KR100798755B1 - Threats management system and method thereof - Google Patents

Abstract

The present invention relates to a threat management system and a method thereof, and related to various threat information generated from the entire network (hereinafter referred to as global network) currently operating around the world (hereinafter referred to as global event) and general companies. Provides network administrators with the risks calculated and collected in real time by collecting and analyzing events (hereinafter referred to as local events) related to threat information generated from a limited managed network (hereinafter referred to as local network) including the company or branch offices. do.

According to the present invention, internal IT assets (eg, web server, DB server, etc.) included in the network by the network administrator proactively respond to various threats to the network according to the risks calculated by collecting and analyzing global and local events in real time. ) Can be easily protected.

Network, threat management system, threat information, events, breach, IT

Description

THREATS MANAGEMENT SYSTEM AND METHOD THEREOF}

1 is a block diagram showing a threat management system according to the present invention.

2 is a flowchart illustrating a threat management method according to the present invention.

<Description of Symbols for Major Parts of Drawings>

100: threat management system 110: global DB

120: local DB 130: asset DB

140: threat management

The present invention relates to a network management system, and more particularly, to collect and analyze in real time a variety of threat information generated from a limited managed network including a whole network currently operating in the world and a company or branch office of a general company. It relates to a threat management system and a method of providing a risk to a network administrator.

In recent years, there has been a rapid increase in information security incidents through limited managed networks, including in-house or branch offices of general companies, as well as information security incidents across the entire network currently in operation worldwide. Losses related to disaster recovery (eg, web server, DB server, etc.) are increasing.

In addition, as the types of accidents such as invasion of the network change rapidly, various threat information is variously and complexly generated, and the attack form on the network is also based on system vulnerabilities, software defects, harmful traffic, and contents. As it is evolving into a multidimensional form, it is becoming increasingly difficult for network administrators to identify and prioritize threats against such threat information and to determine countermeasures. In some cases, it is impossible to respond to various threat information.

On the other hand, various unit security solutions have been introduced to cope with such various types of attacks, but in order to operate such a unit security solution, a large number of security management personnel are required, and each of these unit security solutions is different from other unit security solutions. Not only is it difficult to duplicate an event that occurs, but there is a disadvantage that a false positive occurs that causes a decrease in the reliability of the security alert.

Accordingly, the present applicant has developed a threat management system and method capable of promptly responding with minimum manpower by recognizing various threat information of various attack types in advance.

The present invention is to solve the conventional problems as described above, an object of the present invention is to provide an event related to various threat information generated from the entire network (hereinafter referred to as global network) currently operating in the world (hereinafter referred to as global Events and related events (hereinafter referred to as local events) related to threat information generated from a limited managed network (hereinafter referred to as a local network) including a company or a branch of a general company in real time. It is to provide a threat management system and method for providing the calculated risk to the network administrator.

In order to achieve the object of the present invention as described above, the threat management system according to an embodiment of the present invention, the global event and the currently stored global events given the authorization code and risk associated with the threat information generated from the global network A global DB in which the global comprehensive risk is stored in real time; A local DB storing local real-time risks from local events and currently stored local events that have been granted public codes and risks associated with threat information from local networks and corresponding internal IT asset IPs; An asset DB storing an internal IT asset IP included in the local network and a risk of each internal IT asset; And collects and analyzes events related to threat information generated from the global network in real time through external information security authorized agencies, assigns corresponding authorized codes and risks, stores them as global events of the global DB, and installs them on the local network. Collects and analyzes events related to threat information from local network in real time through the information security authorized organization of the company, assigns corresponding authorized codes, risks and corresponding internal IT asset IPs, and stores them as local events of the local DB. Whether or not the local event is given in the local DB that has been granted the official code matching the authorized code of the newly generated global event when collecting and analyzing the global event in real time, or when the local event is newly collected and analyzed in real time. The official code of the event And a threat management unit for calculating a final risk associated with a newly generated global event or a newly generated local event according to whether or not a global event having a matching authorized code exists in the global DB.

