KR101478227B1 - Central management device processing event logs having different types and operating method thereof - Google Patents

Abstract

The present invention relates to security devices connected to a network and an integrated management apparatus for managing the same. The integrated management apparatus according to an embodiment of the present invention includes: a receiving unit to receive different type event logs through a network from at least one security device; an IP analyzing unit to extract a plurality of IPs from the event logs to determine an extraction number of each type of IPs; a normalization unit to calculate the extraction number and a corresponding type of each type of the IPs, to determine a degree of risk of each type of the IPs, and add the degree of risk corresponding to the same IPs among different type of IPs to calculate a comprehensive degree of risk for IPs.

Description

TECHNICAL FIELD [0001] The present invention relates to an integrated management apparatus for processing different types of event logs, and an operation method thereof. [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic apparatus, and more particularly, to security apparatuses connected to a network and an integrated management apparatus for managing the same.

Network security problems such as the infiltration of malicious code from resources connected to a network or leakage of files containing information requiring security are becoming important social problems. For example, as the information and communication technology develops rapidly, many people can work in the company and send and receive data using messenger and mail programs, and the above programs illegally leak security- It can be used as a tool to import code.

Security devices connected to the network process data packets communicated over the network and generate and store event logs. These event logs can be used to monitor data packets communicated through the network network and resources connected to the network. For example, if a problem such as illegal file leaks occurs, the administrator can analyze the stored event logs, search for leaked files and file leakers, and identify the cause of the accident.

Meanwhile, various types of security processes have been performed recently. For example, firewall, Intrusion Prevention System (IPS), Web Application Firewall, Anti-Virus, Anti-Spam, Application Control, The security processes can be performed. For example, a security device capable of performing security processes of at least two of the above schemes may be used. In particular, in the case of a bank server requiring high security, it will perform security processing for the network in a number of ways.

Different types of event logs are generated when the security processes of the multiple schemes are thus performed. That is, a first type of event logs are generated when the first type of security processing is performed, and a second type of event logs are generated when the second type of security processing is performed. Alarm information may be provided to an administrator when certain conditions such as the number of occurrences of a particular type of event logs exceed a certain criterion or occur intensively during a particular period of time. However, if an attacker attempts to perform various types of multiple attacks to generate multiple types of event logs, the alarm information may not be provided because the number of occurrences of each type of event logs does not exceed a threshold value. In this case, it is difficult for the administrator to recognize the possibility of a security threat or a security threat.

The present invention is for detecting security threats when different types of event logs are generated and received by an integrated management device over a network.

An integrated management apparatus according to an exemplary embodiment of the present invention includes a receiving unit configured to receive different types of event logs from at least one security device through a network; An IP analysis unit configured to extract a plurality of IPs from the event logs and determine an extraction frequency of each type of IPs; A normalized IP risk is calculated by calculating the number of times of extraction of each type of IPs and the reference value of the type to determine the IP risk for each type and summing the IP risks for each type corresponding to the same IP among the different types, part; And a sensing unit configured to compare the comprehensive IP risk with a threshold to provide alarm information.

In an embodiment, the integrated management apparatus may further include a reference value setting unit that stores a reference value of each of the different types.

In an embodiment, the integrated management device may further comprise a memory configured to store the event logs.

As an embodiment, each of the event logs may include data indicating whether the corresponding event log is generated as security processing is performed in some manner. In this case, the IP analysis unit may include a log type determination module for determining the type of each of the event logs by referring to data indicating whether the corresponding event log is generated as the security processing is performed in some manner.

As an embodiment, the normalization unit may include a type-specific IP risk calculation module configured to calculate the type-A IP risk by dividing a reference value of the type in the extraction frequency of each type-based IP. Also, the normalizing unit may include a general IP risk calculation module configured to calculate a total IP risk for each of the plurality of IPs by summing IP risks for each type corresponding to the same IP among the different types.

In an embodiment, the integrated management apparatus may further include a memory for storing the IP risk and the integrated IP risk according to the type.

