KR101913339B1 - Apparatus for visualizing network security state - Google Patents

Abstract

The network security situation visualization apparatus according to an embodiment of the present invention includes a security alarm event collection / extraction unit that extracts the security alarm event characteristics based on at least one of security alarm event information and network traffic information transmitted from the outside; And outputting a current security status to the display based on the security alarm event characteristic extracted by the security alarm event collecting / extracting unit, wherein the security alarm event characteristic includes attacker information, victim information, And the victim, the type of attack, and the number of attacks.

Description

[0001] APPARATUS FOR VISUALIZING NETWORK SECURITY STATE [0002]

The present invention relates to a network security situation visualization apparatus, and more particularly, to a network security situation visualization apparatus capable of efficiently recognizing a security situation of a network by using an important attribute value of a security alarm event.

The network security situation visualization technology using the conventional security alarm event is often performed by independently performing and displaying the TOP-N analysis of the property according to the frequency of each event (attack type, IP address, country) to be.

For example, when a security alert event occurs, an attacker and a victim are generated as point coordinates on a two-dimensional or three-dimensional map, and displayed as a connection line. Extracting a top IP address or countries having high occurrence frequency by attack type, To provide security situation information.

However, such a method can not interpret the unique meaning of the individual security alarm event because the connection lines overlap each other in a situation where a plurality of security alarm events occur, and it is impossible to analyze the inherent meaning of the individual security alarm event, It is impossible to grasp it.

In addition, the TOP-N analysis, which is performed independently according to the event attributes, requires additional query or analysis in order to investigate the relationship between attack and damage, such as secondary, tertiary and quaternary. do.

In addition, since it is difficult to express the extended relationship within the same screen, the screen is updated or an additional screen is generated and displayed.

Therefore, the user has to keep a memory of the previous situation of the extended association and to associate the extended relationships continuously, so that it is difficult to recognize the security situation.

 On the other hand, the following prior art document discloses a network security policy management system based on a web service security and a method thereof, which enable safe and efficient operation of network operations such as service utilization and resource use of network nodes in a network environment And does not disclose the technical gist of the present invention.

Korean Patent Publication No. 10-1067686

The network security situation visualization apparatus according to an embodiment of the present invention aims to solve the above-described problems by solving the following problems.

Using the important attribute values of security alarm events, the attack and damage situation can be collectively represented by attack / damage type, IP address, port number, attack frequency, continuity, It is to provide a network security situation visualization device to distinguish successive attacks and to easily recognize and extend the association between attack and damage, thereby effectively recognizing the security situation.

According to the present invention, even in a situation where a plurality of security alert events are generated at the same time, each security alert event maintains its own meaning and can display and recognize the time transition and continuity of the attack or damage in the same screen, A device that intuitively recognizes a security situation by allowing the user to continuously analyze / display information (attack-damage relationship) such as secondary, tertiary, and quaternary due to an attack continuously in the same screen without additional query or action The purpose of the method is to provide.

The solution to the problem of the present invention is not limited to those mentioned above, and other solutions not mentioned can be clearly understood by those skilled in the art from the following description.

The network security situation visualization apparatus according to an embodiment of the present invention includes a security alarm event collection / extraction unit that extracts the security alarm event characteristics based on at least one of security alarm event information and network traffic information transmitted from the outside; And outputting a current security status to the display based on the security alarm event characteristic extracted by the security alarm event collecting / extracting unit, wherein the security alarm event characteristic includes attacker information, victim information, And the victim, the type of attack, and the number of attacks.

The security alarm event collection / extraction unit may include a security alarm event collection / normalization module for collecting and normalizing the security alarm event information; And a security alert event feature extraction module extracting a main attribute from the normalized security alert event and extracting a security alarm event feature based on the main attribute, wherein the main attribute includes a protocol number, a destination IP address, Destination port number, destination IP address, and attack type.

The security situation analyzing / displaying unit may include an overall security situation analyzing / displaying module for displaying a security situation for the entire network based on the security alarm event characteristic on a two-dimensional plane coordinate system; An individual attack / damage analysis / display module for displaying an individual attack or damage situation of an attacker or victim displayed on the two-dimensional plane coordinate system on the two-dimensional plane coordinate system by the overall security situation analysis / display module; And an attack / damage relation analysis / display module that simultaneously displays all attackers and all victims displayed in the overall security situation analysis / display module in a three-dimensional coordinate system, and displays a connection relationship between the entire attacker and all victims .

The overall security situation analysis / display module 210 outputs all attackers or victims on the network according to a time transition on a first screen implemented in a two-dimensional manner on the display, And a display source indicating the attack or defense event.

A line extending in a vertical direction from the center of the time reference circle is defined as a reference line, and an angle between the reference line and the first line segment between the center and the display circle is defined as an initial occurrence time of an attack or defense event And the distance between the center and the display source is defined as a final occurrence time up to the current point of the attack or defense event of the corresponding indicator.