In order to achieve the object of the present invention as described above, the threat management method according to an embodiment of the present invention, the global event and the currently stored global events given the authorization code and risk associated with the threat information generated from the global network A first step of determining whether a local event, which has received an official code corresponding to the official code of a newly generated global event, exists in the local DB while storing the global comprehensive risk level in real time in a global DB; Local events, which are given the authorized codes and risks related to threat information from the local network, and corresponding internal IT asset IPs, and local comprehensive risks from the currently stored local events are stored in the local DB in real time. A second step of determining whether a global event that has been granted an official code corresponding to an official code exists in the global DB; If there is no local event in the local DB that is assigned an official code that matches the official code of the newly generated global event in the first process, the average value of the risk of the newly generated global event and the global total risk is finalized in relation to the newly generated global event. A third process of calculating risk; If there is a local event in the local DB that is assigned an official code that matches the authorized code of the newly generated global event in the first step, the average value of the risk of the newly generated global event and the risk of the local event is obtained, and then A fourth process of calculating an average value of the global comprehensive risk, the local comprehensive risk, and a risk value of an internal IT asset corresponding to the local event stored in the asset DB as a final risk level associated with a newly generated global event; If there is no global event in the global DB that has been granted an official code that matches the official code of the newly generated local event in the second process, the risk and the local comprehensive risk of the newly generated local event, and the local event stored in the asset DB A fifth process of calculating an average value of risks of internal IT assets corresponding to the final risks related to the newly occurring local event; If there is a global event in the global DB that has been granted an official code that matches the authorized code of the newly generated local event in the second process, the average value of the risk of the newly generated local event and the risk of the global event is obtained, and then A sixth step of calculating a mean value of the global comprehensive risk, the local comprehensive risk, and a risk value of an internal IT asset corresponding to the local event stored in the asset DB as a final risk related to a newly generated local event; And a seventh process of providing the network administrator with the final risk calculated in the third to sixth processes.

Hereinafter, with reference to the accompanying drawings an embodiment of the present invention will be described in more detail.

Referring to FIG. 1, the global DB 110 stores a global comprehensive risk level due to global events and globally received global events that are given an official code and a risk associated with threat information generated from a global network.

The global event risk is assigned by an administrator based on a vulnerability of a network predicted according to threat information currently generated from the global network.

The global event is managed in addition to the official codes and risks given by external information security certification agencies such as the Information Sharing & Analysis Center (ISAC) or the Computer Emergency Response Team (CERT) on the Internet. Include code, attack type, attack name, attack description, registration date, and so on.

The global comprehensive risk is assigned by an administrator based on a vulnerability of a network currently predicted according to global events stored in the global DB 110.

The global comprehensive risk includes not only the risk but also the registrant, the reason for the occurrence, the date of occurrence, and the like.

The local DB 120 stores real-time local risks due to local events and currently stored local events that have been granted the authorized codes and risks associated with threat information from the local network and corresponding internal IT asset IPs.

The local event risk is assigned by an administrator based on a vulnerability of a network predicted according to threat information currently generated from the local network.

The local event may include equipment, as well as authorized codes and risks and corresponding internal IT asset IPs, which are granted by an information security certification authority within a local network, such as an internal CERT which grants the same authentication code as an external information security certification authority. Include code, attack type, attack name, attack information, date of occurrence, countermeasures, etc.

The local comprehensive risk is assigned by an administrator based on a vulnerability of a network currently predicted according to local events stored in the local DB 120.

The local comprehensive risk includes not only the risk but also the registrant, the reason for the risk, the date of occurrence, and the like.

The asset DB 130 stores the internal IT asset IP included in the local network and the risk of each internal IT asset.

The risk of each internal IT asset is given by the manager according to the importance of each asset, and includes not only the risk but also the equipment code, IP information, use, administrator, registration date and time.

In the present invention, each of the risk is preferably given in five stages, 10 grades as follows.

1. Normal phase: Applied when events such as worm virus occurrence, hacking technique, and vulnerability disclosure occur due to normal network condition and usage.

Ratings: 0 (low), 1 (high)

Color: Green

2. Level of interest: Applied when events that increase the possibility of network damage, the spread of infringement incidents, and the occurrence of abnormal traffic occur due to the appearance of high-risk vulnerabilities and codes.

