KR101499116B1 - Method for discriminating securty events, and apparatus applied to the same - Google Patents

Abstract

The present invention discloses a method for discriminating a security event and a device applied thereto. Received reception traffic that is destined for a subject agency and transmission traffic transmitted from the subject agency are identified from network traffic collected in relation to the subject agency so as to be visually displayed in a three-dimensional space, and a security event is discriminated from a form in which the reception traffic and the transmission traffic are displayed in the three-dimensional space, so that massive cyber threats can be detected quickly and accurately.

Description

METHOD FOR DISCRIMINATION SECURITY EVENTS, AND APPARATUS APPLIED TO THE SAME,

The present invention identifies received traffic received from the network traffic collected in relation to a target organization and destination traffic received from the target organization and transmission traffic transmitted from the target organization, and visually displays the received traffic in a three- The present invention relates to a method for effectively discriminating security events from a form in which traffic and transmission traffic are displayed on a three-dimensional space.

Effective control and countermeasures against infringement threat information are required in order to perform prompt and accurate security control and countermeasures in response to rapidly changing cyber threat situations.

For this purpose, in the case of the Threat Management System (TMS), a sensor is installed at the network side of the target organization to collect network traffic, and the security event can be controlled in real time from the collected network traffic It is common to provide a user interface.

In this way, the security events that can be controlled by the intrusion threat analysis system are increasing as the number of institutions to be controlled and the cyber threats caused by the increase of the Internet usage increase.

However, the user interface provided by the above-described infringement threat analysis system is provided as a text based, which makes it difficult to intuitively analyze an enormous amount of security events, and also causes a heavy workload of the control personnel Problems exist.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and an object to be achieved by the present invention is to provide a method and apparatus for receiving traffic from a network traffic collected in association with a target organization, And identifies the security events from the form in which the received traffic and the transmitted traffic are displayed on the three-dimensional space. Thus, cyber threats occurring in a large amount can be rapidly So that they can grasp accurately.

According to a first aspect of the present invention, there is provided a security event determination apparatus comprising: a reception traffic receiving unit configured to receive, from a network traffic collected in association with a target organization, An identification unit for identifying transmission traffic to be transmitted; A display unit for visualizing both the received traffic and the transmission traffic in a three-dimensional space and displaying the three-dimensional space; And a determination unit for determining a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic displayed on the three-dimensional space.

More specifically, in the three-dimensional space, in a rectangular coordinate system consisting of an X-axis Y-axis forming a horizontal plane and a Z-axis forming a vertical plane with respect to the horizontal plane, the first rectangular hexahedron having the same shape and size, Wherein the display unit is configured to continuously display the received traffic on the first rectangular hexahedron and the second rectangular hexahedron where the vertical surfaces of the cubes are adjacent to each other in the three- And the transmission traffic are visualized and displayed.

More specifically, on the first right-angle hexahedron and the second right-angled hexahedron, a target engine plane corresponding to the target organization, an attack terrain plane corresponding to a source of the received traffic, and a damaged ground plane corresponding to a destination of the transmission traffic And the display unit designates a vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other as the target engine plane, and the vertical plane designated by the target organ plane at the first rectangular hexahedron Designating a vertical plane located on the opposite side of the plane as the attack horizon plane and designating a vertical plane located opposite to the vertical plane designated as the target engine plane in the second rectangular hexahedron as the damaged horizon plane, And displays all of the transmission traffic in a visualized form.

More specifically, when the target organ number is two or more, the display unit divides the target engine plane into rectangular cells (Cells) corresponding to the number of the two or more target organs, Both the traffic and the transmission traffic are visualized and displayed.

More specifically, each of the reception traffic and the transmission traffic includes a source address (IP), a source port, a destination address, and a destination port, and the display unit displays the source address and the source port The destination address and the destination port of the received traffic or the source port and the source port of the transmission traffic are visualized and displayed as coordinates on the target engine plane, In the case of the destination address and the destination port of the transmission traffic, visualized as coordinates on the damaged ground plane and displayed.

More specifically, the display unit displays the Y axis on the attacking horizon plane as coordinates of a source address of the received traffic, displays the Z axis on the attack horizon plane as coordinates of a source port of the received traffic, And visually displaying the Y axis in the target organ plane as coordinates of a destination address of the received traffic or a source address of the transmission traffic and displaying the Z axis in the target organ plane as a destination port Visualizing the Y axis as a coordinate of a source port in the transmission traffic and displaying the Y axis on the damaged ground plane as coordinates of a destination address of the transmission traffic and displaying the Z axis on the damaged ground plane as a coordinate Displayed as coordinates of the source port and visualized It characterized.

