KR100992066B1 - An enterprise security management system using an 3d picture - Google Patents

Abstract

PURPOSE: An enterprise security management system using a 3D picture is provided to briefly and clearly display security events and generate statistical data for the security events on a 3D screen so that a user may recognize the states of the events and take a measure for the events. CONSTITUTION: An information collecting unit(10) collects and stores security event data from security devices, and an information processing unit(30) sorts and processes the security data. An information display unit(50) displays the sorted security events through a 3D screen. In addition, the information display unit displays an alarm generation status which indicates the type, frequency, corresponding sites of the security events.

Description

An Enterprise Security Management System using an 3D Picture}

The present invention relates to an integrated security control system for controlling the security of a site, and more specifically, when, where, where, what type of security events occur on a three-dimensional screen, and how many times, The user can grasp the status of security events occurring in the security management system in a short time by quickly displaying the site's exposure to the security risks and displaying them intuitively. In addition to the simple storage of transmitted and collected security event data, it can be displayed through the information display section by security event type, by security equipment, or by the moisture, hourly, daily, weekly, monthly statistics of the whole system. Generate real-time security event by generating data and classifying and storing it separately Status and have the necessary statistical data can be immediately displayed to the user on the integrated security management system using a three-dimensional screen that allows you to respond immediately and effectively to security violations.

In the conventional integrated security control system that manages network security, security event data generated through the display has been visualized and represented.

However, in the case of the screen displayed on the conventional security management system, the status of the security event occurring by using a table or a graph is displayed only in the form of a large number of security event data occurs when the user of the security management system at a glance It is very difficult to recognize at once.

In addition, the existing method of displaying a map on the screen and connecting the security event occurrence point and the security event destination point also helps to identify the origin and destination of the security event, but when the security event, There is also a limit to how quickly and intuitively the user is aware of how they change over time, how they change over time, and what the current state of security alerts are on their sites.

Therefore, the user can be intuitively aware of how, when, where, where, and in what form, and how the security events occurring on the system on one screen are displayed and what risks they have. There is a need for a system that enables the system to respond efficiently to situations.

The present invention has been made to solve the above problems,

It is an object of the present invention, when, where, where, what type of security events occur on which three-dimensional screen, how many times, how they change over time, and how much security the site has 3D enables users to grasp the status of security events occurring in the security management system in a short time and quickly respond by displaying the information such as whether they are exposed to risks and displaying them intuitively. It is to provide integrated security control system using screen.

Another object of the present invention is to display the security event statistical data for each site, security equipment, security event type by the user intuitively recognize the three-dimensional screen that allows the user to easily recognize and cope with the cumulative security events It is to provide integrated security control system.

Yet another object of the present invention is to generate and accumulate security events over time by displaying the statistical data per minute, hourly, daily, weekly, monthly, of the security event data occurring in the integrated security control system so that the user can intuitively recognize the data. It is to provide an integrated security control system using a three-dimensional screen that allows users to easily recognize the situation and cope with it.

Another object of the present invention is not only to simply store the security event data transmitted and collected by the security equipment of each site, but also by the security event type, security equipment or system-wide moisture by one hour, which must be displayed through the information display unit. By creating daily, weekly and monthly statistical data and classifying them separately, real-time security event occurrence status and necessary statistical data can be displayed immediately so that users can cope with security breach immediately and efficiently. It is to provide integrated security control system.

Integrated security control system using a three-dimensional screen for achieving the above object of the present invention includes the following configuration.

Integrated security control system using a three-dimensional screen according to an embodiment of the present invention is an information collection unit for collecting and storing various security event data from the security equipment; An information processor for classifying and processing security event data collected and stored by the information collector; And an information display unit for displaying the security event data classified by the information processing unit on a three-dimensional screen, wherein the information display unit comprises a first display area for displaying a country where a security event has occurred, and a time for displaying a time when a security event has occurred. 2 Display area, the third display area for displaying the type and frequency of security events, and the fourth display area for displaying the site of the security event are displayed on one three-dimensional screen to generate on the security management system. It is characterized in that the user can intuitively grasp the current status of the security event in a short time.

According to another embodiment of the present invention, in the integrated security control system using a three-dimensional screen according to the present invention, the information display unit further comprises a fifth display area for displaying an alarm occurrence situation for alarming a security risk do.

