KR101330222B1 - A dangerous degree calculating system using log information and method thereof - Google Patents

Abstract

A risk estimation system and method using a log generation history and scoring, the method comprising: a database unit providing predetermined information and generating and outputting log information of the provided information; An analysis unit for calculating the risk of the log information with reference to a predetermined risk index, and analyzes the log generated in the database structured and stored in the database, calculates the risk for each structured item through scoring and accordingly Abnormal symptoms can be detected.

Description

A dangerous degree calculating system using log information and method

The present invention relates to a database management method, and more particularly, to a risk estimation system and method using log generation history and scoring.

In general, a variety of places, such as government offices, schools, companies, etc. are used to manage a variety of information.

This information can be used by various operators or employees, and a log is generated according to the connection result.

However, in some cases, important information may be leaked, and in such cases, damage may be caused to the relevant institutions.

The technical problem to be achieved by the present invention is to solve the drawbacks of the prior art by analyzing the log generated in the database structured and stored in the database, and to calculate the risk for each structured item through the scoring and to detect abnormal symptoms accordingly It provides a risk estimation system and method using the log generation history and scoring.

The risk calculation system using the log generation history and scoring according to the characteristics of the present invention for solving this problem,

A database unit providing predetermined information and generating and outputting log information of the provided information;

It includes an analysis unit for calculating the risk of the log information with reference to a predetermined risk index.

The risk calculation method using the log generation history and scoring according to one feature of the present invention for solving this problem,

Providing information by the database server;

Generating and outputting log information of information provided from the database server by a log generator;

Setting a risk index corresponding to the information provided by the database server;

The analysis unit may include calculating a risk level of the log information by referring to the risk index.

In an embodiment of the present invention, the log generated from the database is analyzed and structured and stored in the database, the risk for each structured item is calculated through scoring, and accordingly, the risk using the log generation history and scoring to detect abnormal symptoms. Estimation systems and methods may be provided.

1 is a block diagram of a risk calculation system according to an embodiment of the present invention.
2 is an operation flowchart of a risk calculation method according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, except to exclude other components unless otherwise stated. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 is a block diagram of a risk calculation system according to an embodiment of the present invention.

Referring to Figure 1, the risk calculation system according to an embodiment of the present invention,

It is connected to the user computer 1, the manager computer 2, the work system 3, and includes a database unit 100 and the analysis unit 200.

The work system 3 is a system in which computerized software is installed to assist in carrying out work, and may be omitted as necessary.

The database unit 100 includes a database server 110 and a log generator 120.

The database server 11 is a server to which a user or another device or software can access and register data or inquire, and may be Oracle, MS SQL Server, or the like.

The log generator 120 is a module that generates a history of the database server 110 as a file. Most DBMSs have their own log generation module. And, the log : refers to a file generated through the log generator 120, the time, access point, execution SQL statement, etc., the database is recorded in accordance with the format of the DBMS.

The analysis unit 200 analyzes and structures the log generated by the database unit 100 , calculates and stores a risk level for each action or user, and allows an administrator to search for information stored in a database through a computer.

The analysis unit 200 includes a manager unit 210, an information storage unit 220, a log analyzer 230, and a risk calculator 240.

The information storage unit 220 is a DB normalized and recorded by the user operated DB history, and may store a risk index or a risk calculation result as necessary.

The manager unit 210 provides a DB history manipulated by a user, such as outputting an audit report or tracing, according to a request of the manager computer 2, and may manage operations such as setting a risk index.

The log analyzer 10 analyzes / normalizes the log generated by the database system 10 and registers it in the information storage unit 220.

The risk estimator 240 calculates a risk of DB usage history information registered in the information storage unit 220 based on a risk index registered in advance.

The manager computer 2 sets risk indicators or management targets in advance through the manager unit 210, and the DB operation history registered in the information storage unit 240 through the log analyzer 230 and the risk estimator 240. Query and so on.

Dashboard / Audit Report / Tracking / Operation Management can be done through the manager computer (2), detailed screen of DB operation history can be viewed and audit target setting or risk indicator setting can be set through operation management. Risk indicator management establishes and manages risk indicators for database operations. Risk indicator setup establishes risk indicators for database operations. Risk indicators represent indicators of risk behavior. Risk indicators can be set for cases of major interest, mass data retrieval, and supervisor access.

