KR20040042064A - network security system based on black-board, and method for as the same - Google Patents

Abstract

PURPOSE: A black board-based network security system and an operating method thereof are provided to offer an environment where various network security systems can be effectively evaluated and smoothly perform a communication between security systems. CONSTITUTION: A host(10) operates an intrusion detection system in a network environment and includes an intrusion information database storing accumulative intrusion information on an eternal intrusion. A main host(20) allows a different host, except for an intruded host, to read intrusion information and intrusion level posted on a black board(22), and includes a host controller(21) for controlling packets introduced into a corresponding host or the entire hosts according to an intrusion level. A manager host(30) performs a monitoring on a data processing procedure of the main host(20) or setting a threshold value.

Description

Network security system based on black-board, and method for as the same}

The present invention relates to a blackboard-based network security system and a method of operating the same, and in particular, a board-based network capable of coping with intrusion by sharing the external intrusion information according to the use of the blackboard by distributed hosts in a network environment. It relates to a security system and its operation method.

As computer and network technology advances, the interconnections between computers increase, which makes computer security a major issue. When the IP protocol was experimentally applied to ARPANET in 1981, only 210 hosts were connected to ARPANET, but today more than 7 million computer systems worldwide are interconnected using the same IP protocol. All computers connected to are hackers.

In order to cope with these threats, research on intrusion detection system, an advanced form of auditing technology that analyzes and detects illegal intrusions on documents or systems requiring information protection and prevents problems in advance, is actively conducted. It is becoming.

On the other hand, the intrusion detection system detects intrusions and takes appropriate measures to protect the computer from illegal intrusions.

In general, the safety and ease of use of the systems are contrary to each other, and the design of a secure system is very expensive, making it impossible to design a safe and ideal system against any attack. In such a system, all files can be encrypted and stored as a countermeasure against illegal behavior, but new problems arise such as encryption algorithm selection, key management problem, and system administrator role adjustment.

Therefore, an object of the present invention is to distribute the information related to the intrusion from the outside of the host operating the intrusion detection system in the network environment on the blackboard with the occurrence of the intrusion, and share it in a way that other hosts view At the same time, it provides a blackboard-based network security system and its operation method that can apply the intrusion degree differentially to perform countermeasures to block packets flowing into the host and the entire network according to the intrusion degree.

1 is a block diagram schematically showing the overall configuration of the present invention.

2 is a block diagram showing information flow between a host and a main host on a network according to an embodiment of the present invention.

3 is a block diagram showing a method of operating a blackboard-based network security system according to an embodiment of the present invention.

4 is a flowchart illustrating a method of operating a blackboard-based network security system for host intrusion according to an embodiment of the present invention.

5 is a flowchart illustrating a host intrusion level processing step according to an embodiment of the present invention.

6 is a flowchart illustrating a method of operating a blackboard-based network security system against network intrusion according to an embodiment of the present invention.

7 is a flowchart illustrating a network intrusion level processing step according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

10: host 20: main host

21: host controller 22: the black board

23: Host Intrusion Board 24: Network Intrusion Board

30: admin host

Blackboard-based network security system and its operation method for achieving the above object of the present invention, the intrusion is created by a plurality of hosts operating the intrusion detection system in a network environment and the host receiving an external intrusion from the host The intrusion information including the attacker's IP address and packet collection time is posted by the host so that the other hosts can be shared with each other, and the number of attacker's IP addresses introduced in the packet collection time based on the intrusion information is set in advance. Other hosts can view the shared memory equipped with a black board that applies the intrusion level to the invading host differentially according to the degree of intrusion according to the comparison with the number, and the intrusion information and the intrusion level posted on the black board. Hose that controls the packets flowing into the host or the whole host according to the intrusion level. The host control unit is configured to include a main host further formed, wherein the host control unit is set to a threshold value that is a criterion to which the intrusion level is transferred according to the intrusion information to the outside, the external board is a single intrusion Host intrusion information of the state invaded by the host alone is displayed, and the host intrusion board which generates the level transition of the host according to the intrusion level, and the network intrusion information in which the intrusion of the outside is invaded by at least two hosts are placed. Network intrusion board that generates the level transition of the entire host according to the host intrusion board and network intrusion board is divided into five intrusion levels, intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level, intrusion It is classified as the damage level, and according to the intrusion level, the level of the corresponding host is transferred on the blackboard. In addition, the firewall blocks packets sent from the intrusion to the host at the intrusion severity level, and when two or more hosts are intruded and the host intrusion level is transitioned, The intrusion level of the entire host is transferred to the intrusion level on the blackboard to block packets transmitted from the intrusion site at the intrusion attention level by the firewall, and to block all packets entering the network at the intrusion serious level by the firewall. It is preferable that the intrusion information database for accumulating intrusion information is further included.