According to another embodiment of the present invention, in the integrated security control system using the 3D screen according to the present invention, the second display area includes a 24 equally divided area along the circumference of the circle, and displays a security event occurrence time. The third display area is a figure having a specific color and a specific height on a 24 equally divided area of the second display area, and displays the type and frequency of the security event occurring at a corresponding time, and the first display area is the first display area. It is located outside the circular periphery of the second display area and includes a plurality of figures corresponding to the country where the security event occurs, and the fourth display area is located inside the circular periphery of the second display area, so And a plurality of figures corresponding to the site, wherein the fifth display area is a figure having a specific color at the center of the circular shape of the second display area. Display is characterized in that.

According to another embodiment of the present invention, in the integrated security control system using the three-dimensional screen according to the present invention, the information display unit at the corresponding site when selecting a figure corresponding to the site of the security event of the fourth display area A sixth display area for displaying the type of security equipment and security event statistical information to be managed in a separate second three-dimensional screen, wherein the second three-dimensional screen is located at the center to display an alarm occurrence situation with a figure having a specific color. And a seventh display area displaying the type of security equipment in a plurality of figures rotating along the circumference of the sixth display area, and located at one side of the second three-dimensional screen to display security event statistical information of the corresponding site. And an eighth display area.

According to another embodiment of the present invention, in the integrated security control system using the three-dimensional screen according to the present invention, the information display unit security generated in the security equipment when selecting the figure corresponding to the security equipment of the seventh display area Event statistics information is displayed in a separate third 3D screen, wherein the third 3D screen is a ninth display area for displaying a country on which a security event for a corresponding security device has occurred, and the third 3D screen. Located at one side of the characterized in that it comprises a tenth display area for displaying the security event statistical information occurred in the security device.

According to another embodiment of the present invention, in the integrated security control system using a three-dimensional screen according to the present invention, the information display unit generates a total security event type when selecting a figure indicating an alarm occurrence situation of the fifth display area. Frequency and the country in which the security event occurred are displayed in a separate fourth three-dimensional screen, the fourth three-dimensional screen is an eleventh display area for displaying the type and frequency of the security event in a number of figures and sizes; And a twelfth display area for displaying a country on which an event has occurred on a map.

According to another embodiment of the present invention, in the integrated security control system using a three-dimensional screen according to the present invention, the information processing unit and a control module for periodically analyzing the security event data collected and stored from the information collection unit, the control And a memory cache configured to store the security event data analyzed by the module and to quickly transmit the information to the information display unit.

According to another embodiment of the present invention, in the integrated security control system using the three-dimensional screen according to the present invention, the control module attacks the security event data for each security device collected and stored from the information collection unit (DOS). , System availability, web hacking, unauthorized access, scanning / backdoor, and worm / virus by event type, and each security device, It generates and manages statistical data for each event type.

According to another embodiment of the present invention, in the integrated security control system using the three-dimensional screen according to the present invention, the control module checks the state of change over a certain range appearing in various statistical data generated and stored for each security device, event type And it is characterized in that it comprises an alarm module for displaying the information on the display unit for each predetermined color so that the user can intuitively recognize the security risk.

According to another embodiment of the present invention, in the integrated security control system using a three-dimensional screen according to the present invention, the memory cache is an alarm data module for classifying and storing the alarm data collected and stored from the information collection unit by event type, A first statistical data module configured to store first statistical data generated by analyzing the security event data collected and stored from the information collecting unit by a period of time, and a first stored by the control module in the first statistical data module; A second statistical data module for storing the second statistical data generated by analyzing the statistical data at an interval of time, and a third statistical data generated by the control module analyzing the second statistical data stored in the second statistical data module at daily intervals; A third statistical data module for storing data, and the control module gives the third statistical data stored in the third statistical data module; A fourth statistical data module for storing the fourth statistical data generated by analyzing in units of units, and the fifth statistical data generated by analyzing the fourth statistical data stored in the fourth statistical data module in monthly units; Including a fifth statistical data module to be, characterized in that the security event occurs to be displayed quickly and accurately through the information display.

The present invention can achieve the following effects by the configuration, combination, and use relationship described above with the present embodiment.

According to the present invention, when, where, and where a certain type of security event occurs on a three-dimensional screen, how often and how often, and how it changes over time, the site is subject to some degree of security risk. In addition to displaying whether the exposure is visible at a glance, this can be displayed by the user intuitively, it has the effect of allowing the user to quickly grasp the current status of the security events occurring in the security management system and cope with them quickly.

The present invention displays the security event statistics data for each site, security device, and security event type so that the user can intuitively recognize the cumulative security events.

The present invention displays the statistical data by minutes, hourly, daily, weekly, monthly, of the security event data generated in the integrated security control system so that the user can intuitively recognize the security event occurrence and cumulative status over time It has the effect of making it easy to recognize and cope with it.

