KR100599929B1 - Method for Data Process of Agent Layer of ISM System - Google Patents

Abstract

The present invention relates to an agent layer data processing method of an intelligent integrated security management system, the purpose of which is to collect resource information, log information collection / conversion / analysis, alarm history through a separate security system agent manager and management console In the integrated information security management method by the agent transmitting and monitoring, the process of creating a resource information agent identification object in each system, the process of creating a resource information agent transmission object, resource call information setting of each system and alarm alert information Setting, waiting for a message sent from each system, creating and initializing each resource information object of a given system among waiting for receiving a message, and analyzing a log collection message by a sending object of each system. Process, the log information message of each system is newly Generating a sorting information, including a process for setting the automatic execution command is changed according to the reset command from the manager server is characterized in that is made.

ISM, intelligent integrated security management system, resource information, automatic execution command, file log, agent, manager server,

Description

Agent layer data processing method of intelligent integrated security management system {Method for Data Process of Agent Layer of ISM System}

1 is an agent layer data processing system diagram of an intelligent integrated security management system for implementing the present invention,

2 is a flowchart of a resource information agent data processing process of the intelligent integrated security management system according to an embodiment of the present invention,

3 is a flowchart of a data processing process of an auto-execution command agent of an intelligent integrated security management system according to an embodiment of the present invention,

4 is a flowchart of a filelog agent data processing process of an intelligent integrated security management system according to an embodiment of the present invention.

<Description of Symbols for Major Parts of Drawings>

101: firewall system 102: public security tool system

103: IDS system 110: agent layer

121, 122: router system 130: proxy agent server

200: manager server

The present invention relates to an intelligent enterprise security management (hereinafter, referred to as 'ISM') system, and more specifically, system resource information and use from a system in which various security devices are configured by a single module. Collects logs generated by status and status information and security software, collects resource information and security event logs of routers or all-in-one devices that do not have agent modules, and transmits them to Manager and Console, and collects logs. The present invention relates to an agent layer data processing method and apparatus of an ISM system that receives a filter, an abbreviation, an alarm, and a scenario rule from a manager.

An integrated security management system that generally combines security solutions such as firewalls, intrusion detection systems, and virtual private networks. Recently, enterprise security management (ESM) has been developed and expanded from the integrated management level to enterprise resource management systems such as system resource management (SMS) and network management system (NMS). The ESM has the advantage that companies can reduce redundant investment and waste of resources due to the installation of different types of security solutions, and can establish a security policy for the entire information communication system through interoperation between the solutions.

As one of the security solutions, the intrusion detection system is a system for detecting intrusion or unauthorized processes in a network environment, and classifies risks according to a detected pattern to alert an administrator to a detection result.

However, these intrusion detection systems have a variety of types of detection patterns or classification of risk definition criteria detection patterns for each manufacturer, so that the detection results reported to the administrator are not accurate and cause confusion.

Therefore, when various types of intrusion detection systems are used together for large-scale enterprise-wide security management, each intrusion detection system shows different results for the same intrusion pattern, and the security management is performed by analyzing these logs. do.

The analysis of logs generated by various intrusion detection systems is performed by first dividing the categories by logs and redefining the risks, and manually comparing the defined risks and categories.

However, it is almost impossible to do these tasks manually in a situation where tens of thousands to tens of thousands of event logs are generated in a short time. Furthermore, this problem is more serious in security management, in which speed is an important factor.

Therefore, due to these problems, it is virtually impossible to perform consistent risk management and comprehensive security management using various intrusion detection systems, and it is also impossible to provide integrated security management services to various customers.

In addition, the ESM according to the prior art establishes a security policy for integrated security management, implements a system according to the established security policy, and monitors this or provides a series of workflow functions such as providing various alarm functions for quick and effective actions. It is to be consistently supported.

Such ESM monitors the security status by integrating centrally to prevent loss of resources and manpower for monitoring individual security equipment such as intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system, and server security system. By doing so, it is a system that implements centralized security management. Its function is to implement security management for unit security equipment, alarm system for security threat, and processing system function by three-layer structure.

However, the ESM according to the related art is capable of simple state management only when managing agents, does not support the functions of responding to threats such as multi-layer, multi-device (MMD) and asset management (ISMD), and responds to infringement. Also, there is no automatic response function in real time, and technical and administrative measures are not supported. In addition, there was a problem that can not support the function for the fault management (Fault Tolerance).

The present invention is to solve the above-mentioned problems of the prior art, the purpose of which is composed of a single module, the system resource information, usage status and status information and the log generated by the security software from a system equipped with various security equipment Collect or transmit resource information and security event log of router or all-in-one device that is not equipped with agent module to Manager and Console, and collect log, filter, abbreviation, alarm, scenario rule ) Provides an agent layer data processing method of an ISM system receiving a) from a manager.

