KR20030056652A - Blacklist management apparatus in a policy-based network security management system and its proceeding method - Google Patents

Abstract

PURPOSE: A device and a method for managing blacklists in a policy-based network security control system are provided to collect and analyze various network information in real time, so as to notify an operator of user addresses and host addresses exceeding a reference value and generate a network packet cutoff policy for a corresponding IP(Internet Protocol) address. CONSTITUTION: An intrusion detection alarm receiver(301) collects network intrusion alarm data from a security gateway(103) in real time. A dangerous IP address generator(302) extracts blacklist-related information from the collected network intrusion alarm data, and records the extracted information in a potential blacklist DB(307). A blacklist analyzer(303) compares and analyzes whether a network intrusion exceeds a preset threshold from the extracted blacklist-related information. An event generator(304) generates event information to record an event log in a dangerous blacklist DB(309), if the network intrusion is decided to exceed the threshold through the blacklist analyzer(303). A blacklist event monitor(305) notifies the event information generated by the event generator(304) to a remote security manager through a network. And a blacklist cut-off policy manager(310) generates and transmits a packet cutoff policy for a specific IP address through the event information and the event log.

Description

BLACKLIST MANAGEMENT APPARATUS IN A POLICY-BASED NETWORK SECURITY MANAGEMENT SYSTEM AND ITS PROCEEDING METHOD}

The present invention relates to a security control technology in an information communication network such as the Internet. In particular, real-time notification of user addresses and host addresses exceeding a reference value by collecting and analyzing various network information in real time, and network packet blocking response of the corresponding IP address. The present invention relates to a blacklist management apparatus and management method in a policy-based network security control system for implementing policy generation.

With the development of network-related technology, security control technology has been researched and developed in various fields. In particular, in order to protect the system from network intrusions such as hacking, a firewall and an intrusion detection system (IDS) are known. Security control technology such as System) is widely used.

Here, an intrusion prevention system (Firewall) refers to a system that blocks packet inflow and access from an external network based on an IP (Internet Protocol) address or a specific session through packet filtering, and intrusion detection. The system refers to a system that monitors network usage in real time and detects harmful packets by using the intrusion pattern DB and intrusion analysis engine.

The blacklist management method has been proposed to leave a log in the DB based on the hacking source address in such security equipment and take pre-specified measures on the connection attempts and packets from the IP address afterwards.

However, since these security devices differ in their security functions and interfaces from one manufacturer to another, they only play a role of managing simple rogue IP addresses at a single device level, and integrating security functions integration and operation management at the wide-area network level. There are a number of constraints to implement.

In addition, the conventional single device-oriented blacklist management cannot structurally manage an unspecified number of attackers and victims in the event of cyber terrorism in a large network. There is a problem that can not be identified and monitored.

In addition, since the security equipment is operated according to a predefined detection method, a problem that a flexible blacklist operation management suitable for the security environment of each network desired by the security manager is impossible is raised.

The present invention has been made to solve the above-described problem, by collecting and analyzing the network intrusion source address and destination address, security level, hacking type information, etc. in real time from the network intrusion alert transmitted from the intrusion detection agent (security gateway) Inform the operator of user address and host address information exceeding the preset threshold in real time, and automatically generate network packet blocking response policy of the IP address according to the operator's choice and apply it to the security equipment in the management area. The purpose of the present invention is to provide a blacklist management device and management method in a policy-based network security control system.

According to an embodiment of the present invention for achieving the above object, by analyzing the network packet information flowing into the main network to determine whether the network intrusion, and generating and transmitting the network intrusion alarm data based on the packet information for the intrusion action A blacklist management device of a policy-based network security control system interworking with a security gateway and extracting bad user and bad host information based on network intrusion alarm data received from the security gateway, wherein the network intrusion alarm data from the security gateway is used. Intrusion detection alert receiving means for collecting the real-time; Bad IP address generation means for extracting blacklist related information from the collected network intrusion alarm data and writing it to the first blacklist DB; Blacklist analysis means for comparing and analyzing whether network intrusion behavior exceeds a predetermined threshold value from the extracted blacklist-related information; Event generation means for generating event information and recording an event log in a second blacklist DB if it is determined that the threshold value has been exceeded by the blacklist analysis means; Blacklist event monitoring means for notifying a remote security manager connected via a network of event information generated by the event generating means; And a blacklist blocking response policy management means for generating and transmitting packet inflow blocking response policy data for a specific IP address through event information and the event log. To provide.