The present invention not only stores the security event data transmitted and collected by the security equipment of each site, but also by the type of security event to be displayed through the information display unit, by security equipment or by the whole system, hourly, daily, weekly In addition, by generating monthly statistical data and classifying and storing them separately, real-time security event occurrence status and necessary statistical data can be displayed immediately so that users can cope with the security breach situation promptly and efficiently.

1 is a block diagram showing the configuration of an integrated security control system using a three-dimensional screen according to an embodiment of the present invention
FIG. 2 is a block diagram illustrating a detailed configuration of the information collecting unit of FIG. 1.
3 is a block diagram for explaining a detailed configuration of the information processing unit of FIG.
4 is a block diagram illustrating a detailed configuration of an information display unit of FIG. 1.
5 is a diagram illustrating an example in which a first three-dimensional screen is implemented through an information display unit.
6 is a diagram illustrating an example in which a second 3D screen is implemented through an information display unit.
7 is a diagram illustrating an example in which a third 3D screen is implemented through an information display unit.
8 is a diagram illustrating an example in which a fourth 3D screen is implemented through an information display unit.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the integrated security control system using a three-dimensional screen according to the present invention will be described in detail.

1 is a block diagram showing the configuration of an integrated security control system using a three-dimensional screen according to an embodiment of the present invention, Figure 2 is a block diagram for explaining the detailed configuration of the information collecting unit of Figure 1, Figure 3 1 is a block diagram illustrating a detailed configuration of the information processing unit of FIG. 1, FIG. 4 is a block diagram illustrating a detailed configuration of the information display unit of FIG. 1, and FIG. 5 is a first 3D screen implemented through the information display unit. 6 is a diagram illustrating an example in which a second 3D screen is implemented through an information display unit, and FIG. 7 is a diagram illustrating an example in which a third 3D screen is implemented through an information display unit. 8 is a diagram illustrating an example in which a fourth 3D screen is implemented through an information display unit.

1 to 8, the integrated security control system using a three-dimensional screen according to an embodiment of the present invention includes an information collecting unit 10 for collecting and storing various security event data from the security equipment; An information processor (30) for classifying and processing security event data collected and stored by the information collector (10); And an information display unit 50 for displaying the security event data classified by the information processing unit 30 on a three-dimensional screen, wherein the information display unit 50 displays a first display area 511 for displaying a country where a security event has occurred. ), A second display area 512 for displaying the time when the security event occurred, a third display area 513 for displaying the type and frequency of the security event, and a site for displaying the site targeted for the security event. On the security management system, a four display area 514 and a fifth display area 515 for displaying an alarm occurrence situation for alarming a security risk according to a fluctuation state over a certain range of the security event are displayed on one three-dimensional screen. Users can intuitively grasp the status of security events occurring in a short time.

The information collecting unit 10 is a security device that is managed in the integrated security control system according to the present invention, that is, security equipment installed in the sites corresponding to the management target (where security equipment is a firewall installed at each site for security purposes). (Firewall), IDS (Intrusion Detection System) / IPS (Intrusion Protection System), etc. from the security-related security events (where security events are generated from the event detected by the security equipment or security equipment) It means to collect the type of the event and the time of occurrence, etc.) to collect and store the data through filtering and exception processing, for this purpose, the information collecting unit 10 and the data corresponding to the management site Communication module 110 for transmitting and receiving, and the database 120 for storing the security event data collected through the communication module 110 may be included.

The communication module 110 is configured to transmit and receive data with the sites corresponding to the management target, the communication module 110 is a variety of wired and wireless communication methods capable of transmitting and receiving data (for example, TCP / IP (Transmission Control Protocol) / Internet Protocol).

The database 120 is configured to store the security event data, etc. collected through the communication module 110, the database 120 in the management target site and security equipment managed by the integrated security control system according to the present invention. A resource information module 121 for storing resource information (herein, resource information means information including IP information of a management target site or type of security equipment installed on the site), and latitude for each IP; It may include a geographic information module 122 for storing information such as longitude, country, city, institution, etc., and a security data module 123 for storing security event data collected through the communication module 110.

The information processor 30 is configured to classify and analyze the security event data collected and stored by the information collector 10, and the security event data collected by the information collector 10 is displayed on the information display unit 50. ), Statistical data is generated and managed for each security device, event type, and cycle for the collected security event data so that it can be displayed quickly and clearly. To this end, the information processing unit 30 stores a control module 310 periodically analyzing the security event data collected and stored from the information collecting unit 10, and stores the security event data analyzed by the control module 310. And it may include a memory cache 320 so that it can be quickly transmitted to the information display.