Agent layer data processing of the ISM system according to the present invention for achieving the object of the present invention through the agent from the individual security systems, including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system, server security system An integrated information security management method by an agent for collecting resource information, collecting / converting / analyzing log information, generating alarm history, and transmitting the generated alarm information to a manager server and a management console, wherein the resource information agent identification object is generated in each system. A first process, a second process of generating the resource information agent transmission object, a third process of setting resource call information setting and alarm initiation information of each system, and receiving a message transmitted from each system The fourth step of performing the process and each resource information of a predetermined system A fifth step of generating and initializing the object; and extracting and normalizing resource information from log collection messages of the transmission objects of the respective systems, filtering the normalized resource information, and extracting alarm triggering information to transmit to the manager server. And the log information message of each system includes a seventh step of generating new log classification information and an eighth step of setting an automatic execution command changed according to a reset command in the manager server.

Another method for achieving the object of the present invention is to collect resource information, log information collection / through various agent modules from individual security systems, including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system, server security system In the integrated information security management method by the agent that generates the conversion / analysis, alarm history and transmits it to the manager server and the management console, the first step of creating an identification object for identifying the agent in each system, and the manager A second process of creating a storage object for storing an auto-run command message in each system when an event occurs from a server, a third process of transmitting a state of the auto-run command agent, and a standby state for receiving a message from the manager server; A fourth process of maintaining and the sender in the message reception standby state A fifth process of processing the auto-execution command change message by receiving the automatic execution command change message; a sixth process of performing the auto-execution command according to the reception of the auto-execution command message by the transmitting object in the message reception standby state; 5, the sixth process, and returns to the message receiving standby state, and if the automatic execution command agent termination command by the user is input, the seventh process including deleting the distributed object and the transmission object stored in the memory and terminated do.

Another method for achieving the object of the present invention is to extract the information from the file storing the log in the individual security system, including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system, server security system manager server An integrated information security management method using a file agent transmitted to a system, the first process of generating a file agent identification object in each system, the second process of creating a file agent transmission object in each system, and each system A third process of creating a file agent storage object and setting an alarm command information of the file agent, a fourth process of waiting for receiving a message from each system, and message information if there is a new log in a file of a transmission object among the message reception waits. Log file collected after extracting message normalization time from Process to extract the message scenario alarm information by filtering the data and transmit the message scenario alert information to the message middleware, and to set a new file message and a new auto execution command rule when a new and change request message by the transmission object is input while the message is waiting to be received. Characterized in that it comprises a sixth process to perform.

When described in detail with reference to the accompanying drawings an embodiment of the present invention made as follows.

1 is a structural diagram of an ISM system for implementing an agent layer data processing method of an ISM system according to an embodiment of the present invention, and includes a firewall system agent 101, a public security tool agent 102, and an IDS system agent 103. Through the security system agent, including the resource information collection, log information collection / conversion / analysis, alarm history of each security system through the agent layer 110 to transmit to the communication middleware, and through the router system 121, 122 Collect and store resource information, log information collection / transformation / analysis, proxy agent server 140 generating alarm details, and logs generated from the agent layer 110 and proxy agent server 140 and storing each agent. It consists of a manager server 200 for transmitting various rule settings of the agent.

Here, the security system agents 101 to 103 are operating system (OS) -mounted agents and collect logs generated by system resource information, usage status and status information, and security software from a system equipped with various security equipment.

The proxy agent server 140 collects resource information and security event logs of a router or an integrated device on which the agent module is not installed and transmits them to the manager server 200.

The operation according to the embodiment of the present invention configured as described above will be described in more detail with reference to FIGS. 1 to 4 as follows.

First, the agent layer according to the present invention is a layer for generating resource information collection, log information collection / transformation / analysis, and alarm history of the security system and transmitting them to the manager server and the console. The form is a general agent layer form and a proxy agent. It consists of log converter, resource information collection, 'SYSLOG' module, file read module, 'ASEN' module, and 'OPSEC' module. In particular, the agent module consists of one module, and only the part operates according to the configuration of the agent in the management console.

2 is a resource information agent data flow diagram of an agent layer of an ISM system according to an embodiment of the present invention.

As shown in the drawing, each system 101 to 103 provides a function for identifying a corresponding agent by generating a resource information agent identification object (S102).

Create the resource information agent transmission object (S104).

The resource call information setting and alarm command information are set. That is, it provides information and alarm alert information management functions that can call resources such as CPU, disk, memory, and processor of the corresponding unit equipment (S106).

The message reception system maintains a message reception standby state, receives a message by a transmission object, and generates and initializes a resource information object such as a CPU, a disk, a memory, and a processor in real time by a resource information timer. S118)

 Here, the resource information timer analyzes the information of the transmitted message and performs a function of branching to generate an object of a CPU, a disk, a memory, and a processor.