According to another embodiment for achieving the object of the present invention, in a blacklist management method in a policy-based network security control system having an intrusion detection alarm receiving means for collecting network intrusion alarm data from a plurality of security gateways in real time A first step of transforming network intrusion alert data collected by the intrusion detection alert receiving means into alert DB schema data; A second step of determining whether a predetermined stored cycle time has arrived; A third step of storing the modified alarm data in the storage medium when it is determined that the second step is not a preset storage period; And a fourth step of storing the modified alarm data by reading the modified alarm data stored in the storage medium and transmitting the modified alarm data stored in the storage medium to a remote alarm DB when the determination result of the second step is reached. Provides blacklist management method in policy-based network security control system.

According to another embodiment for achieving the object of the present invention, a black in a policy-based network security control system having a bad IP address generating means, blacklist analysis means, blacklist event generating means, blacklist event monitoring means respectively; A list management method comprising: a first step of searching for alarm data stored in an arbitrary storage medium by a bad IP address generating means, and extracting blacklist related information according to a search result; A second step of determining, by the bad IP address generating means, whether the corresponding IP address exists in the first blacklist DB; If it is determined that the corresponding IP address does not exist, the third step of converting the extracted information into a DB in a data schema form and newly registering the extracted information; As a result of the determination in the second step, if it is determined that the corresponding IP address exists in the first blacklist DB, increasing the value of each field of the corresponding IP address and modifying the blacklist information in the first blacklist DB to the current information. 4 steps; Determining, by the blacklist analyzing means, whether the corresponding IP address is a source address or a destination address; As a result of the determination in the fifth step, when the corresponding IP address is the source address, it is determined whether the total number of security violations and the number of security violations by security level of the bad user IP address in the first blacklist DB exceed the bad user security violation threshold value. A sixth step; As a result of the determination in the fifth step, when the corresponding IP address is the destination address, it is determined whether the total number of security violations and the number of security violations by security level of the bad user IP addresses in the first blacklist DB exceed the bad user security violation threshold values, respectively. A seventh step; As a result of the determination in the sixth and seventh stages, if it is determined that the total number of security violations and the number of security violations by security level of the rogue user IP addresses in the first blacklist DB exceed the rogue user security violation threshold, a blacklist event is generated. An eighth step of generating the event information in the means, and storing the event information in the second blacklist DB; And a ninth step of notifying the security manager of the event information through the blacklist event monitoring means.

According to another embodiment for achieving the object of the present invention, in the blacklist management method in the policy-based network security control system interlocked with the security policy delivery means, and having a blacklist blocking response policy management means, the security manager If the bad IP address is selected by the first step, the blacklist blocking response policy management means determines whether the blocking response policy for the bad IP address is already applied; A second step of notifying the security manager of the current security policy application status in the blacklist blocking response policy management means when it is determined that the blocking response policy for the bad IP address is being applied; If it is determined that the blocking response policy for the bad IP address is not currently applied, the third step of creating a new blocking response policy in the blacklist blocking response policy management means; A fourth step of determining whether there is a policy conflict with another security policy applied to the bad IP address when a new blocking response policy is generated; A fifth step of notifying the security manager of all current security policy application statuses when it is determined that a policy conflict of another security policy applied to the corresponding bad IP address has occurred; As a result of the fourth step, if it is determined that a policy conflict of another security policy applied to the bad IP address has not occurred, a sixth step of transmitting the generated blocking response policy to the security policy delivery means; When the policy application success message is received from the security policy delivery means, the blocking response policy is DBized, and then the policy application status of the corresponding bad IP address in the first blacklist DB and the second blacklist DB is changed to true. A seventh step; When the policy application failure message is received from the security policy delivery means, it provides a blacklist management method in a network security control system comprising an eighth step of notifying the security manager of the failure to apply the block response policy.