The control module 310 collects and stores security event data for each security device collected and stored from the information collection unit 10, a denial of service attack (DOS), system availability, and web hacking (Web hacking). ), Classified by event type of Unauthorized access, Scanning / Backdoor and Worm / Virus, and generating and managing statistical data at regular intervals for each security device and event type. In this way, the security event data collected through the control module 310 is not simply stored, but classified and stored according to a predetermined criterion as well as generating and managing statistical data based on a predetermined cycle. In order to allow the user of the security control system to intuitively recognize the security event occurrence situation, the security event data and each to be displayed through the information display unit 50 and each Allow the statistical data rapidly and can also provide the obvious. Predetermined criteria for the control module 310 to classify and store security event data include classifying and storing security events generated by each security device by event type, classifying and storing the current status of the entire security event by event type, There may be a classification and storing the security event for each country in which a security event occurred, by event type, and the predetermined trend for generating statistical data about the classified security event data by the control module 310 trends in the occurrence of security events. You can immediately identify the number of minutes required to see the situation immediately, the status of the security event occurred by hour, and there can be one hour period required, daily, weekly, monthly, etc. necessary to determine the cumulative status of the security event occurred. Detailed description thereof will be described later in the description of the memory cache 320 to be described later. Check it.

In addition, the control module 310 checks the variation state over a certain range appearing in the various statistical data generated and stored for each security equipment, event type, and displays it on the information display unit 50 for each predetermined color so that the user may have a security risk. It may include an alarm module 311 to intuitively recognize the. That is, the alarm module 311, if the various statistical data generated by the control module 310 changes over a certain range (for example, the frequency of the security event generated by a certain period exceeds a certain number of times) in advance. It is displayed on the information display unit 50 for each designated color so that the user can easily recognize it. For example, the lowest grade to the highest grade based on the number of statistical data generated at a specific cycle for a specific target site 5 By classifying them into levels of purple, blue, green, yellow, and orange, they can be displayed in different colors so that users can see how much security events are occurring in the time zone of the site even if they only see a specific color. You can make it intuitive. Areas displayed by colors through the alarm module 311 will be described later in the description of the information display unit 50.

The memory cache 320 is configured to store the security event data and various statistical data analyzed by the control module 310 and to transmit them to the information display unit 50 quickly, the memory cache ( 320 may be used as a data storage device (RAM). The memory cache 320 queries and calculates the security event data to be displayed through the information display unit 50, which will be described later, in proportion to the number of requests. The storage device is included separately on the information processing unit 30 to improve the problem that the user of the integrated security control system due to the fall of the security event occurs and the response is delayed, in particular the memory cache ( 320 is not merely to store the security event data of the various security equipment, such as the security data module 123 of the database 120 described above, but to transmit it to the information display unit 50, the control module 310 ) Statistical data that is classified and analyzed by security device, event type, and schedule cycle, that is, through the information display unit 50 immediately. As it should be displayed, it is possible to identify and cope with the user's rapid security event status through the information display unit 50 by storing and storing the frequently requested data and providing them to the information display unit 50 immediately. To this end, the memory cache 320 is the alarm data module 321 for classifying and storing the alarm data collected and stored from the information collection unit 10 for each event type, and collected from the information collection unit 10, A first statistical data module 322 for storing the first statistical data generated by analyzing the stored security event data by the control module 310 in a water cycle, and the control module 310 storing the first statistical data module 322. The second statistical data module 323 for storing the second statistical data generated by analyzing the first statistical data stored in the one time period and the control module 310 to the second statistical data module 323 A third statistical data module 324 storing third statistical data generated by analyzing the stored second statistical data on a daily basis, and a third statistical data stored in the third statistical data module 324 by the control module 310; The fourth statistical data module 325 storing the fourth statistical data generated by analyzing the data on a weekly basis, and the fourth statistical data stored in the fourth statistical data module 325 by the control module 310 for the month. It may include a fifth statistical data module 326 for storing the fifth statistical data generated by analyzing in units.

The alarm data module 321 manages each alarm data collected and stored from the information collecting unit 10 (where alarm data means an alarm signal generated for alarming a security risk by each security device). By classifying and storing the target site as a whole or by the type of the event as a whole, the alarm occurrence status that alarms the security risk through the information display unit 50 to be described later is displayed by changing the color by step by step (for example, the lowest rating) 4 levels from blue to yellow to orange to red to classify them.The user can see how much alarm data is generated on the site even if they only see a certain color. You can make the situation intuitive.