On the other hand, in the operation method of the blackboard-based network security system, for the intrusion into one host, the host intrusion step in which the intrusion into one of the hosts from the outside, and the information about the intrusion host Blackboard update step that is posted on the blackboard by the host control unit, the intrusion level application step of setting the intrusion level differentially in accordance with the intrusion level of the intrusion information posted on the blackboard and to the host in accordance with the intrusion level Characterized in that it comprises an intrusion level corresponding step of blocking the incoming packet, the intrusion level application step is made of intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level and intrusion damage level, the blackboard update In the step, the host recognizes the intruded information, creates the intruded information, and sends it to the blackboard. In order to transmit the blackboard update request information to the main host, the blackboard update request step and the main host receiving the blackboard update request information confirm that the host is a registered host, and transmit blockboard update license information to approve the update. The host receiving the blackboard update permission step and the blockboard update permission information proceed to the attack information publication step of accessing the blackboard to update the corresponding attack information, and the intrusion level application step is an intrusion posted on the blackboard. An intrusion information checking step for confirming information; a threshold value checking step for comparing the intrusion level value of the intrusion information with a preset threshold; and a host for increasing the intrusion level on the black press of the host if the threshold value is larger than the threshold value. Intrusion board level transition step and information retrieval and reading message having the level transition information of the blackboard In addition, the intrusion level correspondence step is a host intrusion board check step for checking the host intrusion board of the blackboard as well as characterized in that it proceeds to the blackboard search and browsing step to transmit and search to other hosts. And an intrusion serious level checking step of confirming that the level of the host intrusion board is an intrusion serious level and a packet difference step of blocking a packet flowing into the host if it is determined as the intrusion level.

In case of intrusion into two or more hosts, a host attack step of invading at least two or more of the hosts from the outside, and a blackboard update step of posting information on the intrusion on the blackboard by the host, respectively; The host control unit applies an intrusion level setting step to differentially set the intrusion level in the host intrusion mode and the network intrusion mode according to the intrusion level of the intrusion information posted on the blackboard, and the packet flowing into the host or the network in accordance with the intrusion level. Proceed to the intrusion level response step of blocking, the intrusion level application step is the host intrusion level and network intrusion level is composed of intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level and intrusion damage level, the black In the board update step, after each intruded host recognizes the intruded information, In order to create the intrusion information and to publish it on the blackboard, the blackboard update request step of transmitting the blackboard update request information to the main host, and confirming that the main host receiving the blackboard update request information is a registered host, The blackboard update permission step of transmitting the blockboard update permission information approving the update and the host receiving the blockboard update permission information proceed to the intrusion information publication step of accessing the blackboard and updating the intrusion information. The level application step includes an intrusion information checking step of confirming intrusion information posted on the blackboard, a threshold value checking step of comparing the intrusion level value of the intrusion information with a preset threshold value, and if the threshold value is larger than the threshold value, Host intrusion board level transition step of increasing the intrusion level on the black sidewalk of the host and the black board In addition to proceeding with the blackboard searching and viewing step of transmitting information retrieval and reading messages having the information of the level of the intrusion board to the other hosts, the intrusion level response step is the network of the blackboard. A network intrusion board identification step of identifying an intrusion board, a network intrusion board level transition step of transitioning a network intrusion level of all hosts to the highest intrusion level of each host intrusion level, and a level of the network intrusion board of the blackboard; Blackboard searching and viewing step to send information search and reading message with transferred information to search and view to other hosts, and intrusion level to confirm that the level of network intrusion board is intrusion level and severity level Confirmation step and the intrusion if the intrusion attention level It is preferable to proceed to the packet difference step of blocking packets flowing into the host or blocking all packets flowing into the entire network including the main host in the case of intrusion seriousness level.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

1 is a block diagram briefly showing the overall configuration of the present invention. Referring to FIG. 1, the host 10, the main host 20, and the administrator host 30 are largely configured, and the host 10 operates an intrusion detection system (IDS) in a network environment. It may be desirable to further include an intrusion information database in which intrusion information for intrusion is accumulated and stored. The intrusion information includes contents such as the time of collecting the packet flowing into the host or the IP address of the attacker.