1 is a network diagram showing the interworking between the blacklist management device and the entire security network in a policy-based network security control system according to the present invention;

2 is a block diagram showing the interworking between the black list management device and the security gateway in the policy-based network security control system according to the present invention;

3 is a detailed block diagram of an apparatus for managing a blacklist in a policy-based network security control system according to the present invention;

4 is a flowchart illustrating an operation process of an intrusion detection alarm receiver in a blacklist management apparatus in a policy based network security control system according to the present invention;

5 is a flowchart illustrating an operation process of a bad IP address generator, a blacklist analyzer, a blacklist event generator, and a blacklist event monitor in a blacklist management apparatus in a policy based network security control system according to the present invention;

6 is a flowchart illustrating an operation process of a blacklist blocking response policy management unit in a blacklist management apparatus in a policy-based network security control system according to the present invention;

7 is an alarm data table DBized in the blacklist managing apparatus of FIG. 3;

FIG. 8 illustrates a bad user and bad host data table that is DBized in the blacklist managing apparatus of FIG. 3; FIG.

9 is a table of rogue users and rogue host security violation threshold values that are DBized in the blacklist management apparatus of FIG. 3;

FIG. 10 is an event log information table DBized in the blacklist management apparatus of FIG. 3; FIG.

<Description of the code | symbol about the principal part of drawing>

100: network security control system

102: period network

103: security gateway

104: network connection point

200: black list management device

201: network intrusion detection unit

202: network intrusion prevention counterpart

301: intrusion detection alarm receiver

302: bad IP address generation unit

303: black list analysis unit

304: blacklist event generator

305: blacklist event monitor

306: Intrusion Detection Alarm DB

307: Potential rogue user and rogue host DB (potential blacklist DB)

308: blacklist threshold DB

309: Bad black user and bad host DB (dangerous blacklist DB)

310: Blacklist Blocking Response Policy Management Department

311: security policy DB

312: blacklist statistics and search

313: security policy delivery unit

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a network diagram showing the interworking between a blacklist management device and an entire security network in a policy-based network security control system according to the present invention, the network security control system 100, the main network 102, and a security gateway. 103 and network connection point 104.

As shown in FIG. 1, the security gateway 103 located at the network access point 104 analyzes all network packet information flowing into the network 102 to determine whether or not the network is invaded, and to determine packet information regarding the intrusion behavior. Perform a function to abbreviate.

Based on the packet information of the intrusion, the security gateway 103 generates the network intrusion alarm data as shown in FIG. 7 and transmits the intrusion alarm data to the network security control system 100 which is a higher management system. .

2 is a block diagram showing the interworking between the black list management apparatus 200 and the security gateway 103 in the policy-based network security control system according to the present invention.

As shown in FIG. 2, the blacklist management apparatus 200 according to the present invention installed in the network security control system 100 receives the network intrusion alarm data 203 received from the security gateway 103 (the table of FIG. 7). Extracts bad user and bad host information based on

In addition, the blacklist management apparatus 200 introduces a packet from a corresponding bad IP address through a series of processes such as storing alarm data, extracting alarm level and hacking type information, comparing and analyzing threshold values, and notification of items exceeding threshold values. It generates a blocking response policy data 204 to block the transmission to the security gateway 103. The detailed configuration and operation process of the blacklist management apparatus 200 will be described in more detail with reference to the drawings of FIGS. 3 to 6 below.

On the other hand, the network intrusion block counter 202 in the security gateway 103 receiving the blocking response policy data 204 blocks the inflow of packets from the rogue user IP address (source address), or the rogue host IP address (destination address). It blocks the outflow of packets to).