The first statistical data module 322 stores the first statistical data generated by the control module 310 by analyzing the security event data collected and stored from the information collecting unit 10 in a water cycle. Under the control of the module 310, the security event data stored in the security data module 123 of the information collecting unit 10, a period of a few minutes (this is necessary to immediately identify the trend of the security event occurrence, usually 1 to 10 minutes cycle) By storing the first statistical data classified and analyzed by each security equipment, event type, the information display unit to be described later to enable the user of the integrated security control system according to the present invention to intuitively recognize the security event occurrence situation ( 50) Particularly, the security event data and the statistical data to be displayed through the third display area 513 can be provided quickly and at a glance to the user's rapid security event status. To identify and respond to them.

The second statistical data module 323 is classified and analyzed for each security device and event type at a time interval based on the first statistical data stored in the first statistical data module 322 by the control module 310. The second statistical data generated by storing the information, which is to be described later in order to enable the user of the integrated security control system to quickly and at a glance the security event occurrence status of each time zone, in particular, divided into 24 Statistical data displayed in the third display area 513 on the second display area 512 can be quickly provided.

The third, fourth and fifth statistical data modules 324, 325 and 326 are based on the second, third and fourth statistical data stored in the second, third and fourth statistical data modules 323, 324 and 325, respectively. It stores the third, fourth, and fifth statistical data generated by classifying and analyzing each security device and event type on a daily, weekly, and monthly basis. This is a daily, weekly, This is to display the statistical data of the monthly cycle on the information display unit 50 to be described later so that the user of the integrated security control system can check and utilize it.

As described above, the present invention is not limited to simply storing the security event data transmitted and collected by the security equipment of each site through the information processing unit 30, and by the security event type, security equipment, or the whole system to be displayed through the information display unit. By generating and storing statistical data by moisture, hourly, daily, weekly, and monthly, and classifying them separately, real-time security event occurrence status and necessary statistical data can be displayed immediately so that users can cope with security breach immediately and efficiently. You can do that.

The information display unit 50 visualizes and displays the security event data or statistical data classified and generated by the information processing unit 30 on a 3D screen through the screen display module 51 or by the user through the interface module 52. In particular, the information display unit 50 displays a country where a security event has occurred on one three-dimensional screen (first three-dimensional screen 510) by selecting a specific area by touch or mouse or keyboard input. The first display area 511, the second display area 512 for displaying the time when the security event occurred, the third display area 513 for displaying the type and frequency of the security event, and the target of the security event. The fourth display area 514 for displaying a site to be displayed and the fifth display area 515 for displaying an alarm occurrence situation for alarming a security risk are used to use the status of security events occurring in real time on the security management system. It is characterized in that it allows to identify and respond to in an intuitive short time.

The first display area 511 is an area for displaying a country in which a security event has occurred on the first three-dimensional screen 510. In particular, as shown in FIG. 5, the first display area 511 is based on the second display area 512. It can be specified as the outside of the second display area 512 (which means the outside of the sphere when the circular shape of the second display area 512 is viewed as a 'sphere' shape since it is on a three-dimensional screen). It may include a plurality of corresponding figures (which correspond to the number of security event generating countries). The first display area 511 may be displayed for each country where a security event occurs using a plurality of figures, and directly reminds the meaning of invading from the outside from the outside based on the second display area 512. Even users unfamiliar with the first 3D screen 510 may intuitively recognize the security event generating station.

The second display area 512 is an area for displaying the time when a security event occurred on the first three-dimensional screen 510, in particular, as shown in FIG. It has the effect of intuitively recognizing that each zone represents 24 hours a day. Accordingly, the second display area 512 is a line for displaying each security event that occurs even if a separate security event occurrence time is not displayed on the first 3D screen 510 (this is the first display area 511). Means a line connecting the sites that are the targets of the security event of the fourth display area to each one of the 24 equalized areas corresponding to the time of occurrence. It makes visual sense easy and intuitive. In other words, in the integrated security control system according to the present invention, since a myriad of security events are generated, the screen itself becomes cluttered when each occurrence time is represented by numbers or tables on the screen. There is a considerable difficulty in recognizing the present invention. In the present invention, a line indicating each security event using the second display area 512 as described above (for example, as described above in the alarm module 311, the line Each color has a specific color according to the frequency of occurrence of the security event so that the status of where and how many security events are generated can be intuitively recognized. Simply and intuitively navigates through one of these areas It will have a unique effect to recognize this. Also, the second display area 512 has a first display area corresponding to the outside and a fourth display area 514 corresponding to the inside with respect to the circumference of the circular shape (which means a sphere on a 3D screen). And directly recall the meaning that a security event generating station corresponding to an attacker of a security breach attacks a target site corresponding to a defender of a security breach from the outside to an unfamiliar with the first 3D screen 510. Even the users can have an effect that can intuitively recognize the meaning.