Grades: 2 (Low), 3 (High)

Color: Blue

3. Caution Step: Applied when an event that requires administrator's emergency response and enhanced security posture occurs such as causing local damage due to worm virus, hacking, local internet communication failure, service failure, etc.

Grade: 4 (low), 5 (high)

Color: Yellow

4. Boundary stage: Applied when an event occurs that causes damage to major telecommunications infrastructure or causes serious damage to the private sector, requiring cooperation and cooperative response in each area to resolve the situation.

Grades: 6 (low), 7 (high)

Color: Orange

5. Severe stage: Applied to cases where service failure occurs due to communication obstacles in all areas of the domestic Internet or damage to information and communication infrastructure, and events that require national cooperative response due to the impossibility of using the private Internet.

Grades: 8 (Low), 9 (High)

Color: Red

The threat management unit 140 may be a threat generated from a global network through an external authorized information security agency such as an information sharing & analysis center (ISAC) or a computer emergency response team (CERT) on the Internet. Collecting and analyzing the event related to the information in real time to give a corresponding authorized code and risk to store as a global event of the global DB (110).

The threat management unit 140 collects and analyzes events related to threat information generated from the local network in real time through an internal information security certification authority (for example, internal CERT of the local network itself) installed in the local network and responds to the authorized. A code, a risk, and a corresponding internal IT asset IP are assigned and stored as a local event of the local DB 120.

When the global event is collected and analyzed in real time, the threat management unit 140 checks whether or not the local event is given in the local DB 120 or the local event which has been granted an official code that matches the authorized code of a newly generated global event. When collecting and analyzing in real time, the final risk associated with a newly generated global event or a newly generated local event depends on whether or not a global event in which the official code matches the authorized code of a newly generated local event exists in the global DB 110. Calculate and provide to the network administrator

If there is no local event in the local DB 120, the threat management unit 140 generates a new average value of the risk of the newly generated global event and the average global risk. Calculate the final risk associated with a global event.

The threat management unit 140 obtains an average value of the risk of the newly generated global event and the risk of the local event when the local event that has received the authorized code that matches the authorized code of the newly generated global event exists in the local DB 120. The average value of the average value and the global comprehensive risk, the local comprehensive risk, and the risk value of the internal IT asset corresponding to the local event stored in the asset DB 130 are calculated as the final risks related to the newly generated global event.

The threat management unit 140, if there is no global event in the global DB 110 that has received an official code that matches the official code of the newly generated local event, the risk and the local comprehensive risk of the newly generated local event, and the asset DB The average value of the risk of the internal IT asset corresponding to the local event stored at 130 is calculated as the final risk related to the newly occurring local event.

The threat management unit 140 calculates an average value of the risk of the newly generated local event and the risk of the global event when the global event that has received the authorized code that matches the authorized code of the newly generated local event exists in the global DB 110. Afterwards, the average value of the average value of the average IT risk corresponding to the local event stored in the global comprehensive risk, the local comprehensive risk, and the asset DB 130 is calculated as the final risk level associated with the newly generated local event. .

The threat management unit 140 provides the final risk level through any one of a pop-up screen, an E-mail, an SMS, and a speaker of the network manager console.

The threat management system 100 according to the embodiment of the present invention configured as described above operates as follows by the method shown in FIG.

The threat management unit 140 stores the global comprehensive risk due to the global events and the currently stored global events, which are granted the official code and the risk associated with the threat information generated from the global network, in real time in the global DB 110 (S100). In step S110, it is determined whether there is a local event in the local DB 120 that has received an official code that matches the official code of the newly generated global event.

In addition, the threat management unit 140 displays a local DB (local risk) by the local events and the currently stored local events given the authorized code and the risk and the corresponding internal IT asset IP associated with the threat information generated from the local network (local DB ( While storing in real time (120) (S120) it is determined whether the global event that has been granted the official code matching the authorized code of the newly generated local event in the global DB (110) (S130).

Processes S100 and S110 and S120 and S130 performed by the threat management unit 140 may change the front and rear of the process according to an event occurring first among the global event and the local event.