More specifically, the display unit connects the coordinates on the attack surface plane corresponding to the source address and the source port of the received traffic, and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic The coordinates of the target engine plane corresponding to the source address and the source port of the transmission traffic and the coordinates of the coordinates on the damaged ground plane corresponding to the destination address and the source port of the transmission traffic, Wherein the transmission traffic is visualized as a straight line connecting the traffic.

More specifically, the security event is discriminated on the basis of a destination address or a destination port of each of the reception traffic and the transmission traffic, and the determination unit determines whether or not the security event corresponds to the same source address and source port in each of the reception traffic and the transmission traffic And the coordinates of the destination port are the same, but the lines connecting the coordinates more than the set number corresponding to the different destination addresses are displayed, or one coordinate corresponding to the same source address and origin port and the destination address are the same And a line connecting the coordinates of the set number or more corresponding to the different destination ports is displayed as the security event.

More specifically, the security event is discriminated on the basis of a source port of each of the received traffic and the transmission traffic, and the determining unit determines that the source traffic is the same as the source port of the received traffic and the source traffic, And a line connecting one coordinate corresponding to the same destination address and the destination port are displayed as the security event.

More specifically, the security event is determined on the basis of a destination address and a destination port of the transmission traffic, and the determination unit determines that the destination address and the destination port of the transmission traffic do not exist And determines a case corresponding to a specified target organization as the security event.

According to a second aspect of the present invention, there is provided an operation method of a security event determination apparatus, comprising: receiving traffic received from a network traffic collected in association with a target organization with the target organization as a destination; An identification step of identifying a transmission traffic to be transmitted; A display step of visually displaying both the received traffic and the transmission traffic in a three-dimensional space; And a determination step of determining a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic displayed on the three-dimensional space.

More specifically, in the three-dimensional space, in a rectangular coordinate system consisting of an X-axis Y-axis forming a horizontal plane and a Z-axis forming a vertical plane with respect to the horizontal plane, the first rectangular hexahedron having the same shape and size, Wherein the display step includes a step of displaying the first rectangular hexahedron and the second rectangular hexahedron which are located such that the vertical surfaces of the cubes are adjacent to each other in the three- Both the traffic and the transmission traffic are visualized and displayed.

More specifically, on the first right-angle hexahedron and the second right-angled hexahedron, a target engine plane corresponding to the target organization, an attack terrain plane corresponding to a source of the received traffic, and a damaged ground plane corresponding to a destination of the transmission traffic Wherein at least one of the first rectangular hexahedron and the second rectangular hexahedron is specified as the target engine plane and a vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other is designated as the target engine plane, Designating a vertical plane located on the opposite side of the specified vertical plane as the attacking horizon plane and designating a vertical plane located on the opposite side of the vertical plane designated as the target engine plane in the second rectangular hexahedron as the damaged horizon plane, Both the received traffic and the transmitted traffic are visualized and displayed.

More specifically, when the target organ number is two or more, the displaying step divides the target organ plane as a rectangular cell corresponding to the number of the two or more target organs, Both the received traffic and the transmitted traffic are visualized and displayed.

More specifically, each of the reception traffic and the transmission traffic includes a source address (IP), a source port, a destination address, and a destination port, and the displaying step includes: The destination address and the destination port of the received traffic or the source address and the source port of the transmission traffic are visualized and displayed as coordinates on the target engine plane, The destination address and the destination port of the transmission traffic are displayed as coordinates on the damaged floor plane and displayed.

More specifically, the displaying includes visualizing and displaying the Y-axis on the attack plane as coordinates of a source address of the received traffic, and visualizing the Z-axis on the attack plane as coordinates of a source port of the received traffic And displays the Y axis in the target organ plane as coordinates of a destination address of the received traffic or a source address of the transmission traffic and displays the Z axis in the target engine plane in a destination port Or visualized as coordinates of a source port in the transmission traffic and displays the Y axis at the damaged ground plane as coordinates of a destination address of the transmission traffic and displays the Z axis at the damaged ground plane in the transmission traffic As the coordinates of the source port The features.

More specifically, the displaying step may include connecting the coordinates on the attack surface plane corresponding to the source address and the source port of the received traffic and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic, The coordinates of the target engine plane corresponding to the source address and the source port of the transmission traffic and the coordinates on the destination ground plane corresponding to the destination address and the source port of the transmission traffic, And visualizing the transmission traffic as a straight line connecting the two.

More specifically, the security event is discriminated on the basis of a destination address or a destination port of each of the received traffic and the transmitted traffic, and the discriminating step discriminates, based on the received traffic and the transmitted traffic, One coordinate corresponding to the destination port is displayed, and straight lines connecting the coordinates of the same number with the destination address different from the destination port are displayed, or one coordinate corresponding to the same origin address and the origin port, and the destination address And determines as the security event that the lines connecting the coordinates of the same number of the same port but different from each other are displayed.