Another aspect of the present invention relates to a method of operating an integrated management apparatus. An integrated management device according to an embodiment of the present invention includes: receiving different types of event logs through a network; Extracting a plurality of IPs from the event logs and determining an extraction frequency of each type of IPs; Determining an IP risk for each type by calculating an extraction frequency of each type of IP and a reference value of the type; Calculating a total IP risk by summing IP risks of each type corresponding to the same IP among the different types; And comparing the integrated IP risk with a threshold value to provide alarm information.

As an embodiment, the method of operation may further comprise setting reference values respectively corresponding to the different types.

In an embodiment, the step of determining the number of times of extraction of each type of IP may include determining the type of each of the event logs.

In an embodiment, the plurality of types of event logs are generated by performing security processes in a plurality of ways in the at least one security device, and are transmitted to the integrated management device via the network.

Another aspect of the present invention relates to a storage medium storing a plurality of program codes. A storage medium according to an exemplary embodiment of the present invention stores a plurality of program codes readable by a computing device connected to a network, wherein the plurality of program codes are transmitted from at least one security device to different types of event logs A first program code for extracting a plurality of IPs from the event logs and determining an extraction frequency of each type of IPs; A second program code for calculating the number of times of extraction of each type of IPs and a reference value of the type to determine the IP risk for each type; A third program code for calculating a total IP risk by summing the IP risks for each type corresponding to the same IP among the different types; And a fourth program code for providing the alarm information by comparing the comprehensive IP risk with a threshold value.

According to the embodiment of the present invention, security threats are efficiently detected even when different types of event logs are received by the integrated management device through the network.

1 is a conceptual diagram showing a network system.
2 is a block diagram showing an embodiment of the integrated management apparatus of FIG.
3 to 5 are tables for explaining IP risks according to types calculated in the integrated management apparatus.
6 is a table for explaining comprehensive IP risks calculated in the integrated management apparatus.
7 is a flowchart illustrating an operation method of an integrated management apparatus according to an embodiment of the present invention.
FIG. 8 is a block diagram showing an embodiment for implementing the integrated management apparatus of FIG. 2. FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

FIG. 1 is a conceptual diagram showing a network system 100. FIG.

1, the network system includes a web server 110, first to nth security devices 121 to 12n, an integrated management device 130, a plurality of PCs 141 to 14k, and a network 150 ).

The web server 110 is connected to the network 150 through the first to nth security devices 121 to 12n. The web server 110 is connected to the plurality of PCs 141 to 14k through the network 150 and supports a specific service to the plurality of PCs 141 to 14k. The web server 110 will exchange data packets with the plurality of PCs 141 to 14k through the network 150. [

The first to nth security devices 121 to 12n are connected between the network 150 and the web server 110. The first to nth security devices 121 to 12n are configured to manage data packets communicated between the network 150 and the web server 110.

The first to nth security devices 121 to 12n perform security processes in various manners. For example, each of the first to nth security devices 121 to 12n may include a firewall, an Intrusion Prevention System (IPS), an anti-virus, an anti-spam, DDoS, and application control functions installed on the Web server. For example, the first to n-th security devices 121 to 12n may be a Unified Threat Management (UTM) device, a Firewall device, an Intrusion Prevention System (IPS) device, a WAF Web Application Firewall) equipment, application control equipment, and DDoS equipment.

The first to nth security devices 121 to 12n generate different types of event logs. That is, different types of event logs appear when security processes are performed in different ways. For example, when the first and second security devices 121 and 122 operate in the manner of a firewall and an intrusion blocking system, respectively, the first and second security devices 121 and 122 generate a firewall log and an IPS log, respectively. For example, if the first security device 121 is a Unified Threat Management (UTM) device, the first security device 121 may perform security processes in two or more ways while generating different types of event logs .

The generated event logs are transmitted to the integrated management device 130 through the network 150. As another example, the event logs are transmitted to and stored in a log collection server (not shown) through the network 150, and the integrated management device 130 collects event logs collected through the network 150 from the log collection server Can be provided.

The integrated management device 130 is connected to the first to nth security devices 121 to 12n through the network 150. [ The integrated management device 130 is configured to notify the user of security threats by normalizing received event logs of various types.

2 is a block diagram illustrating an embodiment 200 of the integrated management device 130 of FIG. FIGS. 3 to 5 are tables for explaining IP risks according to types calculated in the integrated management apparatus 200. FIG. 6 is a table for explaining comprehensive IP risks calculated in the integrated management apparatus 200. As shown in FIG.

