KR20030035142A - Method for Providing Enterprise Security Management Service - Google Patents

Abstract

PURPOSE: A unified security management service method is provided to normalize event logs, generated by various hacking detection systems, into mapping event logs, and to notify a manager of the normalized mapping event logs. CONSTITUTION: The method comprises several steps. A collector of an agent collects event logs from hacking detection systems(41). A controller of an agent compares the collected event logs with a mapping table stored at a memory for normalizing the event logs into mapping event logs(42, 43). A manager receives the normalized mapping event logs, analyzes them, generates corresponding messages according to an analysis result, and transmits the corresponding messages to a console(44-48). A controller of the console analyzes the corresponding messages, and outputs the analysis result(49-52). If the mapping event log has a low risk, the manager outputs a simple event message as the corresponding message, but if the mapping event log has a high risk, the manager outputs an alarm event message as the corresponding message.

Description

Method for Providing Enterprise Security Management Service}

The present invention relates to a method for providing a security management service, and in particular, using the integrated security management system for managing network intrusion detection, the normalized event log generated from various intrusion detection system to the mapping event log to inform the administrator It relates to a method of providing management services.

The Internet, a combination of the word International and the word Network, can be found in the ARPANET, which was established in 1969 with the support of the US Department of Defense to link four universities in the United States. It was initially introduced for military purposes, but recently, thanks to the wave of commercialization, millions of people around the world are using the Internet, based on e-mail, remote computer connections, file transfers (FTP), Usenet News, Internet Information Search (Gopher), Internet Conversation and Discussion (IRC), Bulletin Board (BBS), Hypertext Information View (WWW: World Wide Web), Online Games, Movies, or Voice Data in Real Time New services, such as broadcasting services and video conferencing, were developed and available in turn. As the commercialization of the Internet spreads rapidly, the whole world is connected to one Internet network, and the convenience of modern people's life by the Internet is increasing day by day. However, there are risk factors such as information leakage other than the convenience of modern people on the other side of the Internet, which can be easily disrupted and destroyed by criminals called hackers, information leakage, and illegal intrusion. Problems have arisen. In order to prevent such hacking, an intrusion detection system that detects and informs users in advance of unauthorized intrusion by insiders or outsiders is used.

Intrusion detection system is a system that detects intrusion or suspicious behavior in network environment and classifies risk according to detected pattern and informs user of detected result. However, these intrusion detection systems vary in their types, and, as a result, classification methods of detection patterns and risk definition criteria are different for each manufacturer. Therefore, the intrusion detection system for each manufacturer for the same intrusion detection pattern will inform the user of completely different results.

Therefore, when various types of intrusion detection systems are used together for large-scale enterprise-wide security management, each intrusion detection system shows different results for the same intrusion pattern, and the security management is performed by analyzing these logs. do. The analysis of logs generated from various intrusion detection systems is performed by manually dividing the categories by logs and redefining the risks and manually comparing the defined risks and categories. However, it is almost impossible to do this manually in a situation where thousands or tens of thousands of event logs are generated in a short time, and this problem is more serious in security management, which is an important factor of speed. Therefore, due to these problems, it is virtually impossible to perform consistent risk management and comprehensive security management using various intrusion detection systems, and furthermore, to provide integrated security management services to various customers using various intrusion detection systems. It is also impossible.

The present invention has been made to solve the above problems of security management, an object of the present invention is to provide an integrated security management service for a variety of customers using a variety of intrusion detection system.

1 is a schematic diagram of a system implementing the integrated security management service method according to the present invention.

Figure 2 is a detailed block diagram of a system implementing the integrated security management service method according to the present invention.

3 is a diagram showing the structure of a mapping table mounted in an integrated security management system implementing the integrated security management service method according to the present invention;

4 is a flowchart showing a method for integrated security management service according to the present invention;

Figure 5 is a flow chart illustrating a method of integrated security management services according to the present invention characterized by adding a new detection type and changing the existing detection type.

In order to achieve the object of the present invention, the present invention uses an integrated security management system having the following configuration.

The integrated security management system for implementing the service method of the present invention includes a storage unit for collecting commercial event logs from intrusion detection systems, a storage unit equipped with a mapping table reclassifying the intrusion detection type and the risk of the intrusion detection system; An agent including a control unit for comparing the collected commercial event log with a mapping table mounted in the storage unit and normalizing the commercial event log to a mapping event log; A manager including a control unit receiving and analyzing a mapping event log normalized by the agent and generating a corresponding message according to an analysis result; Input for adding and / or changing a control unit for analyzing the corresponding message received from the manager, an output unit for displaying the corresponding message analyzed by the control unit, and a detection type of the mapping table mounted in the storage unit of the agent. It consists of a console that performs a user interface, including a section.