More specifically, the security event is discriminated on the basis of a source port of each of the received traffic and the transmission traffic, and the determining step determines that the received traffic and the transmitted traffic have the same source address, As the security event, a case in which straight lines connecting coordinates having a number equal to or greater than the corresponding set number and one coordinate corresponding to the same destination address and destination port are displayed.

More specifically, the security event is determined on the basis of a destination address of the transmission traffic and a destination port, and the determining step determines that the destination address and the destination port of the transmission traffic do not exist And determines a case corresponding to a predetermined target organization as the security event.

According to a third aspect of the present invention, there is provided a computer-readable recording medium having stored thereon a program for causing a computer to function as: receiving traffic received from a network traffic collected in association with a target organization, An identification step of identifying transmission traffic to be transmitted; A display step of visually displaying both the received traffic and the transmission traffic in a three-dimensional space; And a discrimination step of discriminating a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic being displayed on the three-dimensional space.

According to the security event determination method and the apparatus to which the present invention is applied, the reception traffic received from the target organization as the destination from the network traffic collected in relation to the target organization, and the transmission traffic It is possible to quickly and accurately grasp cyber threats that occur in large quantities by identifying and displaying them on a three-dimensional space and displaying them, and discriminating security events from a form in which received traffic and transmission traffic are displayed on the three-dimensional space.

1 is a schematic configuration diagram of a security event discrimination apparatus according to an embodiment of the present invention;
FIGS. 2 and 3 are diagrams for explaining a mode in which received traffic and transmission traffic are visualized and displayed in a three-dimensional space according to an embodiment of the present invention; FIG.
FIG. 4 and FIG. 5 illustrate types of security events identified from received traffic and transmission traffic displayed on a three-dimensional space according to an embodiment of the present invention; FIG.
FIG. 6 is a flowchart illustrating an operation flow in the security event determination device according to an embodiment of the present invention; FIG.

Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a block diagram illustrating a security event determination apparatus according to an embodiment of the present invention.

As shown in FIG. 1, the security event determination apparatus according to an embodiment of the present invention includes an identification unit 100 for identifying received traffic and transmission traffic from network traffic collected in association with a target organization that requires real- A display unit 200 for visually displaying the received traffic and the transmission traffic identified on the three-dimensional space, and a determination unit 300 for determining a security event from received traffic and transmission traffic displayed on the three-dimensional space .

The security event determination apparatus according to an embodiment of the present invention may further include a collection unit (not shown) for collecting network traffic from a sensor installed at a network end of a target organization that requires real-time monitoring, in addition to the above- Configuration.

Here, all or a part of the above-described configuration of the security event determination apparatus according to an embodiment of the present invention including the identification unit 100, the display unit 200, the determination unit 300, and the collection unit (not shown) Implemented in the form of a software module executed by a processor, or implemented as hardware.

The security event determination device refers to various devices having a display panel capable of displaying received traffic and transmission traffic to be visualized.

For example, the security event determination device may be a device having a display panel capable of displaying received traffic and transmission traffic that can be visualized, such as, but not limited to, a PC, a tablet PC, and a PDA May all be included.

Meanwhile, according to an embodiment of the present invention, a user interface for discriminating security events in real time from network traffic collected in association with a target organization requiring real-time monitoring is provided.

As such, in the case of a user interface provided for discrimination of security events, it is common to be provided as a text basis.

However, in the case of security events, as the number of target institutions to be controlled increases, and as the cyber threat due to an increase in the use of the Internet increases, the number increases greatly. However, in the case of providing a text-based user interface as described above, Intuitive analysis of the security events of the control personnel is difficult, and also causes heavy workload of the control personnel.

Thus, in order to quickly and accurately identify a large amount of security events in an environment where the target organization or cyber threats are controlled, a new scheme for effective control and response is required

Accordingly, in one embodiment of the present invention, a new method for quickly and accurately discriminating a security event from network traffic collected in association with a plurality of target entities requiring control is proposed. Hereinafter, .

First, the identification unit 100 performs a function of identifying network traffic collected in association with the target organization.

More specifically, the identification unit 100 identifies the received traffic received from the network traffic collected in relation to the target organization to the target organization, and conversely, the transmission traffic transmitted from the target organization.

At this time, the identification unit 100 identifies a source address (IP), a source port, a destination address, and a destination port of each of the received traffic and the transmission traffic from the network traffic.

The identification unit 100 identifies each of the received traffic and the transmitted traffic by using a network protocol (e.g., TCP, UDP, ICMP), an identification time (detection time), and a packet Packets (for example, bps, Kbps, Mbps).

The display unit 200 displays the received traffic and the transmitted traffic in a visualized manner.

More specifically, when the receiving traffic and the transmission traffic for the target organization are identified in the identifying unit 100, the display unit 200 displays the first and second right-angled hexahedrons positioned adjacent to each other on the three- Both the received traffic and the transmitted traffic are visualized and displayed.