After the initialization process of the resource information object generation by the message timer to return to the message receiving wait step (S108), at this time, the resource information alarm time is synchronized to initialize the reference time of the alarm rule of the entire resource information by applying the current time Perform the function (S150) (S152).

The log is collected in the message reception standby state (S108) by the communication message transmission system, and when the resource information message is received (S120), resource information is extracted (S122), and the parsed information is extracted from the extracted resource information. That is, the collected resource information is normalized, the normalized resource information is filtered (S126), and the alarm alert information is extracted from the filtered resource information (S128). Transmission to the manager server 200. (S129)

When the resource information extraction rule is changed in the message reception standby state by the communication message transmission system, if the log information message is the new log information from the manager server 200, the new message is generated and then the reception message is waited again (S108). Will return. (S130) (S132)

When the message received in the message receiving step (S108) by the communication message transmission system receives a change message for the default setting value of the autoexecuting command issued to the predetermined agent from the manager server 200, The rule is changed and set. (S140) (S142)

If the user wants to terminate the resource information agent from the manager server 200, the resource information agent is terminated after deleting the distributed object and deleting the transmission object through the message timer S150 (S150) (S154). )

3 is a flowchart of a data processing process of an auto execution command agent of an ISM system according to an embodiment of the present invention, wherein the auto execution command agent automatically executes a corresponding command in a server when an event occurs from a scenario manager. The agent in charge.

As shown in the figure, first, an identification object for identifying a corresponding agent is generated (S202). That is, after generating an identification object for identifying where an auto execution command agent is installed, an auto execution command is received. Create a storage object to manage the storage location can be (S204).

Manages the state of the automatic execution command agent, and maintains the message reception waiting state by the communication message transmission system after transmitting to the manager server 200 whether the normal standby state (S206) (S208).

If there is a change in the initial value of the automatic execution command by the transmission object in the message reception waiting state (S208), it receives a change message from the manager server 200 (S210).

The manager server 200 requests basic information on an auto execution command agent.

The manager server 200 requests information on an alarm condition, that is, at what point in time the command is to be executed (S213).

The manager server 200 requests normalization, filtering, and automatic execution command information on the received message. (S216)

After the automatic execution command change message is processed, the message timer returns to the message reception waiting state (S208).

If the automatic execution command message is received by the transmission object in the message reception waiting state (S208) (S220), the target server for the automatic command is distinguished from the message middleware (S221).

The execution command is processed by combining the commands in the received auto-run command message (S223).

After processing the execution command, the message timer returns to the message reception standby state (S208) again (S230).

If the user executes an automatic execution command agent termination command from the manager server 200, the stored distributed object is deleted and the transmission object is deleted after the user terminates the automatic execution command agent (S231).

4 is a flowchart of a file agent data processing process of an ISM system according to an embodiment of the present invention, which automatically collects information generated from a file log storing a log of each system and transmits the information to the manager server 200. It provides the function to monitor the status of the program to be monitored in real time.

As shown in FIG. 4, first, an identification object for identifying the corresponding agent is generated (S302). That is, after generating an identification object for identifying where the file agent is installed, the file log can be received. Create a storage object to manage the storage location (S304).

After setting file agent information and alarm command information in each of the systems, a message reception waiting state by the communication message transmission system is maintained. (S306) (S308)

If there is a new log in the file log received by the transmission object in the message reception standby state (S308), message information is extracted (S312).

After the extracted message is normalized and filtered, alarm information is extracted from the filtered message and returned to the message receiving step by the message timer (S310) (S340).

At this time, the data is collected from the log file, the collected data is filtered, and then a message is transmitted to the manager server 200. (S342 to S346).

If there is an alert rule change request for adding a new alert rule by the transmitting object in the new message reception standby state (S308), a new alert rule message is received (S320).

According to the received new alarm message, a new file alarm rule, a new resource information rule, a new log analysis rule, and a new auto execution command rule are set. (S322 to S328).

In addition, the storage object is continuously stored in the file agent log. At this time, the log timer is used to delete the past log information at a predetermined time interval to prevent the memory pool from being full (S330).

If a file agent termination command is issued from the manager server 200 by the user, the stored distributed object is deleted and the transmission object is deleted after the file agent is terminated (S348).

 Although a preferred embodiment according to the present invention has been described above, modifications can be made in various ways depending on the form of the agent, and those skilled in the art can make various modifications without departing from the claims of the present invention. It is understood that examples and modifications may be made.

As described above, in the agent layer data processing method of the ISM system according to the present invention, each unit system can be monitored in real time using resource information, a file log, and an automatic execution command agent. It has the effect of quick response and the effect of automatically updating and managing the agent's rule setting, and each unit security system (firewall, IDS, IPS, VPN, server security system), network equipment, and application program with log. As a result, it is possible to establish an integrated management system for application servers.