The third display area 513 is an area for displaying the type and frequency of occurrence of a security event on the first three-dimensional screen 510. In particular, as shown in FIG. 5, 24 of the second display area 512 is shown. Types and frequencies of security events occurring at a given time may be displayed in a figure having a specific color and a specific height on the equalized area. That is, in the third display area 513, by security event type (as described above, Denial of Service attack (DOS), System availability, Web hacking, Unauthorized access) After assigning a specific color by access, scanning / backdoor, and worm / virus, the figure having the color of each security event type is divided into 24 equal parts of the second display area 512. By displaying on the area corresponding to the time of occurrence, the user can intuitively recognize the type of security event that occurred at the time, as well as giving the height of each figure rather than simply giving the height of each figure. How often is the security event type by having a height that corresponds to the frequency of occurrence (that is, a low height if the frequency is low, such as a bar graph, and a high height if the frequency is high)? And that is to occur at a frequency to allow the user to recognize intuitively. In the integrated security control system, it is important to first identify which types of security events are relatively high or low in terms of the type of security events occurring per hour. The three display areas have a unique effect of making them simple and intuitive on the screen by using the height of the figure. Incidentally, when the figure is clicked, a screen for providing details of a security event type corresponding to the figure may be additionally displayed.

The fourth display area 514 is an area for displaying a site that is a target of a security event on the first three-dimensional screen 510. In particular, as shown in FIG. 5, the fourth display area 514 refers to the second display area 512. This can be specified as the interior of the second display area 512 (which means the inside of the sphere when the circular shape of the second display area 512 is viewed as a 'sphere' shape since it is on a three-dimensional screen) and is the target of the security event. This may include a plurality of figures corresponding to the site (managed on the integrated security control system according to the present invention), which corresponds to the number of the target site of the security event. The fourth display area 514 can be displayed for each security event target site by using a plurality of figures, and directly the meaning of receiving an external attack from the inside based on the second display area 512. In this way, even users unfamiliar with the first 3D screen 510 may intuitively recognize the target site.

The fifth display area 515 is an area for displaying an alarm occurrence situation that alerts to a security risk on the first three-dimensional screen 510. In particular, as shown in FIG. Arrange a figure having a specific shape (referred to as an 'alarm figure') in the center and the alarm data stored in the alarm data module 321 (that is, an alarm occurrence signal for alerting a security risk at a target site for a security event). By connecting the corresponding figure of the site that generated the alarm data and the alarm figure on the basis, the user can quickly and intuitively know where the site of the alarm occurrence situation which is dangerous to the security, as well as the alarm data module 321 ), By displaying the color of the alarm graph or the color of the surrounding area by changing the color step by step, even if the user only sees a certain color, It is possible to intuitively recognize the current status of whether or not the alarm data is generated.

As described above, according to the present invention, when, where, where, and what type of security event occurs on a three-dimensional screen through the information display unit 50 at a certain frequency, and how much security the corresponding site has. In addition to displaying whether the user is exposed to danger at a glance, the user can intuitively recognize the situation, and the effect of enabling the user to grasp the status of the security event occurring in the security management system in a short time and respond quickly to it. Will be exercised. In addition, the first 3D screen 510 may further include an additional area displaying an index table for colors by security event type or colors by security event occurrence frequency or a security event occurrence state occurring in the entire system. It may be.

Referring to FIG. 6, in another embodiment of the present invention, the information display unit 50 selects a figure corresponding to a site that is the target of the security event of the fourth display area 514. Type and security event statistics are displayed on a separate second three-dimensional screen 520, and the second three-dimensional screen 520 is located in the center as shown in FIG. A sixth display area 521 for displaying a situation, a seventh display area 522 for displaying the type of security equipment in a plurality of figures rotating along the circumference of the sixth display area 521, and the second display area 522; Located on one side of the three-dimensional screen 520 may include an eighth display area 523 for displaying the security event statistical information of the site.

The sixth display area 521 is a figure having a specific color located in the center of the second 3D screen 520 and displaying an alarm occurrence situation occurring at a corresponding site. This is the first 3D screen. Except that 510 is displayed on a separate screen, the same function as that of the fifth display area 515 described above may be performed. Therefore, a detailed description thereof will be omitted to avoid redundant descriptions.

The seventh display area 522 is an area for displaying the type of security equipment installed at the corresponding site as a plurality of figures rotating along the circumference of the sixth display area 521. For example, the security equipment managed at the site. Is two types of firewall and IDS / IPS, two figures corresponding to the two kinds are shown to rotate along the circumference of the sixth display area 521, and the names of the corresponding security equipment are separately indicated on the upper portion thereof. Or it may be represented as a figure of a different shape for each security device.