At this time, as shown in Fig. 2, the display unit 200 has a rectangular coordinate system of a three-dimensional space consisting of an X-axis Y-axis forming a horizontal plane and a Z-axis forming a vertical plane with respect to the horizontal plane, One right-angled hexahedron and the second right-angled hexahedron are successively positioned so that their vertical surfaces are adjacent to each other in the X-axis direction.

Here, on the first right-angled hexahedron and the second right-angled hexahedron, damage plane planes corresponding to the target engine plane corresponding to the target organs, the attack horizon plane corresponding to the start point of the received traffic, and the destination of the transmission traffic may be designated.

Thus, the display unit 200 designates the vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other as the target engine plane, and also designates, as the target engine plane, And designates a vertical plane located on the opposite side of the vertical plane designated as the target engine plane in the second rectangular hexahedron as the damaged horizontal plane.

In addition, as described above, when the attack surface planes, the target engine planes, and the damaged horizon planes are designated on the first and second rectangular hexahedral bodies positioned on the three-dimensional space as described above, In addition to visualizing and displaying received traffic on a plane, transmission traffic is visualized on the target engine plane and the damaged ground plane.

Here, in the case of the source address and the source port of the received traffic, the destination address and the destination port of the received traffic, or the source address and the source port of the received traffic, are displayed as coordinates on the attack floor plane, And in the case of the destination address and the destination port of the transmission traffic, it can be visualized as coordinates on the damaged ground plane and displayed.

Accordingly, the display unit 200 visualizes and displays the Y axis on the attacking horizon as the coordinates of the source address of the received traffic, and displays the Z axis on the attack horizon as the coordinates of the source port of the received traffic.

The display unit 200 visually displays the Y axis in the target engine plane as coordinates of the destination address of the received traffic or the source address of the transmission traffic and displays the Z axis in the target engine plane in the destination port And is visualized as coordinates of the source port in the transmission traffic.

In addition, the display unit 200 visualizes and displays the Y axis on the damaged ground plane as coordinates of the destination address of the transmission traffic, and displays the Z axis on the damaged ground plane as coordinates of a source port of the transmission traffic.

On the other hand, as described above, the following method may be applied in displaying the source address, the source port, the destination address, and the destination port in the attack plane plane, the target engine plane, and the damaged plane plane as coordinates, respectively.

First, in the case of the source address of the received traffic displayed on the attack plane and the source address of the transmission traffic displayed on the target engine plane, for example, a linear method, which is a method of linearly rearranging the decimal converted value of the source address, Can be applied.

In this case, in case of attack plane plane where the source address of the received traffic is displayed and Y axis of the target engine plane in which the source address of the transmission traffic is displayed, the minimum value (0.0.0.0) of the source address is changed from '0' 4,294,967,295 ", which is a value obtained by converting the maximum value (255.255.255.255) of the pixel value to decimal value.

Conversely, in the case of the destination address of the received traffic displayed on the target organ plane and the destination address of the transmission traffic displayed on the damaged horizon, for example, the destination address is inverted, and then the decimal conversion value of the inverted destination address is linearly listed The Reversed Octet Method can be applied.

In this case, when the Y axis of the target engine plane in which the destination address of the received traffic is displayed and the Y axis of the damaged plane in which the destination address of the transmission traffic is displayed, the minimum value (0.0.0.0) 4,294,967,295 'which is a value obtained by converting the maximum value (255.255.255.255) of the starting address to a decimal number.

For example, when the destination address is' 192.168.0.5 ', if the above-described inverse conversion method is applied, the destination address becomes' 5.0.168.192', and if it is converted into a decimal value, it becomes '83, 929,280 ' It can be the coordinate value in the Z-axis of the plane or the damage plane.

Applying the inverse conversion method as the coordinate value of the destination address is one of security events to easily identify a network scan in which the destination port is scanned by changing the destination address in a fixed state.

That is, when the destination address of the received traffic or the transmitted traffic increases by 1, the actual decimal conversion value in the inverse conversion method is increased by 2 ^ 24 (16,777,216), not by 1, Because.

Next, in the case of the destination port of the received traffic displayed on the attack plane, the destination port of the received traffic and the destination port of the transmitted traffic displayed on the target engine plane, and the destination port of the transmitted traffic displayed on the damaged horizon, A common logarithmic method for converting the value into a commercial log value may be applied.

The Z axis of the attack plane showing the source port of the received traffic, the Z axis of the target engine plane in which the destination port of the received traffic and the source port of the transmitted traffic are displayed, and the Z axis of the damaged plane showing the destination port of the transmission traffic 4.8164733038 ', which is a value obtained by converting the maximum value (65535) of the source port to the common log from the minimum value' 0 '.