If the global event occurs earlier than the local event, the threat management unit 140 performs the steps S100 and S110 before the steps S120 and S130 to sequentially perform the following steps S140, S150, and S160.

That is, if there is no local event in the local DB 120 that has been granted an official code that matches the official code of the newly generated global event in step S110, the threat management unit 140 is the risk of the newly generated global event and the global synthesis. The average value of the risk is calculated as the final risk related to the newly occurring global event (S140).

On the other hand, if there is a local event in the local DB 120 that has been granted the official code matching the authorized code of the global event newly generated in step S110, the threat management unit 140 is the risk of the newly generated global event and the local After calculating the average value of the risk of the event (S150), the average value of the average value of the internal IT asset corresponding to the local event stored in the asset and the global comprehensive risk, the local comprehensive risk, and the asset DB 130 is newly generated. The final risk associated with the global event is calculated (S160).

On the other hand, if the local event occurs before the global event, the threat management unit 140 performs the steps S120 and S130 before the steps S100 and S110 to sequentially perform the following steps S170, S180, and S190. do.

In other words, if there is no global event in the global DB 110 that has been granted an official code that matches the official code of the newly generated local event in step S130, the threat management unit 140 may determine the risk of the newly generated local event and the local synthesis. The average value of the risk and the risk value of the internal IT asset corresponding to the local event stored in the asset DB 130 is calculated as the final risk related to the newly generated local event (S170).

On the other hand, if there is a global event in the global DB (110) that has been granted the official code matching the official code of the newly generated local event in the step S130, the threat management unit 140 is the risk of the newly generated local event and the global After calculating the average value of the risk of the event (S180), the newly generated average value of the average value and the global comprehensive risk, the local comprehensive risk, and the average value of the risk of the internal IT asset corresponding to the local event stored in the asset DB 130. The final risk associated with a local event is calculated (S190).

If the final risk is calculated as described above, the threat management unit 140 provides to the network administrator through any one of the pop-up screen, E-Mail, SMS, speakers of the network manager console (S200).

Accordingly, the network manager can proactively respond to various threats to the network to easily protect internal IT assets (eg, web server, DB server, etc.) included in the network.

The threat management system and method thereof according to the present invention described above are not limited to the above-described embodiments, and have a general knowledge in the field of the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone who grows has the technical spirit to the extent that anyone can make various changes.

According to the present invention as described above, the event related to the threat information generated from the entire network currently operating in the world and the event related to the threat information generated from the limited managed network including the company or branch of the general company According to the risks calculated and collected in real time, network administrators can proactively respond to various threats to the network to easily protect internal IT assets (eg, web server, DB server, etc.) included in the network.

Claims (8)