Meanwhile, the main host 20 includes a host controller 21, a black board 22, a host intrusion board 23, and a network intrusion board 24. The main host 20 includes the black board. A host control unit 21 is provided to allow a host other than the intruded host to view the intrusion information and the intrusion level disclosed in (22), and to control packets flowing into the host or the entire host according to the intrusion level.

At this time, the host control unit 21 is set to a threshold value that is a criterion for the intrusion level is transferred according to the intrusion information from the outside posted on the blackboard 22, the two or more hosts receive the intrusion to increase the corresponding host intrusion level When transitioned, the intrusion level of the entire host is transferred on the blackboard 22 to the host intrusion level of the highest host, and according to the intrusion level, packets transmitted from the intrusion are blocked by the firewall or flowed into the entire network. All packets are blocked by the firewall. The threshold is a value that reflects how many attacks have been performed on the host or network. The threshold is set by the system administrator according to his system (main host in this embodiment) or by the policy for protecting the entire network. To increase the security of the threshold to a lower value, and to mitigate the security part, it is desirable to set the threshold higher.

In addition, the blackboard 22 is the intrusion information is posted by the intruded host so that the intrusion information created by the externally intruded host among the host can be shared between the other hosts, the intrusion degree based on the intrusion information As a result, the intrusion level is differentially applied to the invading host and mounted in the shared memory formed in the main host. For example, if the intrusion degree is viewed by the attacker's IP address, the threshold is a value that reflects how long the attack has been conducted on the network. You can see how many packets per second are currently entering the network, and compare the number of attacker's IP addresses and the preset number with the number of attackers entering the packet collection time. It will be apparent that the number of packets per second is also internally set as a threshold.

In this case, the black board 22 has a host intrusion board 23 and the network intrusion board 24, the host intrusion board 23 is a host intrusion of the external intrusion into a single host state alone The information is posted and the level transition of the host according to the intrusion level is generated, and the intrusion level is divided into five stages, the intrusion attempt level, the intrusion boundary level, the intrusion attention level, the intrusion seriousness level, and the intrusion damage level. Metastasize in the phase.

In addition, the network intrusion board 24 is a network intrusion information in the state that the external intrusion is invaded in at least two or more hosts are interposed to generate a level transition of the entire host according to the intrusion level, five intrusion levels in the network intrusion board It is divided into Intrusion Attempt Level, Intrusion Threshold Level, Intrusion Attention Level, Intrusion Severity Level, and Intrusion Damage Level.

On the other hand, the manager host 30 is formed to monitor the data processing of the main host 20, the setting of a threshold value and the like.

2 is a block diagram illustrating information flow between a host and a main host on a network according to an exemplary embodiment of the present invention. Referring to FIG. 2, the present invention detects an intrusion from the outside and performs a message transfer process for responding to the intrusion. First, in the host A 11 that detects the intrusion from the outside, In order to create the corresponding information and publish it on the blackboard 22 formed on the main host 20, the blackboard update request message ① is transmitted to the host controller 21 of the main host 20, and the host is received. The control unit 21 transmits a blackboard update permission message ② to approve the update to the host A 11.

Thus, host A 11 accesses the blackboard 22 and starts to perform a blackboard update (③), and transmits a blackboard update complete message ④ indicating that the posting is completed to the host controller 21, The host controller 21 transmits the posted information of the blackboard 22 to all hosts 12 and 13 (host B and N in this embodiment) in the network. When the other host (12, 13) receives the transmission to access the blackboard 22, and then proceeds to search and read the blackboard information (⑥), all the hosts (12, 13) search And when the reading is finished, and transmits the blackboard information reading completion message (⑦) to the main host 20, respectively, the connection is terminated.

3 is a block diagram showing a method of operating a blackboard-based network security system according to an embodiment of the present invention. Referring to FIG. 3, the host intrusion step S1, the blackboard update step S2, the intrusion level application step S3, and the intrusion level correspondence step S4 are roughly performed.

The host intrusion step (S1) is a process in which intrusion from the outside to a plurality of hosts existing on the network, which is a threat on the network (DOS: Denial of service), sniffing, forgery (IP spoofing), avoidance (PPP, Source Routing), stop function (ICMP).

When the blackboard update step (S2) receives an intrusion from the threats as described above and detects the intrusion, the intrusion information is posted on the blackboard 22 formed on the main host 20 by the host. Updates are made to

In the intrusion level application step (S3), the host controller 21 checks the intrusion information posted on the blackboard 22 and compares it with a threshold value that is a criterion that can be determined as a preset intrusion. Differently set the intrusion level.