3 is a detailed block diagram of the blacklist management apparatus 200 in the policy-based network security control system 100 according to the present invention. The intrusion detection alarm receiver 301, the bad IP address generator 302, and the black are shown in FIG. List analyzer 303, blacklist event generator 304, blacklist event monitor 305, intrusion detection alarm DB 306, potential rogue user and rogue host DB (307), black List critical value DB (308), critical bad user and bad host DB (dangerous blacklist DB) (309), blacklist blocking response policy management unit 310, security policy DB (311), blacklist statistics and search unit (312) And a security policy delivery unit 313, respectively.

As shown in FIG. 3, the intrusion detection alarm receiver 301 collects the alarm data from the security gateway 103 in real time and stores it in the intrusion detection alarm DB 306, through the bad IP address generator 302. Source IP address, destination IP address, security level, and hacking type information are extracted from the collected alarm data and stored in the potential rogue user and rogue host DB 307. In this case, the source address related information may be stored in the potential bad user and the bad user DB area in the bad host DB 307 and the destination address related information in the bad host DB area, and the bad IP address already exists when the information is stored. In this case, the count of each corresponding field is increased and the contents are corrected.

The blacklist analyzing unit 303 periodically compares and analyzes whether each count value for the bad IP address recorded in the bad rogue user and the bad host DB 307 exceeds the threshold defined in the blacklist threshold DB 308. It performs the function. If the count value exceeds the threshold value, the event data is generated through the blacklist event generator 304 and notified to the blacklist event monitor 305 in real time. Record the event log at 309).

The blacklist event monitoring unit 305 outputs event data so that the network security manager can monitor the blacklist management in real time.

The blacklist blocking response policy manager 310 automatically generates a packet inflow blocking response policy 204 for a specific IP address through such event data and an event log recorded in the bad user and bad host DB 309 of interest.

The packet inflow blocking response policy 204 generated by the blacklist blocking response policy management unit 310 is recorded in the security policy DB 311 and sent to the security policy delivery unit 313 in the network security control system 100. Delivered.

The security policy delivery unit 313 transmits the packet inflow blocking response policy 204 to the security gateway 103 through the network.

Thereafter, the network intrusion prevention counterpart 202 in the security gateway 103 applies the transmitted packet inflow blocking response policy 204 in real time to block all subsequent packet inflows from the corresponding IP address.

Hereinafter, the above-described configuration will be described in detail with reference to the flowcharts of FIGS. 4 to 6 attached to the blacklist management process in the policy-based network security control system according to the preferred embodiment of the present invention.

First, FIG. 4 is a blacklist management method according to an embodiment of the present invention. The operation of the intrusion detection alarm receiver 301 in the blacklist management apparatus 200 in the policy-based network security control system 100 is illustrated. One flow chart.

As shown in FIG. 4, in step S402, the intrusion detection alarm receiver 301 in the network security control system 100 collects alarm data received from a plurality of security gateways 103 in real time.

At this time, the alarm data transmitted from the security gateway 103 is first accumulated in a message queue (not shown) in the network security control system 100 first. That is, since the method of storing a plurality of alarm data each time in a remote DB is inefficient, the intrusion detection alarm receiver 301 according to the present invention continuously reads the alarm data from the message queue.

Thereafter, in step S403, the alarm data is transformed into an alarm DB schema as shown in FIG. 7, and the flow proceeds to step S404.

In step S404, it is determined whether a predetermined scheduled cycle time has arrived, and when it is determined that the preset storage cycle is not set, the intrusion detection alarm receiver 301 proceeds to step S406 and in step S403 described above. Is stored in the cache memory (not shown).

If, as a result of the determination in step S404, the preset storage period has arrived, the intrusion detection alarm receiver 301 proceeds to step S405 to read the modified alarm data stored in the above-described cache memory to remotely alert DB. The alarm data can be stored by sending it to.

5 is a blacklist management method according to another embodiment of the present invention. In the policy-based network security control system 100, a bad IP address generation unit 302 and a blacklist analysis unit in the blacklist management device 200 are provided. 303), and a flowchart illustrating an operation process of the blacklist event generator 304 and the blacklist event monitor 305.

