver 260 receiving a security filtering mode transmitted from a security management server (SMS);
Based on the security filtering mode received from the security command receiving unit, the security filter unit 270 that protects in real time on the network through forced blocking and security patch against hacker intrusion and traffic abnormality detected in a large network environment Service network type integrated security device through transaction pattern analysis and monitoring.
The method of claim 1, wherein the Security Management Server (SMS) 300
Form N security pattern module (SPM) and N agent module (AM), web server, web application server, general application server, DBMS and network, and set the threshold for pattern A second network security management unit 310 which first generates an alarm signal for the harmful packet and excessive traffic flowing into the network and forcibly blocks it;
Access to the web server, web application server, general application server, DBMS, security pattern module connected to the network through the second network security management unit, to check the status of the web server, web application server, general application server, DBMS, security pattern module Monitoring unit 320 to monitor,
The primary event, abnormal event, and pattern analysis result data transmitted through the second network security management unit are analyzed first with a trend graph regarding session count, transaction usage, and return row. After that, the trend and log analysis unit 330 for secondary analysis of hacker intrusion and traffic abnormality through a log analyzer,
The security filtering mode output unit 340 is configured to output the security filtering mode in which the forced blocking and the security patch are set as N security pattern modules to the hacker intrusion and traffic abnormality analyzed in the trend and log analysis unit. Service network-type integrated security device through the transaction pattern analysis and monitoring, characterized in that the.
The method of claim 5, wherein the monitoring unit 320
A session monitoring unit 321 for monitoring status information of sessions connected to a web server, a web application server, a general application server, and a DBMS;
SQL monitoring unit 322 for monitoring the real-time list and details of the SQL accessed by the DBMS,
Report Builder (323) for generating a report while changing the search conditions by DB, host, and security perspective,
Transaction pattern characterized in that it consists of a communication protocol monitoring unit 324 to monitor the real-time monitoring of the telnet, FTP, RCmd log of the client connected to the monitoring target web server, web application server, general application server, DBMS Service network type integrated security device through analysis and monitoring.
Installing an agent module in each of the web server, web application server, general application server, DBMS (Database Management System), security pattern module (S100),
Filtering the packet while monitoring the status of the web server, the web application server, the general application server, the DBMS, and the security pattern module through the agent module (S200);
Logging through the agent module, the normal event regarding the resource usage status data, traffic flow data, and abnormal events related to hacker intrusion, virus infiltration, and then directly transmitted to the security management server (S300),
Connecting to a web server, a web application server, a general application server, and a DBMS through a security pattern module to form a network (S400);
Accessing a web server, a web application server, a general application server, and a DBMS formed through a security pattern module to collect URLs requested by the client, parameter names, values, and patterns of data types in the URL (S500). Wow,
Comparing and analyzing the existing collected pattern through the security pattern module, and transmitting the pattern analysis result data to the security management server (S600),
The security management server is connected with N security pattern modules (SPM) and N agent modules (AM) that have a large network environment base, and receives normal event, abnormal event, and pattern analysis result data. After analyzing, detecting the hacker intrusion and traffic abnormality (S700),
Outputting, to the N security pattern modules, the security filtering mode in which forced blocking and security patches are set as defense countermeasures against hacker intrusion and traffic abnormality analyzed through the security filtering mode output unit of the security management server (S800);
Based on the security filtering mode delivered from the Security Management Server (SMS) in the security pattern module, a step for defending in real time on the network through forced blocking and security patch against hacker intrusion and traffic anomaly detected in a large network environment Service network-type integrated security method through the transaction pattern analysis and monitoring, characterized in that consisting of (S900).
The method of claim 7, wherein the step (S500)
The URL collected by the pattern collecting unit, the parameter name, the value, and the data type pattern included in the URL are 128 bit encrypted by the second encryption processing unit. Integrated security method for service network.

Images