The intrusion level correspondence step (S4) is for countermeasures such as blocking packets flowing into the host or packets entering the entire network according to the level of the intrusion level.

4 is a flowchart illustrating a method of operating a blackboard-based network security system for host intrusion according to an embodiment of the present invention. Referring to FIG. 4, first, one host among a plurality of hosts will be described based on the intrusion from the outside.

When an intrusion occurs to the host A 11 from the outside (S11), the host A 11 is generated to invade the request to update the blackboard to the host controller 21 to update it to the blackboard 22 is generated. Proceed with the blackboard update request step of sending a message (S12),

After receiving the blackboard update request message (S13), the host controller 21 confirms that the host is associated with itself, and then sends a blackboard update permission message to allow the blackboard 21 to update the intrusion information. 11) proceeds to the blackboard update permission step of transmitting (S14),

The host 11 receiving the blackboard update permission message (S15) creates the intrusion information data (S16) and transmits it to the blackboard 22 (S17), and sends the intrusion information to the blackboard 22. When it is posted (S18) (S19), Host A 11 creates a blackboard update completion message (S20) and proceeds to intrusion information posting step of transmitting it to the host controller 21 (S21),

The host controller 21 receiving the blackboard posting completion message (S22) proceeds with the intrusion information checking step (S31) to confirm the intrusion information posted on the blackboard 22,

After converting the intrusion information data published on the blackboard 22 into a numerical value, it is a predetermined threshold value, that is, a reference value that can be determined as an intrusion, and this value is based on accumulated data on past intrusions or numerical value with expected data. If the value is larger than the threshold (S32), the threshold value determination step is determined to be an intrusion. If the value is larger than the threshold value, the host is determined to be an intrusion. The host intrusion board level transition step of transitioning the level of intrusion, that is, level up or down (S33),

When the level of the host A 11 is adjusted, the blackboard update completion broadcast message is transmitted to the remaining hosts (N host 13) except for the host A 11 (S51). After receiving this (S52), after accessing the blackboard 22 (S53), after searching and reading intrusion information for the host A (11) posted on the blackboard 22 (S54) (S55), After the blackboard information search and reading completion message is created and transmitted to the host control unit 21 (S56), the board searching and viewing step is performed, and the blackboard reading completion message is received (S57). In accordance with the intrusion information of the host A 11, the level of the entire host 13 is also changed in the same manner (S58), and after processing the host intrusion level accordingly (S70), the host other than the main host 20 ( 13 is terminated (S80), and if the intrusion continues in the host A (11) (S81) and (S11) and The will start again.

On the other hand, the process of processing the host intrusion level (S70) of the above will be described in FIG.

5 is a flowchart illustrating a host intrusion level processing step according to an embodiment of the present invention. Referring to FIG. 5, the host controller 21 performs a host intrusion board verification step of confirming (S71) the blackboard host intrusion board 23 formed on the black board 22, and then the host intrusion level. After confirming, the intrusion severity level of the intrusion level is checked (S72) and proceeds to the intrusion severity level checking step, and all packets flowing into the host A that was invaded by the firewall (S73). Proceed to the packet blocking step.

6 is a flowchart illustrating a method of operating a blackboard-based network security system against network intrusion according to an embodiment of the present invention. Referring to FIG. 6, since the process of intrusion into the host described with reference to FIG. 4 is applied to a plurality of hosts, the process of FIG. 4 is repeatedly performed.

The process from (S11) to (S58) in FIG. 4 is the process (S11 ') to (S58') of host A (11) and the process (S11 ") of host B (12) in FIG. To (S58 "), but in FIG. 6, the progress of the host B 12 is performed after the process of the host A 11, but the intrusion from the outside is irregular and occurs simultaneously. Since the process of host A 11 and the process of host B 12 progress with time difference, it would be too obvious.

Detailed description of the process from (S11 ') to (S58 ") is omitted in the process in FIG. 6, and the following process is performed at the host level due to the host A (11) and host B (12). The network level is determined accordingly, and after processing the intrusion level based on the network level accordingly (S100), the connection between them is terminated (S200). In step S201, after checking whether the intrusion of the host B 12 occurs (S202), the process proceeds to (S11 ") or (S11"), respectively. This will be described with reference to FIG. 7.