The integrated security management system may analyze the mapping event log by the controller of the manager to generate an event message with the corresponding message if the risk is low and generate an alarm message with the corresponding message if the risk is high.

In addition, the integrated security management system stores and receives the addition and / or change signal of the detection type of the detection type addition and / or change of the detection type of the mapping table mounted on the storage unit of the agent received by the agent This can be accomplished by adding and / or changing the detection type in the negative mapping table.

The integrated security management service method according to the present invention is a method for providing an integrated security management service in an integrated security management system comprising an agent, a manager, and a console, wherein the collection unit of the agent collects a commercial event log from intrusion detection systems. In step 1, the control unit of the agent compares the collected commercial event log and the mapping table mounted in the storage unit to normalize the commercial event log to the mapping event log, and the manager by the agent A third step of receiving and analyzing the formed mapping event log and generating a corresponding message according to the analysis result and transmitting the generated message to the console; and analyzing the corresponding message received from the manager by the controller of the console and analyzing the corresponding message. A fourth step of outputting a message to the output of the console It should.

In the third step of the integrated security management service method according to the present invention, if the risk is low by the controller of the manager analyzing the mapping event log, a simple event message is generated as the corresponding message if the risk is low, and the corresponding message if the risk is high. It is characterized by generating an alarm message.

In another integrated security management service method according to the present invention, in order to add and / or change the detection type of the mapping table mounted in the storage unit of the agent, input of the detection type is added and / or changed through the input unit of the console. And a sixth step of loading the addition and / or change of the detection type from the console to the storage unit of the agent via the manager.

Hereinafter, with reference to the accompanying drawings, an embodiment of the present invention will first be described a system for implementing the integrated security management service method of the present invention and then in detail the service method of the present invention implemented by the system.

1 is a schematic diagram illustrating an interworking relationship between an agent, a manager, and a console constituting an integrated security management system implementing the integrated security management service method of the present invention. As shown in FIG. 1, the system includes an agent 10 collecting intrusion detection event logs from various intrusion detection systems 1, 2, and 3 and a manager receiving and analyzing event logs from the agent 10 ( 20) and a console 30 for implementing a user interface by outputting the analysis result received from the manager.

2 is a detailed block diagram of a system implementing the integrated security management service method according to the present invention. As shown in FIG. 2, the agent 10 of the system includes a log collector 11, a storage 12, and a controller 13.

The log collecting unit 11 collects various intrusion detection event logs by receiving patterns detected by various intrusion detection systems 1, 2 and 3 using SNMP Trap which is a network management protocol (41).

The storage unit 12 includes a mapping table composed of structures reclassifying the detection types of various intrusion detection systems into a standardized type. As shown in FIG. 3, the structure constituting the mapping table includes a major classification name 70, a description of the major classification (71), a middle classification (72), a description of the intermediate classification (73), and a commercial intrusion detection system name (74). And the risk and intrusion detection type name 75, which is one of the simple embodiments for implementing the technical idea of the present invention and its structure can be changed at any time. The classification criteria for classifying and classifying the structures mounted on the mapping table and their descriptions are detailed in Tables 1 and 2. As such, the major categories are classified into four categories: 'information collecting attack', 'intrusion attack', 'service denial attack' and 'other'. The middle category is 'aggressive probe' and 'suspicious' 'Door', 'Buffer Overflow', 'IP Scoping', 'Protocol Analysis Attempt', 'Unauthorized Access Attempt', and 'Category Attack' for Major Category 'Intrusion Attack' DOS, and the other classifications 'other' are classified into 'application' and 'misuse', 'web information' and 'other information'. Of course, these classifications are just examples of structures and can be changed or added at any time.

The control unit 13 compares the various commercial event logs collected from the log collection unit with the mapping table mounted in the storage unit 42 to form the mapping event log with the commercial event log 43. The mapping event log is formed by adding the major classification name and the middle classification name and descriptions thereof to the commercial event log contents.