Furthermore, as described above, when the originating address, the originating port, the destination address, and the destination port are displayed as coordinates on the attacking horizon plane, the target engine plane, and the damaged horizon plane, the display unit 200 displays a straight line And visualizes the transmission traffic as a straight line connecting between the target engine plane and the damaged ground plane.

That is, the display unit 200 displays the received traffic as a straight line connecting the coordinates on the attacking ground plane corresponding to the source address and the source port of the received traffic and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic. And displays the transmission traffic as a straight line connecting the coordinates on the target agency plane corresponding to the source address and the source port of the transmission traffic and the coordinates on the damaged ground plane corresponding to the destination address and the source port of the transmission traffic, Visualized and displayed.

On the other hand, not only one target organ but also a plurality of target organs can be displayed on the target organ plane.

3 (a), the display unit 200 divides the target engine plane into respective rectangular cells (Cells) corresponding to the number of target organs (for example, 47) requiring the control, The received traffic and the transmission traffic are separately visualized and displayed for each of the divided rectangular cells.

At this time, when a specific target organization (for example, KS) being displayed on the target organization plane is selected, the display unit 200 independently displays only the received target traffic for the selected target organization as shown in FIG. 3 (b) And the transmission traffic can be separately visualized and displayed.

In addition, the display unit 200 displays the received traffic and the transmitted traffic in a three-dimensional space and displays the received traffic and the transmitted traffic in a group according to a network protocol (for example, TCP, UDP, ICMP) And visualize them by name and color according to the classified group.

For example, if the network protocol is TCP, the port associated with HTTP [80 (of HTTP), 8080 (of Tomcat), 443 of HTTPS), the port associated with Remote Access [3389 (of RDP) SSH), NetBIOS related port [139 (of NetBIOS)], e-mail related port [25 (of SMTP), 110 (of POP3), 143 (of IMAP) MS-SQL), 1521 (of Oracle), 3306 (of My SQL), and well-known ports [0-1023 (except for the ports mentioned above).

In addition, if the network protocol is UDP, it can be classified into a DNS related port [53 (of DNS), a well-known port [0-1023 (except for the port mentioned above)] and the like.

In addition, in the case of the network protocol IMCP, one group can be classified regardless of the port.

In addition, when receiving traffic or transmission traffic displayed as a straight line in a three-dimensional space is selected by the user, the display unit 200 displays, for example, a network protocol, a source address (port), a destination address Additional information such as the identification time (detection time), the amount of packets, and the name of the target organization (country) may be displayed together.

Then, the determination unit 300 performs a function of determining a security event.

More specifically, the determination unit 300 determines various security events occurring in relation to the target organization from the display form of the reception traffic and the transmission traffic displayed on the three-dimensional space.

Here, in the case of a security event discriminated by the determiner 300, for example, a network scan event, a port scan event, and a DDoS event may be applicable.

For example, as shown in FIG. 4 (a), the determination unit 300 determines that one of the coordinates corresponding to the same source address and source port in each of the received traffic and the transmitted traffic is the same as the destination port, If lines connecting a plurality of coordinates corresponding to a destination address are displayed, it can be determined as a network scan event.

As another example, as shown in FIG. 4 (b), the determination unit 300 may determine that one of the coordinates corresponding to the same source address and source port in the received traffic and the transmitted traffic has the same destination address, If straight lines connecting a plurality of coordinates corresponding to a destination port are displayed, it can be discriminated as a port scan event.

As another example, as shown in FIG. 5 (a), the determination unit 300 may include a plurality of coordinates corresponding to a source port having the same source address but different from each other in a reception traffic and a transmission traffic, And a line connecting one coordinate corresponding to the destination port are displayed, it can be discriminated as a disable event.

5 (b), when the destination address and the destination port of the transmission traffic correspond to the predetermined specific target organization in the state where there is no received traffic, That is, if the transmission traffic is the destination of the target organization and another destination is the destination, it can be determined as a security event.

As described above, according to the security event discrimination apparatus according to an embodiment of the present invention, the network traffic collected in relation to the target organization is used as a source of received traffic received from the target organization, By identifying the transmission traffic to be transmitted and visualizing it on a three-dimensional space, and by identifying the security event from the form in which the received traffic and the transmission traffic are displayed in the three-dimensional space, the cyber threat that occurs in large quantities can be quickly .

Hereinafter, an operation method of the security event determination device according to an embodiment of the present invention will be described with reference to FIG.

Here, for convenience of description, the components shown in FIG. 1 will be described with reference to corresponding reference numerals.

First, the identification unit 100 identifies received traffic received from the network traffic collected in relation to the target organization with the target organization as a destination, and conversely, transmission traffic transmitted from the target organization as a departure (S100).

At this time, the identification unit 100 identifies a source address (IP), a source port, a destination address, and a destination port of each of the received traffic and the transmission traffic from the network traffic.