7 is a flowchart illustrating a network intrusion level processing step according to an embodiment of the present invention. Referring to FIG. 7, the host controller 21 checks the network intrusion board 24 of the black board 20 in a state where the network intrusion level is transitioned (S101), and performs a network intrusion board check step. If the intrusion of the host A 11 and the host B 12 occurs, that is, if two or more host intrusions occur (S102), the intrusion level of the host A 11 and the host B 12 is compared (S103). If both sides are different, the network intrusion level of the entire host 13 is transferred to the highest intrusion level among the intrusion levels of the host A 11 and the host B 12 (S104), or if both intrusion levels are the same. (S103) the network intrusion board level transition step of transitioning the network intrusion level to the intrusion level (S105),

The corresponding information search and reading message is transmitted to another host (N host 13) so that other hosts 13 can search and read the information whose level of the network intrusion board 24 of the blackboard 22 is transferred. After (S110), the N-host 13 is connected to the blackboard 22 to perform a blackboard search and reading (S111), and then to the host controller 21 retrieves a blackboard information search and reading completion message To proceed (S112) to search and view the blackboard information,

When the level of the network intrusion board 24 is confirmed that the level of intrusion attention (S120) proceeds to the intrusion level checking step, blocking the packets flowing into the host (11, 12) to be invaded (S121), packet blocking step In addition to proceeding to, the network intrusion board 24 is confirmed that the level of the intrusion serious level (S122), when the intrusion level checking step, the entire network (11, 12, 13) including the main host 20 The packet blocking step of blocking all packets introduced into the network by the firewall (S123) is performed.

As described above, the blackboard-based network security system and its operation method according to the present invention provides an environment that can effectively evaluate various network security systems, and smoothly performs communication between security systems through the present invention. In addition, there is an advantage that it is easy to respond to the system according to the level of the blackboard. Also, it is advantageous to evaluate the performance of the security system through the environment and iterative simulation of various networks through the provided simulation environment. Not only exists, but it can be used to derive surveillance, predict the result, and cope with the real intrusion through simulation, so that it can be applied to the configuration of the security system operating in the actual network, and it can be applied to the security system that processes a large amount of data. Evaluate via simulation model This advantage can bring savings of time and money if it exists.

The present invention is not limited to the above-described embodiments, and it will be apparent that many modifications are possible by those skilled in the art within the technical spirit of the present invention.

Claims (19)