As shown in Fig. 5, in step S500 and step S501, the bad IP address generation unit 302 in the blacklist management apparatus 200 searches for alarm data stored in the alarm data cache memory and writes to the search result. Source address, destination address, security level of alarm and hacking type information are extracted.

Thereafter, in step S502, the bad IP address generator 302 determines whether there is a corresponding IP address in the potential bad user and the bad host DB 307.

If it is determined in step S502 that the corresponding IP address does not exist, the bad IP address generation unit 302 proceeds to step S503 and displays the extracted information as shown in FIG. Register newly by making DB in the form of bad host data schema.

If it is determined in step S502 that the corresponding IP address exists in the potential bad user and the bad host DB 307, the bad IP address generator 302 proceeds to step S504, and the corresponding IP address exists. It increments the value of each field of address and modifies 'potential blacklist' information to current information.

Meanwhile, in step S505, the blacklist analyzing unit 303 determines whether the corresponding IP address is a source address or a destination address.

As a result of the determination in step S505, if the corresponding IP address is the source address, the blacklist analyzing unit 303 proceeds to step S506 to determine the potential bad user and bad user IP addresses in the bad host DB 307. FIG. It is determined whether the total number of security violations and the number of security violations by security level exceed the bad user security violation threshold value. When the determination result in step S507 is that the corresponding IP address is the destination address, the blacklist analyzing unit 303 In step S508, it is determined whether the total number of security violations and the number of security violations by security level of the potential bad user and the bad user IP address in the bad host DB 307 exceed the bad user security violation threshold value, respectively. Such threshold data is tabled in the 'blacklist threshold DB' shown in FIG.

As a result of the determination in step S506 and S508, the total number of security violations and the number of security violations by security level of the potential bad user and the bad user IP address in the bad host database (307) (307) are bad user security violation threshold values. If it is determined to exceed, the blacklist event generating unit 304 proceeds to step S509 to generate event information as shown in FIG. 10, and then proceeds to step S510 to indicate a bad user and bad host DB of interest. This event information is stored in 309.

Thereafter, in step S512, such event information is notified to the security manager through the blacklist event monitor 305 remotely connected through the network.

6 is a blacklist management method according to another embodiment of the present invention, the operation process of the blacklist blocking response policy management unit 310 in the blacklist management apparatus 200 in the policy-based network security control system 100. It is a flowchart shown.

As shown in FIG. 6, in step S601, the blacklist blocking response policy manager 310 monitors a 'dangerous blacklist' event notification through the blacklist event monitor 305 described above. Determines whether the bad IP address on which the intrusion response determination has been made is selected on the screen, and if a bad IP address is selected by the security administrator, the flow proceeds to step S602.

In step S602, the blacklist blocking response policy management unit 310 performs a determination procedure to check whether the blocking response policy for the corresponding bad IP address is already applied.

As a result of the determination in step S602, if the blocking response policy is already applied, the blacklist blocking response policy management unit 310 proceeds to step S609 and notifies the security manager of the current security policy application status. As a result of the determination in S602, the blacklist blocking response policy management unit 310 automatically proceeds to step S603 to automatically generate a new blocking response policy.

When a new blocking response policy is generated as in step S603, the blacklist blocking response policy management unit 310 proceeds to step S604 to determine whether there is a policy conflict of another security policy applied to the corresponding bad IP address.

If an abnormality is found as a result of the determination in step S604, the blacklist blocking response policy management unit 310 proceeds to step S609 and notifies the security manager of all current security policy application statuses, but no abnormality is found. If not, the process proceeds to step S605 and transfers the generated blocking response policy to the security policy delivery unit 313 in the network security control system 100.

The blocking response policy transmitted to the security policy transmission unit 313 is transmitted to the network intrusion blocking response unit 202 in the security gateway 103 through the network.