The eighth display area 523 is located on one side of the second 3D screen 520 to display security event statistical information of each security device of the corresponding site. The third, fourth, and fifth statistical data modules Security event statistics data of daily, weekly and monthly cycles are displayed for each security device of the relevant site created and stored in (324,325,326) to identify the cumulative status of security events generated and checked by the user of the integrated security control system. Make it available. For example, security event data such as allowed IP, blocked IP, allowed port, blocked port, etc. for firewall among security devices is classified by Top N method (sorted by descending order) by day and week. In this case, security event data such as attack IP and attack pattern may also be displayed in daily, weekly and monthly cycles in the Top N manner.

Referring to FIG. 7, in another embodiment of the present invention, the information display unit 50 displays security event statistical information generated by the security device when selecting a figure corresponding to the security device of the seventh display area 522. The third 3D screen 530 is displayed as a separate third 3D screen 530. The third 3D screen 530 is a ninth display area 531 for displaying a country on which a security event for a corresponding security device has occurred on a map. Located on one side of the third 3D screen 530 may include a tenth display area 532 for displaying the security event statistical information generated in the security device.

As shown in FIG. 7, the ninth display area 531 is an area that is located on one side of the third 3D screen 530 to display a country on which a security event for a corresponding security device has occurred on a map. Using the information of the geographic information module 122, which stores information such as latitude, longitude, country, city, and institution for each IP described, the area where the corresponding IP of the security event originating station is located is displayed on the map. It helps to recognize the point intuitively.

As shown in FIG. 7, the tenth display area 532 is located on one side of the third 3D screen 530 to display security event statistical information generated in a corresponding security device. Similar to that described in (523), the security event statistical data of the security device in the daily, weekly or monthly period is displayed in association with the security event generating station of the ninth display area 531 to indicate the cumulative status of the security events generated. It can be checked and used by the users of the integrated security control system.

Referring to FIG. 8, in another embodiment of the present invention, the information display unit 50 selects a figure indicating an alarm occurrence state of the fifth display area 515, and the occurrence frequency and security event of all security event types. Is displayed on a separate fourth 3D screen 540, and the fourth 3D screen 540 is an eleventh display area for displaying the type and frequency of security events in a plurality of figures and sizes thereof. 541 and a twelfth display area 542 for displaying a country on which a security event occurred on a map.

As illustrated in FIG. 8, the eleventh display area 541 is located on one side of the fourth 3D screen 540 and displays types and frequency of security events in a plurality of figures and sizes. By matching each figure by security event type, users can intuitively recognize the type by security event type, and the size of each figure corresponds to the occurrence frequency of the corresponding security event (for example, the highest occurrence frequency). Shapes of the security event type are formed to be the largest, and shapes of the security event type having the lowest occurrence are formed to be the smallest) so that the user can easily and intuitively recognize the frequency of the security event type. If necessary, the name of the corresponding security event type and its occurrence frequency may be displayed on the upper part of the figure. In addition, a line may be matched with a security event generating station displayed on a map of the twelfth display area 542 to be described later to intuitively recognize in which country the security event corresponding to each figure occurs. .

As shown in FIG. 8, the twelfth display area 542 is located on one side of the fourth 3D screen 540 to display a country where a security event has occurred on a map. Map the region where the corresponding IP of the security event generating station is located by using the information of the geographic information module 122 that stores the latitude, longitude, country, city, institution, etc. of each IP in the same manner as the region 531. And connect each figure and line displayed in the eleventh display area 541 for each type of security event occurring in a corresponding country so that the user can intuitively recognize which type of security event occurred in that country. do.

In the above, the Applicant has described preferred embodiments of the present invention, but these embodiments are merely one embodiment for implementing the technical idea of the present invention, and any changes or modifications may be made as long as the technical idea of the present invention is implemented. Should be interpreted as being within the scope.