Table 1: Major Classification Criteria

Major Category Explanation Information collection attack It is an attack that collects network or system vulnerabilities before hacking is performed. Through this attack, you can see the version of the application used by the OS of the system or open ports. This is the type of attack that can lead to hacking. Intrusion attack In fact, the type of attack is underway. These types include buffer overflows when leaking or illegal operation of information inside the system such as backdoors, attempting to gain unauthorized access, attempting to interpret the protocol to view mail or user IDs / passwords, and so on. This type of attack requires immediate action, such as attempting an intrusion using a vulnerability. Denial of Service Attack A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a particular server. It does not leak internal information, but it can be fatal to business due to a malfunction. Etc Although not a pattern of hacking, this is a classification type that requires attention or is necessary for administrative statistics, and is used for applications (e.g. ICQ, IRC, etc.) It includes.

Table 2: Criteria for Classification

Main Category Category Explanation Information collection attack Aggression probe It is a type of attack that collects proactive information for attempting unauthorized access (attack), and this type includes scans using Satan, ports, and IP scans. Suspicious behavior In general, the action is performed after the pre-attack probe, which requires more attention than the pre-attack probe, and an attempt is made to check open ports at the previous stage and to obtain more detailed information through the port. Intrusion attack Backdoor It exists in the form of a virus, and there are various types from leaking various information to the outside to be able to illegally take control of the system from outside and monitor the communication port connected to the outside. The backdoor used must be deleted. Buffer overflow It is an attack that exploits a vulnerability that occurs when the buffer used by the system and application internal code overflows, and it must be implemented considering such risks when all programs are written, but it can be a major target if it does not. In the case of system programs, a patch program that fixes known vulnerabilities should be installed. IP spoofing It is an attack type to deceive a firewall that controls access based on an IP address. It is an attack that uses the passive protection method of a firewall to infiltrate the IP address of a computer attempting hacking as accessible. Even after analyzing the log, it may be misleading. Protocol Analysis Attempt It is an attempt to analyze a protocol by intercepting a network packet, and if each packet is not encrypted, it is a type of attack that may expose sensitive information such as a user ID and a password, and leak the contents of an exchanged mail. . Unauthorized access attempt It is a serious type of attack that attempts to intrude into the internal network or system without authorization or the information inside can be leaked to the outside. In this case, immediate action must be taken to minimize the damage. Denial of Service Attack DOS A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a server. There are patterns of attacks from one location or from several distributed locations simultaneously. Etc application Information about the application patterns used, and may be vulnerable to known hacking attacks against these applications. In particular, attention should be paid to the messenger program. Misuse Detects information about misuse that is connected regardless of work, and may be necessary for internal management purposes but is not related to hacking. These types include pornography, gambling, sports, and securities. Web information This is a type of information used to connect to internal web server from outside, and some of them may require attention depending on the type and version of web server. Other information Although it cannot be classified as an attack pattern, it shows various other information detected by intrusion detection.

In addition, as shown in FIG. 2, the manager 20 receives and analyzes the mapping event log generated by the agent, generates a corresponding message according to the analysis result, and includes a connection unit 21 and a control unit 23.

The connection unit 21 interworks with the agent 10 to receive a mapping event log, and the control unit 23 determines a risk of the mapping event log received from the connection unit 21, and has a mapping event log having a high risk. An alarm message is added to the mapping event log, and a corresponding message is generated. For the mapping event log having a low risk, a corresponding message consisting of only the mapping event log is generated and transmitted to the console 30.

As shown in FIG. 2, the manager 20 may further have a storage 22 to store the received mapping event log.

As shown in FIG. 2, the console 30 includes a control unit 33 for analyzing a corresponding message received from the manager 20 and an output unit for displaying a corresponding message analyzed by the control unit 33 ( 33) and an input unit 34 for adding and / or changing a detection type of the mapping table mounted in the storage unit 12 of the agent 10 to perform a user interface.

3 to 5, an example of the structure shown in Table 3 constituting the mapping table is set and the integrated security management service method according to the present invention will be described.