A plurality of hosts operating the intrusion detection system in a network environment; And Intrusion information including an attacker's IP address and packet collection time is posted by an intrusion host created by an external intrusion host among the hosts so that the intrusion information can be shared among the remaining hosts, and the packet is based on the intrusion information. Shared memory equipped with a blackboard that applies the intrusion level differentially to the invading host according to the degree of intrusion which is a comparison value based on a comparison between the number of attacker's IP addresses introduced at the collection time and the preset number, The host and the host control unit for controlling the packets flowing into the host or the entire host according to the intrusion level, and the other host to view the intrusion information and the intrusion level posted on the blackboard, characterized in that it comprises a main host formed Blackboard based network security system. The method of claim 1, wherein the host control unit Blackboard-based network security system, characterized in that the threshold value is set as a reference that is transferred according to the number of times the intrusion into the network during the set time in accordance with the intrusion information to the outside. The method of claim 1, wherein the blackboard Host intrusion board that displays host intrusion information in which external invasion is invaded to one host alone and causes level transition of the host according to the intrusion level. Blackboard-based network security system, characterized in that the network intrusion information of the state in which the external intrusion is invaded in at least two or more hosts is created, and the network intrusion board to generate a level transition of the entire host according to the intrusion level. The method of claim 3, wherein the blackboard It is divided into 5 intrusion levels in the host intrusion board, and is divided into intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level, and intrusion damage level. Blackboard based network security system. The method of claim 4, wherein Blackboard-based network security system, characterized in that the firewall blocks packets transmitted from the intrusion to the host at the intrusion severity level. The method of claim 3, wherein the blackboard It is divided into five intrusion levels in the network intrusion board, and is divided into intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level, and intrusion damage level. Blackboard based network security system. The method of claim 6, Blackboard-based network security system, characterized in that when two or more hosts are intruded and the host intrusion level is transferred, the intrusion level of the entire host is transferred on the blackboard to the intrusion level of the host that has transitioned to the highest level. . The method of claim 6, At the intrusion alert level, packets from the intrusion are blocked by the firewall, Blackboard-based network security system, characterized in that the firewall blocks all packets flowing into the network at the intrusion severity level. The method of claim 1, wherein the host is Blackboard-based network security system, characterized in that it further comprises an intrusion information database stored in the accumulated intrusion information for external intrusion. In a method of operating a blackboard-based network security system consisting of a main host equipped with a host and a controller for controlling the inflow of packets to the host and a plurality of hosts operating the intrusion detection system in the network environment , A host intrusion step in which an intrusion into one of the hosts from the outside proceeds; A blackboard update step of posting the information on the intrusion to the blackboard by the host; An intrusion level application step of setting the intrusion level differentially according to the intrusion level of the intrusion information posted on the blackboard; And And an intrusion level corresponding step of blocking a packet flowing into a corresponding host according to the intrusion level. The method of claim 10, wherein the intrusion level application step A method of operating a blackboard-based network security system, characterized in that it is applied to one of an intrusion attempt level, an intrusion boundary level, an intrusion attention level, an intrusion severity level, and an intrusion damage level. The method of claim 10, wherein the blackboard update step The host recognizes the intruded information, writes the intrusion information, and sends a blackboard update request information to the main host in order to publish the blackboard; A blackboard update permission step of confirming that the main host receiving the blackboard update request information is a registered host and transmitting blockboard update permission information for approving the update; And The host receiving the blockboard update permission information accesses the blackboard and proceeds to the attack information publication step of updating the attack information. The method of claim 10 or 11, wherein the intrusion level application step An intrusion information verification step of confirming intrusion information posted on the blackboard; A threshold value checking step of comparing the numerical value of the intrusion level of the intrusion information with a preset threshold value; A host intrusion board level transition step of adjusting the intrusion level on the black sidewalk of the corresponding host when the threshold value is larger than the threshold value; And Operation of a blackboard-based network security system, characterized in that for proceeding to the blackboard search and reading step of transmitting information search and reading messages having the information of the level of the blackboard to search and view to other hosts Way. The method of claim 10 or 11, wherein the intrusion level response step A host intrusion board checking step of checking a host intrusion board of the black board; An intrusion severity level checking step of confirming that the level of the host intrusion board is an intrusion severity level; And And if it is determined that the intrusion level is detected, proceeding to a packet blocking step of blocking a packet flowing into the host. In a method of operating a blackboard-based network security system consisting of a main host equipped with a host and a controller for controlling the inflow of packets to the host and a plurality of hosts operating the intrusion detection system in the network environment , A host attack step of invading at least two or more of the hosts from the outside; A blackboard update step of posting information on the intrusion into the blackboard by the host; An intrusion level application step of setting the intrusion level differentially in the host intrusion mode and the network intrusion mode according to the intrusion level of the intrusion information posted on the blackboard; And And an intrusion level corresponding step of blocking packets flowing into the host or the network according to the intrusion level. The method of claim 15, wherein applying the intrusion level And a host intrusion level and a network intrusion level are applied to one of intrusion attempt level, intrusion boundary level, intrusion attention level, intrusion severity level, and intrusion damage level. The method of claim 15, wherein the updating of the blackboard Each of the intruded hosts recognizes the intruded information, writes the intruded information, and transmits the blackboard update request information to the main host to post the intruded information to the blackboard; A blackboard update permission step of confirming that the main host receiving the blackboard update request information is a registered host and transmitting blockboard update permission information for approving the update; And The host receiving the blockboard update permission information accesses the blackboard and proceeds to the intrusion information posting step of updating the intrusion information. The method according to claim 15 or 16, wherein the attack level application step is An intrusion information verification step of confirming intrusion information posted on the blackboard; A threshold value checking step of comparing the numerical value of the intrusion level of the intrusion information with a preset threshold value; A host intrusion board level transition step of adjusting the intrusion level on the black coverage of each host if the threshold value is larger than the threshold value; And Blackboard-based network, characterized in that for proceeding to the blackboard search and reading step to send the information search and reading messages having the information of the level of the host intrusion board of the blackboard to search and read to other hosts How to use security system. 17. The method of claim 15 or 16, wherein the intrusion level response step A network intrusion board checking step of identifying a network intrusion board of the black board; A network intrusion board level transition step of transitioning the network intrusion level of the entire host to the highest intrusion level of each of the intrusion levels of the hosts; A blackboard searching and reading step of transmitting an information searching and reading message having information that has been at the level of the network intrusion board of the blackboard to search and read to another host; An intrusion level checking step of confirming that the level of the network intrusion board is an intrusion attention level and an intrusion serious level; And In the case of the intrusion attention level, a packet blocking step is performed to block packets flowing into the intruded host or to block all packets entering the entire network including the main host in the case of intrusion serious level. Operating method of network security system.