Thereafter, in step S606, the blacklist blocking response policy management unit 310 determines whether a policy application success message is received from the security policy delivery unit 313 described above, and receives a blacklist blocking response policy when the policy application success message is received. After the management unit 310 proceeds to step S607 and step S608 and stores the blocking response policy in the security policy DB 311, the potential blacklist DB and the blacklist DB of interest, that is, the reference numerals of FIG. 3. The policy application status of the bad IP address in 307 and 309 is changed to true.

As a result of the determination in step S606, when the policy application failure message is received, the blacklist blocking response policy management unit 310 proceeds to step S609 to notify the security manager of the failure status of applying the blocking response policy.

As mentioned above, although this invention was demonstrated concretely based on the Example, this invention is not limited to this Example, A various deformation | transformation, for example, through a personal computer (PC), does not deviate from the summary. Of course, the present invention may be embodied in a readable form and stored in a recording medium (eg, CD-ROM, RAM, ROM, hard disk, magneto-optical disk, etc.).

As described above, according to the present invention, when cyber terrorism occurs in a large network, the network security breach situation can be specifically identified and monitored up to IP address units by structurally managing unspecified attackers and attackers. By operating the blacklist security thresholds that are appropriate for the network security environment by network security violation level, it is possible to automatically analyze and detect the security status of a specific IP address beyond the risk level. In addition, the present invention automatically detects a bad IP address exceeding a threshold value and notifies the remote security manager in real time, and automatically generates a block response policy according to the administrator's decision and applies it to the wide area network afterwards. It has the effect of network intrusion countermeasures that block harmful packets for addresses.

Claims (16)