Major classification: Information gathering attack, information gathering Description: An attack that collects vulnerabilities of a network or system before the hacking is performed. Through this attack, the version of the application used by the OS or port of the system can be known. Category: pre-attack probes, pre-attack probes Description: Type of attack to collect unauthorized information for attempting unauthorized access (scan, port, ip scan) Etc. Commercial Intrusion Detection System: Product = RealSecure3: Satan3: Port_Scan ： Product = Dragon3: TCP-SCAN3: UDP-SCAN ：

Table 3 Example of Structure

The storage unit 12 of the agent 10 is loaded with a mapping table composed of the structures shown in Table 3. For intrusion attempts such as scans using Satan (software that allows computers on the network to be intruded into the system in the same way as hackers through software and not on computers on the network). In the intrusion detection system named RealSecure, the intrusion detection type Satan has three risks, the intrusion detection type Port_Scan, and the intrusion detection system named Dragon, the intrusion detection type TCP-SCAN and the intrusion detection type UDP-SCAN. Doing. However, the structure reclassifies all of the intrusion detection types into "Category name: information gathering attack 70, and medium class name: pre-attack probe 72", and adds "Category name and description of subcategory name (71, 73)" Therefore, the user can easily perform security management regardless of the type of intrusion detection system.

Therefore, during the network scan by hacker, intrusion detection system called RealSecure detects intrusion attempt and generates commercial event log for intrusion detection type Satan, Port_Scan, and Dragon intrusion detection system TCP-SCAN, UDP-SCAN. Generate a commercial event log for.

Thereafter, the agent 10 collects the commercial event log by the log collecting unit 11 and performs the first step (41), and the control unit 13 stores the mapping table and the event log stored in the storage unit. By comparing (42) and generating a mapping event log based on the structure of Table 3 of the mapping table (43), performing an event log collection and mapping event log generation operation and transmitting a mapping event log to the manager (44). Perform the second step. In this case, since the mapping event log includes the contents of the structure, the contents of the general and middle classifications as well as the contents of the commercial event log as well as the structures of Table 3 (the major and middle classification names, the major and middle classifications) Includes)

As described above, when the mapping event log is generated by the agent 10, the manager 20 receives the mapping event log (45) to determine the risk (46) and alerts the mapping event log if the risk is high. If the message is added (47) to generate a response message (48) and the risk is low, the response message is generated using only the mapping event log without transmitting an alarm message and transmitted to the console 30 (48 and 49). Perform. In this case, the corresponding message exists in the form of a file containing contents to be transmitted by the user through the console 30.

The console 30 receives the corresponding message from the manager 20 to determine whether the alarm message is an attached message, and then outputs the alarm to the output unit 35 with or without an alarm 51. The corresponding message is output (52) to perform the fourth step.

In addition, another feature of the present invention is that it may further include a fifth step of adding or changing the structure of the mapping table. As shown in FIG. 5, in the fifth step, when the user inputs an addition / change of the detection type using the input unit 34 of the console 30 (61), the control unit 33 of the console adds the change. Transmits / changes to the manager 20 (62), adds / changes received by the manager 20 from the console to the agent 10, and the agent 10 stores the storage 12 64 by adding / changing the changes. In addition, if the manager 20 has a storage unit and needs to store additions / changes in the storage unit, the manager 20 may add / change the same at any time.

The above-described embodiments are merely examples of the present invention, and various modifications may be made without departing from the spirit of the present invention.

According to the configuration of the present invention, the present invention can achieve the following effects.

According to the present invention, the mapping process is performed using a mapping table composed of structures reclassifying the intrusion detection types of various intrusion detection systems. Thus, even if various intrusion detection systems are used, a consistent and rapid security management can be achieved.

Since the present invention can add / change a new detection type, it is possible to achieve the effect of enabling rapid security management for the new detection type.

Claims (3)

In the method of providing an integrated security management service in an integrated security management system consisting of an agent, a manager and a console, A first step of collecting a commercial event log from intrusion detection systems by a collector of the agent; A second step of normalizing the commercial event log to a mapping event log by comparing the collected commercial event log with the mapping table mounted in the storage unit by the controller of the agent; A third step in which the manager receives and analyzes the mapping event log formed by the agent, generates a corresponding message according to the analysis result, and transmits the corresponding message to the console; And a fourth step of analyzing, by the controller of the console, the corresponding message received from the manager, and outputting the corresponding message analyzed by the controller to the output of the console. The method of claim 1, wherein the third step comprises the controller of the manager analyzes the mapping event log to generate a simple event message with the corresponding message if the risk is low and to generate an alert message with the corresponding message if the risk is high. Integrated security management service method, characterized in that. The method of claim 1, further comprising: inputting the addition and / or modification of the detection type through an input unit of the console to add and / or change the detection type of the mapping table mounted in the storage unit of the agent; And a sixth step of loading the addition and / or change of the detection type from the console to the storage unit of the agent via the manager.