1 and 2, the integrated management device 200 includes a receiving unit 210 configured to receive different types of event logs from at least one of the security devices 121 through 12n through the network 150, An IP analyzer 230 configured to extract a plurality of IPs from event logs and to determine the number of times of extraction of each type of IPs, a memory 220 for storing received event logs, A normalizing unit 240 configured to calculate the total IP risk by summing the IP risks for each type corresponding to the same IP among different types by calculating the number of times of extraction and the reference value of the type to determine the IP risk for each type, A detection unit 250 configured to compare the IP risk with a threshold value to generate alarm information, and to store and normalize each type of reference value And a reference value setting unit (260) configured to provide the reference value to the unit (240).

The receiving unit 210 is connected to the network 150 and receives event logs generated from the security devices 121 to 12n. These event logs are different types of event logs as described above.

The memory 220 stores event logs received through the receiving unit 210. [

The IP analysis unit 230 is connected to the memory 220. The IP analysis unit 230 includes a log type determination module 235.

Each event log contains data indicating whether or not it occurred as a result of the security processing being performed. The log type determination module 235 identifies the type of each event log based on this data.

The IP analysis unit 230 extracts IPs from the event logs and determines the number of times each of the IPs is extracted for each type. The number of times of extracting the upper part of one of the security devices 121 to 12n while processing the traffic between the corresponding IP (for example, the IP of 141 in FIG. 1) and the web server 110 It will mean the number of times event logs are generated. When the number of extraction times of each of the IPs is determined for each type, the corresponding information is stored in the memory 220.

The tables shown in FIGS. 3 to 5 are tables arranged in descending order based on the extraction frequency of each of the IPs. 3, the first to fifth IPs IP1 to IP5 are respectively allocated to 600, 480, 300, and 300, respectively, while the first type of security processing is performed (for example, 260 and 100 times. 4, the second type of security processing is performed (e.g., 122 performs security processing), and the fifth, first, fourth, third and second IPs IP5, IP1, IP4, IP3 and IP2 were extracted 250, 220, 190, 110 and 90, respectively. 5, a third type of security processing is performed (e.g., 12n performs security processing), and the first, fifth, third, second and fourth IPs IP1, IP5, IP3, IP2 , IP4) were extracted 550, 420, 310, 220 and 110, respectively.

It can be seen that the second type of security processing generates event logs relatively fewer times than the first type and the third type.

Referring again to FIG. 2, the normalization unit 240 is connected to the memory 220. The normalization unit 240 includes a type-specific IP risk calculation module 241 and a general IP risk calculation module 242.

The type-based IP risk calculation module 241 is configured to calculate the IP risk for each type by calculating the extraction frequency of each type of IP and the reference value of the corresponding type. The computed type-specific IP risk is stored in the memory 220.

In one embodiment, the IP risk for each type can be calculated by dividing the number of times of extraction of each type of IP by the reference value of the corresponding type. In this case, for example, a security processing method (for example, a security processing method corresponding to the first type) in which event logs are generated at a relatively high frequency corresponds to a large reference value, and event logs are generated at a relatively low frequency The security processing method (for example, the security processing method corresponding to the second type) can correspond to a small reference value. The IP risk per type can be normalized by applying different reference values for each security processing method.

Referring to FIG. 3, the reference value corresponding to the first type is 1000. When the reference value is divided by the number of times of extraction, the IP risk per type corresponding to the first to fifth IPs IP1 to IP5 is 0.6, 0.48, 0.3 0.26 and 0.1, respectively. Referring to FIG. 4, the reference value corresponding to the second type is 500 considering the characteristic that the security processing corresponding to the second type generates the event logs with a relatively small number of times. The IP risk per type corresponding to the fifth, first, fourth, third and second IPs IP5, IP1, IP4, IP3 and IP2 is 0.5, 0.44, 0.38, 0.22 And 0.18. Referring to FIG. 5, the reference value corresponding to the third type is 900. The IP risk for each type corresponding to the first, fifth, third, second and fourth IPs IP1, IP5, IP3, IP2 and IP4 is 0.61, 0.47, 0.34, 0.24 And 0.12.