delete delete A global DB 110 in which global events, which are given global codes and risks that are authorized with threat codes generated from global networks, and global comprehensive risks of currently stored global events, are stored in real time; A local DB 120 storing local real-time risks by local events and currently stored local events that have been granted public codes and risks associated with threat information originating from a local network and corresponding internal IT asset IPs; An asset DB 130 in which an internal IT asset IP included in the local network and a risk of each internal IT asset are stored; And Collects and analyzes events related to threat information generated from the global network in real time through external information security authorized agencies, assigns corresponding authorized codes and risks, stores them as global events of the global DB 110, and stores them in the local network. Collect and analyze events related to threat information from the local network in real time through the installed internal information security certification authority to assign corresponding authorized codes, risks, and corresponding internal IT asset IPs to the local DB 120 In the event of storing and analyzing the global event in real time, it is determined whether the local event that has received the official code that matches the official code of the newly generated global event exists in the local DB 120, and newly generated global event. Locally assigned an official code that matches the public code of If the vent does not exist in the local DB 120, the risk of the newly generated global event and the average value of the global comprehensive risk are calculated as the final risks related to the newly generated global event, and an official code that matches the official code of the newly generated global event is calculated. If the given local event exists in the local DB 120, the average value of the risk of the newly generated global event and the risk of the local event is obtained, and then the average value, the global comprehensive risk, the local comprehensive risk, and the asset DB ( A threat management unit (140) for calculating a mean value of risks of internal IT assets corresponding to the local events stored in the final event as final risks related to newly generated global events and providing them to the network administrator; Threat management system, characterized in that consisting of. delete A global DB 110 in which global events, which are given global codes and risks that are authorized with threat codes generated from global networks, and global comprehensive risks of currently stored global events, are stored in real time; A local DB 120 storing local real-time risks by local events and currently stored local events that have been granted public codes and risks associated with threat information originating from a local network and corresponding internal IT asset IPs; An asset DB 130 in which an internal IT asset IP included in the local network and a risk of each internal IT asset are stored; And Collects and analyzes events related to threat information generated from the global network in real time through external information security authorized agencies, assigns corresponding authorized codes and risks, stores them as global events of the global DB 110, and stores them in the local network. Collect and analyze events related to threat information from the local network in real time through the installed internal information security certification authority to assign corresponding authorized codes, risks, and corresponding internal IT asset IPs to the local DB 120 In the event of storing and analyzing the local event in real time, it is determined whether a global event, which has received an official code that matches the official code of a newly generated local event, exists in the global DB 110, and newly generated local event. Globally assigned an official code that matches the official code of If the event is not present in the global DB 110, the newly generated local event may include an average value of a risk of the newly generated local event, the local comprehensive risk, and an average value of an internal IT asset corresponding to the local event stored in the asset DB 130. If the global event is calculated in the final risks associated with the global event, and the global event has been given the official code that matches the official code of the newly generated local event, the average value of the risk of the newly generated local event and the global event is calculated. After calculating, the average value and the average value of the global comprehensive risk, the local comprehensive risk, and the average value of the risk of the internal IT asset corresponding to the local event stored in the asset DB 130 are calculated as the final risks related to the newly generated local event. A threat management unit 140 provided to the network administrator; Threat management system, characterized in that consisting of. The threat management unit of claim 3 or 5, wherein the threat management unit 140 provides the final risk level through any one of a pop-up screen, an E-mail, an SMS, and a speaker of a network manager console. system. Certified globally received risks from the global network, and the global comprehensive risks from the currently stored global events in real time in the global database (110) (S100) A first step (S110) of determining whether a local event that has been granted an official code corresponding to a code exists in the local DB 120; While storing the local comprehensive risk due to local events and currently stored local events that are granted the authorized code and risks associated with threat information from the local network and corresponding internal IT asset IP in real time (S120) A second step (S130) of determining whether a global event, which has been granted an official code corresponding to an official code of a newly generated local event, exists in the global DB 110; If there is no local event in the local DB 120 that has received an official code that matches the official code of the newly generated global event in the first process, the global event newly generated the average value of the risk of the newly generated global event and the global total risk. A third step (S140) of calculating a final risk level associated with the risk; If there is a local event in the local DB 120 that has been granted an official code that matches the authorized code of the newly generated global event in the first process, after calculating the average value of the risk of the newly generated global event and the risk of the local event ( S150), the average value of this average value and the global total risk, the local total risk, and the average value of the risk of the internal IT asset corresponding to the local event stored in the asset DB 130 are calculated as the final risk level in relation to the newly generated global event. A fourth process (S160); If there is no global event in the global DB 110 that receives an accreditation code corresponding to the accreditation code of the newly generated local event in the second process, the risk and the local comprehensive risk of the newly occurring local event, and the asset DB 130 A fifth step (S170) of calculating an average value of risks of internal IT assets corresponding to the local event stored in the final event as a final risk related to a newly generated local event; In the second process, if the global event that has received the official code corresponding to the official code of the newly generated local event is present in the global DB 110, after calculating the average value of the risk of the newly generated local event and the risk of the global event ( S180), the average value of the average value of the global combined risk, the local combined risk, and the risk of the internal IT asset corresponding to the local event stored in the asset DB 130 is calculated as the final risk related to the newly generated local event. A sixth process (S190); And A seventh process (S200) of providing the network administrator with the final risk calculated in the third to sixth processes; Threat management method, characterized in that made. 8. The threat management method according to claim 7, wherein in the seventh step (S200), the final risk is provided through one of a pop-up screen, an E-mail, an SMS, and a speaker of a network manager console.

Images