The identification unit 100 identifies each of the received traffic and the transmitted traffic by using a network protocol (e.g., TCP, UDP, ICMP), an identification time (detection time), and a packet Packets (for example, bps, Kbps, Mbps).

Then, when the receiving traffic and the transmission traffic for the target organ are identified in the identifying unit 100, the display unit 200 places the first rectangular hexahedron and the second rectangular hexahedron adjacent to each other in the three-dimensional space (S200).

At this time, in the rectangular coordinate system of the three-dimensional space formed by the X-axis Y-axis forming the horizontal plane and the Z-axis forming the vertical plane with respect to the horizontal plane, the display unit 200 displays the first rectangular hexahedron having the same shape and size, The hexahedron is successively positioned so that the vertical planes of the cubes are adjacent to each other in the X-axis direction.

Next, the display unit 200 designates the vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other as the target engine plane, and also designates, as the target engine plane, the opposite plane of the vertical plane designated by the target engine plane in the first rectangular hexahedron And a vertical plane located opposite to the vertical plane designated by the target engine plane in the second rectangular hexahedron is designated as the damaged horizontal plane at step S300.

Then, the display unit 200 displays the source address and the source port of the received traffic as coordinates on the attack floor plane, and also displays the destination address and the destination port of the received traffic or the source address and the source port of the received traffic on the target engine plane The destination address and the destination port of the transmission traffic are visualized as coordinates on the horizon plane and displayed (S400).

At this time, the display unit 200 visualizes and displays the Y axis on the attacking horizon as coordinates of the source address of the received traffic, and displays the Z axis on the attack horizon as the coordinates of the source port of the received traffic.

The display unit 200 visualizes and displays the Y axis in the target engine plane as the coordinates of the destination address of the received traffic or the source address of the transmitted traffic and displays the Z axis in the target engine plane in the destination port or the transmission And is displayed as coordinates of the source port in traffic.

In addition, the display unit 200 visualizes and displays the Y axis on the damaged ground plane as coordinates of the destination address of the transmission traffic, and displays the Z axis on the damaged ground plane as coordinates of a source port of the transmission traffic.

Furthermore, as described above, when the originating address, the originating port, the destination address, and the destination port are displayed as coordinates on the attacking horizon plane, the target engine plane, and the damaged horizon plane, the display unit 200 displays a straight line And visualizes the transmission traffic as a straight line connecting between the target engine plane and the damaged ground plane (S500).

At this time, the display unit 200 displays the received traffic as a straight line connecting the coordinates on the attack surface plane corresponding to the source address and the source port of the received traffic and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic. And displays the transmission traffic as a straight line connecting the coordinates on the target agency plane corresponding to the source address and the source port of the transmission traffic and the coordinates on the damaged ground plane corresponding to the destination address and the source port of the transmission traffic, Visualized and displayed.

Thereafter, the determination unit 300 determines various security events occurring in relation to the target organization from the display form of the received traffic and the transmission traffic displayed on the three-dimensional space (S600).

At this time, the determining unit 300 determines that one of the coordinates corresponding to the same source address and source port in each of the received traffic and the transmitted traffic, and the coordinates connecting the plurality of coordinates having the same destination port but different destination addresses If it is displayed, it is determined as a network scan event.

In addition, the determining unit 300 determines whether one of the coordinates corresponding to the same source address and the source port in the received traffic and the transmitted traffic and the coordinates of the coordinates corresponding to the destination port, If it is displayed, it is determined as a port scan event.

In addition, the determining unit 300 determines that a plurality of coordinates corresponding to the source port having the same starting address but different from each other in the receiving traffic and the transmission traffic, and the straight lines connecting one coordinate corresponding to the same destination address and destination port If it is displayed, it is discriminated as a disable event.

In addition, when the destination address and the destination port of the transmission traffic correspond to the predetermined specific target organization, that is, when the transmission traffic is the destination, If the target institution is the destination, it will be identified as a security event.

As described above, according to the operation method of the security event determination device according to the embodiment of the present invention, the received traffic received from the target network and the target network from the network traffic collected with respect to the target network, It is possible to visually identify and display the transmission traffic transmitted from the origin as a three-dimensional space, identify the security events from the form in which the received traffic and the transmission traffic are displayed on the three-dimensional space, It is possible to grasp accurately.

Meanwhile, the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, or may be embodied in a computer readable medium, in the form of a program instruction, which may be carried out through various computer means. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

According to the security event determination method and apparatus applied therefor of the present invention, it is possible to identify the reception traffic received from the network traffic collected in relation to the target organization with the target organization as a destination and the transmission traffic transmitted from the target organization as a departure Dimensional space, it is possible to effectively determine a security event from the reception traffic and the transmission traffic displayed on the three-dimensional space. Thus, in overcoming the limitations of the prior art, The present invention is not limited to the use of the present invention, but merely has a possibility of commercialization or operation of the applied device, and is practically usable since it is practically possible to carry out clearly.