As another embodiment, not only the reference value but also the ranking described in the table of FIG. 3 to FIG. 5 may be considered as follows.

Referring to Equation (1), the RD risk for each type is calculated by multiplying the rank value of the corresponding IP by 0.5, adding the reference value of the corresponding type to the number of times of extracting the relevant IP, and multiplying the value by 0.5.

In addition, it will be understood that the type of IP risk can be calculated in various ways.

Referring again to FIG. 2, the integrated IP risk calculation module 242 calculates a total IP risk by summing IP risks for each type corresponding to the same IP among a plurality of types. The calculated total IP risk is stored in the memory 220.

3 to 5, the IP risks for each type of the first IP IP1 are 0.6, 0.44, and 0.61 in the first to third types, respectively. 1.65. The IP risks for each type of the second IP (IP2) are 0.48, 0.18, and 0.24 in the first to third types, respectively, and the total IP risk by adding them is 0.9 as shown in FIG. The IP risk per type of the third IP (IP3) is 0.3, 0.22, and 0.34, and the total IP risk sum by adding them is 0.86 as shown in FIG. The IP risk per type of the fourth IP (IP4) is 0.26, 0.38, and 0.12, and the total IP risk by adding them is 0.76 as shown in FIG. The IP risk per type of the fifth IP (IP5) is 0.1, 0.5, and 0.47, and the total IP risk by adding them is 1.07 as shown in FIG. Here, although the fifth IP (IP5) is extracted from the first type considerably (100 times), since the reference value is extracted from the second type having a low reference number (250 times), the comprehensive IP risk becomes larger than 1 have.

Referring again to FIG. 2, the sensing unit 250 is connected to the memory 220. The detection unit 250 compares the integrated IP risks corresponding to the respective IPs with a threshold value and provides alarm information. For example, when the threshold value is 1, the composite IP risks corresponding to the first and fifth IPs IP1 and IP5 in FIG. 6 are larger than one. The detection unit 250 may provide alarm information indicating that the first and fifth IPs IP1 and IP5 are higher than the threshold value. Accordingly, the administrator can recognize that there is a possibility that a security threat is generated or generated from the first and fifth IPs IP1 and IP5 and set a security policy.

The reference value setting unit 260 stores reference values of the respective types. In one embodiment, this reference value may be preset and may be changed by the administrator.

According to an embodiment of the present invention, the integrated management device 130 notifies the user of security threats by normalizing various types of event logs. Therefore, even if there are various types of event logs, security threats can be efficiently detected by calculating a comprehensive risk level.

7 is a flowchart illustrating an operation method of the integrated management device 130 according to an embodiment of the present invention.

Referring to FIGS. 1 and 7, in step S110, different types of event logs are received in the integrated management device 130 through the network 150. FIG.

In step S120, IPs are extracted from different types of event logs, and the number of times of extraction of each of the IPs is determined for each type. In step S130, the extraction frequency of each of the IPs and the reference value of the corresponding type are calculated for each type to determine the IP risk for each type. For example, the tables shown in FIGS. 3 to 5 may be generated through steps S120 and S130.

In step S140, the overall IP risk is calculated by summing the IP risks per type corresponding to the same IP among the different types. Through the comprehensive IP risk, the frequency of occurrence of event logs related to each IP is normalized and the degree of security threat is determined. For example, the table as shown in FIG. 6 may be generated through step S140.

In step S150, it is determined whether or not the comprehensive IP risk is greater than a threshold value. If the total IP risk is greater than the threshold value, in step S160, alarm information is generated to inform that there is a possibility that a security threat may occur or occur in the corresponding IP.

FIG. 8 is a block diagram illustrating an embodiment 1000 for implementing the integrated management device 200 of FIG.

8, the integrated management apparatus 1000 includes a central processing unit (CPU) 1100, a random access memory (RAM) 1200, a user interface 1300, a nonvolatile storage medium 1400, A power supply 1500, a transceiver 1600, and a system bus 1700.

The central processing unit 1100 and the RAM 1200 may perform functions of the IP analysis unit 230, the normalization unit 240 and the sensing unit 250 described with reference to FIG. For example, the program codes for performing the functions of the IP analysis unit 230, the normalization unit 240, and the sensing unit 250 are stored in the nonvolatile storage medium 1400, and the program codes are stored in the RAM 1200 And the central processing unit 1100 executes the program codes loaded on the RAM 1200 to perform the functions of the IP analysis unit 230, the normalization unit 240, and the sensing unit 250, respectively.