An act that causes Database operated by accessing indirectly database operation is to connect to the DBMS and meaning to the act of operating the SELECT, INSERT, UPDATE, DELETE, etc. Database, DB task execution is a user either directly or through another Application, DB logs generated Is a file that records the actions that occur in the database, and the DB operation log : refers to a file created through the DB log creation process. The log analysis is to analyze the database operation history, and the DB history information is normalized to SQL information such as SELECT, INSERT, UPDATE, and DELETE, execution time of SQL information, DB login time, and SQL type. Normalized log registration means to register the normalized log to the information storage through log analysis. Risk calculation : calculates the risk for each SQL action or group of SQL actions according to the previously created risk indicator.

Then, the operation of the risk calculation system according to the embodiment of the present invention will be described.

First, when a user directly accesses the database unit 100 or the work system 2 to operate directly or indirectly accesses the database unit 100 through the work system 2 (S21), the database unit 100 In the log generator 120 to generate a log (S22).

The log generated by the database unit 100 records information such as when the user connected to the database server 6 and what SQL was executed. The items recorded in the log may vary according to each DBMS (database management system).

The analysis unit 200 stores these logs in the information storage unit 220 by formatting them (structured for 5W 1H). In order to determine how dangerous each SQL stored in the information storage unit 220 is, a risk may be calculated. For this purpose, an administrator registers a risk index through the manager unit 210 by operating the manager computer 2 in advance. (S10).

Risk indicators through risk indicator management are pre-set and managed as risk in the following cases.

When SQL is executed by a high authority that requires high authority to retrieve important information of a predetermined level or more of the database, or when accessing a predetermined table (A table for convenience) or a predetermined number, that is, 10,000 users If there is more than one data inquiry.

Thereafter, the log analyzer 230 analyzes the log (S23), extracts database usage history information, and registers the normalized log (S24).

And the risk calculator 240 calculates the risk (S25), and stores the risk in the information storage unit 220 as necessary (S26).

For reference, an example of high-risk data in the dashboard in the above process is as follows.

The user logged in with the most important data (high security) with high authority to execute SQL, and accessed 20,000 data by accessing the critical information table (A table). In this case, since all three dangerous cases overlap, this may be the most dangerous case.

Also, if you look up the inquired data, if you have inquired a lot of data with abnormal point in case of usual, this case is regarded as one of the dangerous cases. These risks can be set differently depending on the circumstances of each company or organization.

And an example of the risk calculation method of the risk calculator 240 is as follows.

In this case, the prerequisite is that the risk indicator is generated for the SQL executed by the high-privileged user, and the A table is set as the audit target.

In this case, if the user is logged in as a high authority and accesses the B table, a risk is given.

Also, if the A table is accessed without logging in with a high authority, a risk is given.

If you log in with high authority and access the A table, you assign two points of risk.

If you access the B table without logging in with a high privilege, you assign a risk of 0. This example is only an example, and one point may be added for each overlapping risk factor.

In addition, in the embodiment of the present invention, it is possible to confirm what data has been examined later or to have a person calling the data query. That is, the data corresponding to a specific risk index is examined through the following trace. You can also track the history of more than 30,000 data in A table and check who has executed the SQL data.

Such embodiments of the present invention may be variously modified, and may be manufactured in various forms.

The embodiments of the present invention described above are not implemented only through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation can be easily implemented by those skilled in the art from the description of the above-described embodiments.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

100: database unit 110: log generator
200: analysis unit 210: manager unit
220: information storage unit 230: log analyzer
240: risk calculator

Claims (4)

A database unit providing information requested by an external computer and generating and outputting log information of the provided information;
An analysis unit for calculating a risk of the log information by referring to at least one risk index indicating a stored dangerous condition;
The risk level is determined by scoring a risk level corresponding to the number of the risk indicator corresponding to the log information,
The database unit,
A database server providing information requested by an external computer;
It includes a log generator for generating historical information about the information provided by the database server as log information,
The analysis unit,
An information storage unit for storing the risk indicator, risk information, and log information;
A log analyzer for shaping the log information and storing the log information in the information storage unit;
A risk estimator for calculating a risk of the log information with reference to the risk indicator,
The risk indicators may be set and stored in advance in case of including the main target of interest, the mass data inquiry, and the high authority access.
Risk estimation system using log generation history and scoring. delete delete Providing information by a database server in response to a request from an external computer;
Generating and outputting log information of information provided from the database server by a log generator;
Analyzing the risk information of the log information with reference to at least risk indicator information, including
The risk indicator information includes at least one risk indicator indicating a dangerous condition,
Set these risk indicators for cases that include key target access, mass data lookup, and high-privilege access,
The risk level is determined by scoring a degree of risk corresponding to the number of the risk indicators corresponding to the log information.
Risk estimation method using log generation history and scoring.

Images