100:
200:
300:

Claims (21)

An identification unit for identifying received traffic received from the target network as a destination from network traffic collected in association with the target organization and transmission traffic transmitted from the target organization as a departure;
A display unit for visualizing both the received traffic and the transmission traffic in a three-dimensional space and displaying the three-dimensional space; And
And a determination unit for determining a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic displayed on the three-dimensional space,
In the three-dimensional space,
An attack plane corresponding to a source of the received traffic, and a damaged ground plane corresponding to a destination of the transmission traffic. The method according to claim 1,
In the three-dimensional space,
The first rectangular hexahedron having the same shape and size and the second rectangular hexahedron having the same shape and size are arranged in a direction perpendicular to the X-axis Y-axis and the Z-axis forming the vertical plane with respect to the horizontal plane, Are adjacent to each other,
The display unit includes:
And displays both the received traffic and the transmitted traffic on the first rectangular hexahedron and the second rectangular hexahedron which are positioned so that the vertical surfaces of the three rectangular spaces are adjacent to each other. 3. The method of claim 2,
On the first right-angled hexahedron and the second right-angled hexahedron,
At least one of a target engine plane corresponding to the target organization, an attack horizon corresponding to a source of the received traffic, and a damage horizon corresponding to a destination of the transmission traffic,
The display unit includes:
A vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other is designated as the target engine plane and a vertical plane located on the opposite side of the vertical plane designated by the target engine plane in the first rectangular hexahedron is defined as Designating as the attack horizon plane a vertical plane located on the opposite side of the vertical plane designated to the target engine plane in the second rectangular hexahedron as the damaged horizon plane and visually displaying both the received traffic and the transmission traffic Wherein the security event determination device comprises: The method of claim 3,
When the target organ is two or more,
The display unit includes:
And displays the received traffic and the transmitted traffic for each of the divided right-angled cells in a visualized form. Event discriminator. The method according to claim 3 or 4,
Each of the reception traffic and the transmission traffic includes:
A source address (IP), a source port, a destination address, and a destination port,
The display unit includes:
The destination address and the source port of the received traffic are displayed as coordinates on the attack plan surface in the case of the source address and the source port of the received traffic, and in the case of the destination address and the destination port of the received traffic, And displays the visualized traffic information as coordinates on the damaged ground plane in the case of the destination address and the destination port of the transmission traffic. 6. The method of claim 5,
The display unit includes:
Axis in the attack plane, and displaying the Y axis on the attack plane as coordinates of a source address of the received traffic, displaying the Z axis on the attack plane as coordinates of a source port of the received traffic, Axis in the target engine plane as coordinates of the destination address of the received traffic or the source address of the transmitted traffic and displays the Y axis of the target engine plane in the destination port in the destination traffic or the source port of the transmission traffic And displaying the Y axis on the damaged ground plane as coordinates of a destination address of the transmission traffic and displaying the Z axis on the damaged ground plane as coordinates of a source port of the transmission traffic A security event determination Value. The method according to claim 6,
The display unit includes:
The received traffic is visualized as a straight line connecting the coordinates on the attack surface plane corresponding to the source address and the source port of the received traffic and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic And a transmission line as a straight line connecting coordinates on the target engine plane corresponding to a source address and a source port of the transmission traffic and coordinates on the damaged ground plane corresponding to a destination address and a source port of the transmission traffic, And displays the visualized traffic. 8. The method of claim 7,
The security event includes:
The destination address or the destination port of each of the reception traffic and the transmission traffic,
Wherein,
One line corresponding to the same source address and source port in each of the reception traffic and the transmission traffic and lines connecting the coordinates of the same number that is the same as the destination port but different from the destination address are displayed, Wherein the security event determination unit identifies, as the security event, a case where a line connecting one coordinate corresponding to a source address and a source port and a destination line having coordinates equal to or greater than a set number corresponding to different destination ports is displayed, Discrimination device. 8. The method of claim 7,
The security event includes:
And the source port of each of the reception traffic and the transmission traffic,
Wherein,
Wherein a line connecting the coordinates of the same number as the source port and the coordinates of the destination port that correspond to the source port and the destination port are displayed in the reception traffic and the transmission traffic, And determines the security event as a security event. 8. The method of claim 7,
The security event includes:
A destination address of the transmission traffic, and a destination port,
Wherein,
And judges, as the security event, a case where the destination address and the destination port of the transmission traffic correspond to a predetermined target entity in a state where the reception traffic does not exist. An identification step of identifying received traffic received from the target network as a destination from network traffic collected in relation to the target organization and transmission traffic transmitted from the target organization as a departure;
A display step of visually displaying both the received traffic and the transmission traffic in a three-dimensional space; And