Claims (17)

It collects resource information, collects / converts / analyzes and analyzes alarm information through the agent from individual security systems including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system and server security system, and manages manager server and management. In the integrated information security management method by the agent to transmit to the console, A first step of generating a resource information agent identifier in each system; A second step of generating the resource information agent transmission object; A third step of setting resource call information setting and alarm command information of each system; A fourth step of waiting for a message sent from each system; A fifth step of generating and initializing each resource information object of a predetermined system among the message reception waits; A sixth step of extracting and normalizing resource information from the log collection message by the transmission object of each system, filtering the normalized resource information, and extracting the alarm command information to transmit to the manager server; A seventh step of generating new log classification information in the log information message of each system; And And an eighth process of setting the changed auto-execution command according to the reset command in the manager server. The method of claim 1, The agent is an agent-based data processing method of the intelligent integrated security management system, characterized in that divided into a general operating system (OS) -mounted agent and proxy agent server. The method of claim 1, In the fifth process, the resource information object is created and initialized by including a central processing unit (CPU) information object, a disk information object, a memory information object, and a processor resource information object. Way. delete The method of claim 1, The resource information agent always maintains a standby state, and when terminated by a user, the agent layer data processing method of the intelligent integrated security management system, characterized in that further comprising the step of deleting the distributed object and the transmission object. The method of claim 1, Agent layer data processing method of the intelligent integrated security management system, characterized in that the time synchronization by the resource information timer for the real-time collection of the resource information. Manager server by generating resource information, log information collection / conversion / analysis, alarm history through various agent modules from individual security systems including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system, server security system In the integrated information security management method by the agent to monitor and transmit to the management console, A first step of creating an identifier for identifying an agent in each system; A second process of creating a storage object for storing an automatic execution command message in each system when an event occurs from the manager server; Transmitting a status of the auto-run command agent; A fourth step of maintaining a standby state for receiving a message from the manager server; A fifth step of processing the automatic execution command change message by the transmission object in the message reception standby state; A sixth step of performing an automatic execution command in response to receiving an automatic execution command message by the transmission object in the message reception standby state; and And a seventh process of returning to the message reception standby state after the fifth and sixth processes and deleting the distributed object and the transfer object stored in the memory and ending when the automatic execution command agent termination command is input by the user. Agent layer data processing method of an intelligent integrated security management system, characterized in that. The method of claim 7, wherein The agent is an agent layer data processing method of the intelligent integrated security management system, characterized in that divided into a general OS-mounted agent and proxy agent server. The method of claim 7, wherein The fifth step includes requesting basic information about an agent from the manager server when an automatic execution command change message is received by the transmission object; Requesting an alarm condition from the manager server; And Normalizing, filtering, and abbreviating / alarming the automatic execution command change message. The method of claim 7, wherein The sixth step may include extracting a command of a target server when an automatic execution command message is received by the transmission object; Combining the extracted instructions into execution instructions; And Agent layer data processing method of the intelligent integrated security management system comprising the step of processing the combined execution command. delete Integrated information security management method using file agent that extracts information from files storing logs in individual security systems including intrusion prevention system, intrusion detection system, vulnerability analysis system, antivirus system and server security system and transmits them to the manager server To Creating a file agent identifier in each of the systems; Creating a file agent transfer object in each system; A third process of creating file agent storage objects and setting alarm trigger information of each system; A fourth step of waiting for reception of a message from each system; If there is a new log in the file by the transmission object during the message reception wait, extract the message issuing time from the message information, normalize and then filter the data in the collected log file to extract the message scenario alert information and transmit it to the message middleware. 5 courses; And And a sixth process of setting a new file message and setting a new auto-execution command rule when a new and change request message by a transmission object is input while waiting for the message to be received. Agent of an intelligent integrated security management system, comprising: Hierarchical data processing method. The method of claim 12, The agent is an agent layer data processing method of the intelligent integrated security management system, characterized in that divided into a general OS-mounted agent and proxy agent server. delete The method of claim 12, The sixth process may include setting a new file alert rule as new and change request messages are inputted; Setting a new resource information rule; Setting a new log analysis rule; And Setting a new automatic execution command rule; agent layer data processing method of an intelligent integrated security management system, characterized in that comprises a. The method of claim 12, The file log information is agent layer data processing method of an intelligent integrated security management system, characterized in that further comprising the step of deleting the data over the set time. The method of claim 12, The file agent always maintains a standby state, and when the user terminates by the user, the distributed object deletion and the agent layer data processing method of the intelligent integrated security management system, characterized in that further comprising the step of deleting the transmission object.

Images