10: information collecting unit 110: communication module 120: database
121: resource information module 122: geographic information module 123: security data module
30: information processing unit 310: control module 311: alarm module
320: memory cache 321: alarm data module 322: first statistical data module
323: second statistical data module 324: third statistical data module
325: fourth statistical data module 326: fifth statistical data module
50: information display section 51: screen display module 52: interface module
510: first three-dimensional screen 520: second three-dimensional screen
530: third three-dimensional screen 540: fourth three-dimensional screen
511: first display area 512: second display area 513: third display area
514: fourth display area 515: fifth display area
521: sixth display area 522: seventh display area 523: eighth display area
531: ninth display area 532: tenth display area
541: eleventh display area 542: twelfth display area

Claims (10)

An information collector for collecting and storing various security event data from security devices;
An information processor for classifying and processing security event data collected and stored by the information collector;
And an information display unit for displaying the security event data classified by the information processing unit on a three-dimensional screen.
The information display unit includes a first display area for displaying a country where a security event has occurred, a second display area for displaying a time when a security event occurs, a third display area for displaying a type and frequency of a security event, and a security event. A fourth display area for displaying a site that is the target of the target, and a fifth display area for displaying an alarm occurrence situation for alarming a security risk on a three-dimensional screen,
The second display area includes an area divided into 24 equally along a circular circumference so that a line for displaying security events passes through an area corresponding to the occurrence time, and displays the occurrence time, and the third display area is the second display area. The type and frequency of the security event occurring at the corresponding time are displayed on the 24 equally divided areas of the display area, and the first display area is located outside the circular circumference of the second display area. A plurality of figures corresponding to a country where a security event occurs, and the fourth display region includes a plurality of figures corresponding to a site targeted for a security event by being located inside a circular circumference of the second display region, The fifth display area includes a specific figure at the center of the circular shape of the second display area and connects to the security event target site where the alarm data is generated. An integrated security control system using a three-dimensional screen that displays the alarm occurrence status of events to allow users to intuitively grasp the status of security events occurring in the security management system within a short time. delete delete The method of claim 1,
The information display unit displays the type of security equipment managed by the site and the security event statistical information in a separate second three-dimensional screen when selecting a figure corresponding to the site targeted for the security event of the fourth display area.
The second three-dimensional screen has a sixth display area for displaying an alarm occurrence situation with a figure having a specific color located at the center and a plurality of figures rotating along a circumference of the sixth display area to display types of security equipment. And an eighth display area positioned at one side of the second three-dimensional screen to display security event statistical information of the corresponding site. The method of claim 4, wherein
The information display unit displays security event statistical information generated by the security device in a separate third 3D screen when selecting a figure corresponding to the security device of the seventh display area.
The third 3D screen includes a ninth display area for displaying a country on which a security event has occurred for a corresponding security device on a map, and security event statistical information generated at the security device by being located at one side of the third 3D screen. Integrated security control system using a three-dimensional screen comprising a tenth display area to display. The method of claim 1,
The information display unit displays the occurrence frequency of the entire security event type and the country where the security event occurred in a separate fourth three-dimensional screen when selecting a figure displaying the alarm occurrence situation of the fifth display area.
The fourth 3D screen includes an eleventh display area for displaying the type and frequency of security events in a plurality of figures and sizes, and a twelfth display area for displaying a country on which a security event has occurred on a map. Integrated security control system using a three-dimensional screen. The method of claim 1,
The information processing unit stores a control module for periodically analyzing the security event data collected and stored from the information collection unit, the memory cache for storing the security event data analyzed by the control module to be quickly transmitted to the information display unit Integrated security control system using a three-dimensional screen comprising a. The method of claim 7, wherein the control module
Security event data for each security device collected and stored from the information collection unit is collected by the service denial of service (DOS), system availability, web hacking, unauthorized access, scanning / backdoor (Scanning / Integrated security control system using three-dimensional screen characterized in that it is classified by the event type of the backdoor) and worm / virus (Worm / Virus), and to generate and manage statistical data for each security device, event type. The method of claim 8, wherein the control module
It includes an alarm module that checks the variation over a certain range appearing in various statistical data generated by each security device and event type, and displays it in the information display unit according to a predetermined color so that users can intuitively recognize the security risk. Integrated security control system using a three-dimensional screen, characterized in that. The method of claim 8, wherein the memory cache is
An alarm data module for classifying and storing the alarm data collected and stored from the information collecting unit by event type;
A first statistical data module for storing first statistical data generated by the control module by analyzing the security event data collected and stored from the information collecting unit in a water cycle;
A second statistical data module for storing second statistical data generated by the control module by analyzing the first statistical data stored in the first statistical data module at an interval of time;
A third statistical data module configured to store third statistical data generated by the control module by analyzing the second statistical data stored in the second statistical data module on a daily basis;
A fourth statistical data module configured to store fourth statistical data generated by the control module by analyzing the third statistical data stored in the third statistical data module on a weekly basis;
And a fifth statistical data module configured to store fifth statistical data generated by the control module analyzing fourth statistical data stored in the fourth statistical data module on a monthly basis. Integrated security control system using a three-dimensional screen, characterized in that to be displayed quickly, accurately.

Images