And a determination step of determining a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic being displayed on the three-dimensional space,
In the three-dimensional space,
An attack plane corresponding to a source of the received traffic, and a damaged ground plane corresponding to a destination of the transmission traffic. 12. The method of claim 11,
In the three-dimensional space,
The first rectangular hexahedron having the same shape and size and the second rectangular hexahedron having the same shape and size are arranged in a direction perpendicular to the X-axis Y-axis and the Z-axis forming the vertical plane with respect to the horizontal plane, Are adjacent to each other,
In the displaying step,
And displays both the received traffic and the transmitted traffic on the first rectangular hexahedron and the second rectangular hexahedron which are positioned so that their vertical surfaces are adjacent to each other in the three-dimensional space. 13. The method of claim 12,
On the first right-angled hexahedron and the second right-angled hexahedron,
At least one of a target engine plane corresponding to the target organization, an attack horizon corresponding to a source of the received traffic, and a damage horizon corresponding to a destination of the transmission traffic,
In the displaying step,
A vertical plane in which the first rectangular hexahedron and the second rectangular hexahedron are adjacent to each other is designated as the target engine plane and a vertical plane located opposite the vertical plane designated by the target engine plane in the first rectangular hexahedron And designates a vertical plane located on the opposite side of a vertical plane designated by the target engine plane in the second rectangular hexahedron as the damaged horizontal plane to visualize both the received traffic and the transmitted traffic, The security event determination apparatus comprising: 14. The method of claim 13,
When the target organ is two or more,
In the displaying step,
And displays the received traffic and the transmitted traffic for each of the divided right-angled cells in a visualized form. And a method of operating the event discrimination device. The method according to claim 13 or 14,
Each of the reception traffic and the transmission traffic includes:
A source address (IP), a source port, a destination address, and a destination port,
In the displaying step,
The destination address and the source port of the received traffic are displayed as coordinates on the attack plan surface in the case of the source address and the source port of the received traffic, and in the case of the destination address and the destination port of the received traffic, And displays, in the case of the destination address and the destination port of the transmission traffic, as visual coordinates as coordinates on the damaged ground plane. 16. The method of claim 15,
In the displaying step,
Axis in the attack plane, and displaying the Y axis on the attack plane as coordinates of a source address of the received traffic, displaying the Z axis on the attack plane as coordinates of a source port of the received traffic, Axis in the target engine plane as coordinates of the destination address of the received traffic or the source address of the transmitted traffic and displays the Y axis of the target engine plane in the destination port in the destination traffic or the source port of the transmission traffic And displaying the Y axis on the damaged ground plane as coordinates of a destination address of the transmission traffic and displaying the Z axis on the damaged ground plane as coordinates of a source port of the transmission traffic A security event determination How to value work. 17. The method of claim 16,
In the displaying step,
The received traffic is visualized as a straight line connecting the coordinates on the attack surface plane corresponding to the source address and the source port of the received traffic and the coordinates on the target engine plane corresponding to the destination address and the source port of the received traffic And a transmission line as a straight line connecting coordinates on the target engine plane corresponding to a source address and a source port of the transmission traffic and coordinates on the damaged ground plane corresponding to a destination address and a source port of the transmission traffic, And displays the visualized traffic and displays the visualized traffic. 18. The method of claim 17,
The security event includes:
The destination address or the destination port of each of the reception traffic and the transmission traffic,
Wherein,
One line corresponding to the same source address and source port in each of the reception traffic and the transmission traffic and lines connecting the coordinates of the same number that is the same as the destination port but different from the destination address are displayed, Wherein the security event determination unit identifies, as the security event, a case where a line connecting one coordinate corresponding to a source address and a source port and a destination line having coordinates equal to or greater than a set number corresponding to different destination ports is displayed, And an operation method of the discriminating device. 18. The method of claim 17,
The security event includes:
And the source port of each of the reception traffic and the transmission traffic,
Wherein,
Wherein a line connecting the coordinates of the same number as the source port and the coordinates of the destination port that correspond to the source port and the destination port are displayed in the reception traffic and the transmission traffic, And determines that the security event is a security event. 18. The method of claim 17,
The security event includes:
A destination address of the transmission traffic, and a destination port,
Wherein,
And determines, as the security event, a case where the destination address and the destination port of the transmission traffic correspond to a predetermined target entity in a state where the reception traffic does not exist. An identification step of identifying received traffic received from the target network as a destination from network traffic collected in relation to the target organization and transmission traffic transmitted from the target organization as a departure;
A display step of visually displaying both the received traffic and the transmission traffic in a three-dimensional space; And
And a determination step of determining a security event occurring in relation to the target organization from at least one of the reception traffic and the transmission traffic being displayed on the three-dimensional space,
In the three-dimensional space,
An attack plane corresponding to a source of the received traffic, and a damaged ground plane corresponding to a destination of the transmission traffic.

Images