As an embodiment, there is provided a removable storage medium for performing the functions of the IP analysis unit 230, the normalization unit 240 and the sensing unit 250, and for storing program codes readable by the central processing unit 1100 And the program codes stored in the removable storage medium can be copied to the nonvolatile storage medium 1400 mounted in the integrated management apparatus 1000. [

The RAM 1200 may perform the functions of the memory 220 described with reference to FIG.

The transceiver 1600 may perform the functions of the receiver 210 described with reference to FIG.

It is to be understood that FIG. 8 is merely an embodiment of the integrated management device 200, and that the integrated management device 200 of FIG. 2 may be implemented in various ways.

According to the embodiment of the present invention, even if various types of event logs are received, they can be normalized to notify a user of a security threat to a specific IP. Therefore, security threats can be efficiently detected even if there are various types of event logs.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the equivalents of the claims of the present invention as well as the claims of the following.

110: Web server
121 to 12n: first to nth security devices
130, 200: Integrated management device
140: First to k < th > PCs
150: Network
210:
220: Memory
230: IP analysis section
240: normalization unit
250:
260: Reference value setting section

Claims (13)

There is provided an integrated management apparatus connected through a network to at least one security device for generating a plurality of types of event logs by performing security processes in a plurality of manners;
A receiving unit configured to receive different types of event logs from the at least one security device through the network;
An IP analysis unit configured to extract a plurality of IPs from the event logs and determine an extraction frequency of each type of IPs;
Determining a type of IP risk for each type of IP by calculating an extraction frequency of each type of IP and a reference value of the type, summing IP risks for each type corresponding to the same IP among the different types, A normalizing unit configured to calculate comprehensive IP risks corresponding to IP addresses; And
And a sensing unit configured to compare the combined IP risks with a threshold to provide alarm information. The method according to claim 1,
And a reference value setting unit that stores a reference value of each of the different types. The method according to claim 1,
And a memory configured to store the event logs. The method according to claim 1,
Wherein each of the event logs includes data indicating whether a corresponding event log has been generated as a result of the security process being performed. 5. The method of claim 4,
Wherein the IP analysis unit determines a type of each of the event logs by referring to data indicating whether the corresponding event log is generated as the security process is performed in the certain manner. The method according to claim 1,
Wherein the normalizing unit divides the reference value of the corresponding type by the number of times of extraction of each of the type-specific IPs to calculate the IP risks according to the type of IPs of each type. delete The method according to claim 1,
The IP risks for each type of IPs, and the integrated IP risks. A method for operating an integrated management device connected to at least one security device through a network, the method comprising:
Receiving different types of event logs through the network;
Extracting a plurality of IPs from the event logs and determining an extraction frequency of each type of IPs;
Determining IP risks for each type of IP by calculating an extraction frequency of each type of IP and a reference value of the type;
Calculating total IP risks corresponding to the plurality of IPs by summing IP risks for each type corresponding to the same IP among the different types; And
And comparing the composite IP risks with a threshold value to provide alarm information. 10. The method of claim 9,
And setting reference values corresponding to the different types, respectively. 10. The method of claim 9,
Wherein the step of determining the number of times of extraction of each type of IP includes determining the type of each of the event logs. 10. The method of claim 9,
Wherein the plurality of types of event logs are generated as the security processes are performed in a plurality of ways in the at least one security device and are delivered to the integrated management device via the network. 1. A storage medium storing a plurality of program codes readable by a computing device connected to a network, comprising:
The plurality of program codes may include:
A first program code for extracting a plurality of IPs from the event logs and determining an extraction frequency of each type of IPs when different types of event logs are received from the at least one security device through the network;
A second program code for computing the number of times of extraction of each type of IP and a reference value of the type to determine IP risks for each type of IP by type;
Third program code for calculating a total IP risks corresponding to the plurality of IPs by summing up IP risks for each type corresponding to the same IP among the different types; And
And fourth program code for comparing the composite IP risks with a threshold value to provide alarm information.

Images