It analyzes network packet information flowing into the main network to determine network intrusion and interwork with security gateway that generates and transmits network intrusion alarm data based on packet information on intrusion activity, and receives network intrusion alarm received from the security gateway. A blacklist management apparatus in a policy-based network security control system that extracts rogue user and rogue host information based on data, Intrusion detection alert receiving means for collecting network intrusion alert data from the security gateway in real time; Bad IP address generation means for extracting blacklist related information from the collected network intrusion alert data and writing it to a first blacklist DB; Blacklist analyzing means for comparing and analyzing whether network intrusion behavior exceeds a predetermined threshold from the extracted blacklist-related information; Event generating means for generating event information and recording an event log in a second blacklist DB if it is determined that the threshold value has been exceeded by the blacklist analyzing means; Blacklist event monitoring means for notifying event information generated by the event generating means to a remote security manager connected through a network; Blacklist management in the policy-based network security control system, characterized in that it comprises a blacklist blocking response policy management means for generating and transmitting packet intrusion prevention response policy data for a specific IP address through the event information and the event log. Device. The method of claim 1, The blacklist related information Black list management device in the policy-based network security control system, characterized in that the information of at least one of the network intrusion source IP address, destination IP address, security level, hacking type information. The method of claim 1, The policy-based network security control system, And a security policy forwarding means for transmitting the packet inflow blocking response policy data to the security gateway through the network. The method of claim 1, The first blacklist DB is a potential bad user and bad host DB (potential blacklist DB) blacklist management device in a policy-based network security control system, characterized in that. The method of claim 1, The second blacklist DB is a blacklist management device in a policy-based network security control system, characterized in that the bad user and bad host DB (dangerous blacklist DB). The method of claim 1, The packet inflow blocking response policy data is recorded in a security policy DB, blacklist management device in a policy-based network security control system. A blacklist management method in a policy-based network security control system having an intrusion detection alarm receiving means for collecting network intrusion alarm data from a plurality of security gateways in real time, A first step of transforming network intrusion alert data collected by the intrusion detection alert receiving means into alert DB schema data; A second step of determining whether a predetermined stored cycle time has arrived; A third step of storing the deformation alarm data in a storage medium if it is determined that the preset storage period is not determined; And a fourth step of storing the modified alarm data by reading the modified alarm data stored in the storage medium and transmitting the modified alarm data stored in the storage medium to a remote alarm DB as a result of the determination of the second step. Blacklist management method in a policy-based network security control system, characterized in that. The method of claim 7, wherein Network intrusion alarm data transmitted from the security gateway, Blacklist management method in a policy-based network security control system, characterized in that sequentially stored in the message queue in the network security control system. In the blacklist management method in a policy-based network security control system, each having a bad IP address generating means, a blacklist analyzing means, a blacklist event generating means, and a blacklist event monitoring means, A first step of searching for alarm data stored in an arbitrary storage medium by the bad IP address generating means and extracting blacklist related information according to a search result; A second step of determining, by the bad IP address generating means, whether a corresponding IP address exists in a first blacklist DB; If it is determined that the corresponding IP address does not exist, the third step of converting the extracted information into a DB in a data schema form and newly registering it; If it is determined that the corresponding IP address exists in the first blacklist DB, the value of each field of the corresponding IP address is increased, and the blacklist information in the first blacklist DB is used as the current information. A fourth step of modifying; A fifth step of determining, by the blacklist analyzing means, whether the corresponding IP address is a source address or a destination address; As a result of the determination in the fifth step, if the corresponding IP address is a source address, it is determined whether the total number of security violations and the number of security violations by security level of the bad user IP address in the first blacklist DB exceed the bad user security violation threshold value. Determining the sixth step; As a result of the determination in the fifth step, if the corresponding IP address is a destination address, it is determined whether the total number of security violations and the number of security violations by security level of the bad user IP address in the first blacklist DB exceed the bad user security violation threshold value. Judging each step; As a result of the determination in the sixth and seventh steps, if it is determined that the total number of security violations and the number of security violations by security level of the bad user IP address in the first blacklist DB exceed the bad user security violation threshold value, the black An eighth step of generating event information in the list event generating means and storing the event information in a second blacklist DB; And a ninth step of notifying the security manager of the event information through the blacklist event monitoring means. The method of claim 9, The blacklist related information A method for managing a blacklist in a policy-based network security control system, characterized in that the information is at least one of network intrusion source IP address, destination IP address, security level, and hacking type information. The method of claim 9, The first blacklist DB is a blacklist management method in a policy-based network security control system, characterized in that the potential rogue user and rogue host DB. The method of claim 9, The second blacklist DB is a blacklist management method in a policy-based network security control system, characterized in that the bad user and bad host DB of interest. In the blacklist management method in a policy-based network security control system interlocked with a security policy delivery means, and having a blacklist blocking response policy management means, If a bad IP address is selected by the security manager, determining, by the blacklist block response policy management means, whether a block response policy for the bad IP address is being applied; A second step of notifying the security manager of the current security policy application status by the blacklist blocking response policy management means when it is determined that the blocking response policy for the bad IP address is being applied as a result of the determination of the first step; Wow; A third step of generating a new blocking response policy in the blacklist blocking response policy management means when it is determined that the blocking response policy for the corresponding bad IP address is not currently applied; A fourth step of determining whether or not a policy conflict of another security policy applied to the bad IP address is generated when the new blocking response policy is generated; A fifth step of notifying the security manager of all current security policy application statuses when it is determined that the policy conflict of another security policy applied to the corresponding bad IP address has occurred; A sixth step of transmitting the generated blocking response policy to the security policy delivery means when it is determined that the policy conflict of another security policy applied to the corresponding bad IP address has not occurred; When the policy application success message is received from the security policy delivery means, the DB corresponding blocking response policy is made into DB, and then the policy application status of the corresponding bad IP address in the first blacklist DB and the second blacklist DB is changed to true. A seventh step; And an eighth step of notifying the security manager of a failure response policy application failure status when a policy application failure message is received from the security policy delivery means. The method of claim 13, The blacklist management method of the network security control system, characterized in that the blocking response policy delivered to the security policy delivery means is transmitted to the network intrusion blocking response means in the security gateway through the network. The method of claim 13, The first blacklist DB is a blacklist management method in a policy-based network security control system, characterized in that the potential rogue user and rogue host DB. The method of claim 13, The second blacklist DB is a blacklist management method in a policy-based network security control system, characterized in that the bad user and bad host DB of interest.