The individual attack / damage analysis / display module outputs an attack or defense event to any one of a plurality of attackers or victims displayed on the first screen on a second screen implemented in a two-dimensional manner, The second screen may include a plurality of time reference sources having the same center and different radii, and a display source indicating the attack or defense event, wherein an individual attacker or individual victim is displayed at the center.

The attack / damage relationship analysis / display module may include a plurality of attackers, a plurality of victims, and a plurality of attackers based on the analysis result of at least one of the overall security situation analysis / display module and the individual attack / damage analysis / It is preferable to output the connection relationship between the plurality of attackers and the victim on the third screen which is implemented in the third screen.

In the case of selecting one of the plurality of attackers and the plurality of victims, a connection line between the selected attacker or an associated victim or an associated attacker associated with the victim is displayed on the third screen.

Preferably, the screens output by the overall security situation analysis / display module, the individual attack / damage analysis / display module, and the attack / damage relationship analysis / display module are displayed on one screen.

The network security situation visualization apparatus according to an embodiment of the present invention can intuitively analyze / display the security status of the network using only the security alarm event attribute value to quickly recognize the status information, It is possible to display and recognize the time transition and the continuity of the attack or damage by displaying the unique meaning of each security alarm event.

In addition, by analyzing / displaying the damage information and related information such as secondary, tertiary, and quaternary attacks according to individual attacks continuously in the same screen without additional query or action, the user can quickly recognize and cope with the security situation There is an effect that can be.

The effects of the present invention are not limited to those mentioned above, and other effects not mentioned may be clearly understood by those skilled in the art from the following description.

1 is a block diagram briefly illustrating an apparatus for visualizing a network security situation according to an embodiment of the present invention.
2 is a view for explaining a basic output screen of the security situation analysis / display unit of the network security situation visualization apparatus according to an embodiment of the present invention.
FIG. 3 and FIG. 4 are examples of various screens displayed by the overall security situation analysis / display module in the network security situation visualization apparatus according to the embodiment of the present invention.
FIG. 5 and FIG. 6 are various examples of screens displayed by the individual attack / damage analysis / display module in the network security situation visualization apparatus according to an embodiment of the present invention.
7 is an example of a screen displayed by the attack / damage relation analysis / display module in the network security situation visualization apparatus according to an embodiment of the present invention.
FIG. 8 and FIG. 9 are various examples of displaying a screen output from each sub-configuration of the situation analysis / display unit on a single display in the network security situation visualization apparatus according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. It is to be noted that the accompanying drawings are only for the purpose of facilitating understanding of the present invention, and should not be construed as limiting the scope of the present invention with reference to the accompanying drawings.

First, a network security situation visualization apparatus according to an embodiment of the present invention will be described with reference to FIG.

1 is a block diagram briefly illustrating an apparatus for visualizing a network security situation according to an embodiment of the present invention.

The network security situation visualization apparatus according to an embodiment of the present invention includes a security alarm event collecting / extracting unit 100 and a security situation analyzing / displaying unit 200 as shown in FIG.

The security alarm event collecting / extracting unit 100 extracts a security alarm event characteristic based on at least one of security alarm event information and network traffic information transmitted from the outside.

The security alarm event collecting / extracting unit 100 is specifically configured with a security alarm event collection / normalization module 110 and a security alarm event characteristic extraction module 120.

The security alarm event collecting / extracting unit 100 collects the security alarm event information and normalizes it after collecting the security alarm event information. The information of the security alarm event may be transmitted to an external From the security alert generator 310 or from the external security alert event log file 320 or from the security alert event storage 330. [

The security alarm event characteristic extraction module 120 extracts main attributes from the normalized security alarm events in the security alarm event collection / normalization module 110 and extracts the security alarm event characteristics based on the extracted main attributes do.

Here, the main attributes are attributes including at least one of a protocol number, a destination IP address, a destination port number, a destination IP address, and an attack type. In addition, the security alert event characteristic includes an attacker information, victim information, Year relationship, type of attack, and number of attacks.

The security situation analysis / display unit 200 outputs the current security status to the display based on the security alarm event characteristic extracted by the security alarm event collecting / extracting unit 100.

The security situation analysis / display unit 200 is divided into an overall security situation analysis / display module 210, an individual attack / damage analysis / display module 220 and an attack / damage relation analysis / display module 230 The specific contents of each of the analysis / display modules 210, 220 and 230 will be described in more detail with reference to FIG. 2 to FIG. 7. FIG.

FIG. 2 is a view for explaining a basic output screen of the security situation analysis / display unit of the network security situation visualization apparatus according to an embodiment of the present invention. FIG. 3 and FIG. FIG. 5 and FIG. 6 show an individual attack / damage analysis / display module in the network security situation visualization apparatus according to an embodiment of the present invention. FIG. FIG. 7 is an example of a screen displayed by the attack / damage relation analysis / display module in the network security situation visualization apparatus according to an embodiment of the present invention, and FIGS. 8 and 9 In the network security situation visualization apparatus according to an embodiment of the present invention, the screen output from each sub configuration of the situation analysis / display unit is displayed on one display It is different embodiments.

First, the security situation analysis / display unit 200 displays a basic output screen based on the overall security situation analysis / display module 210. The overall security situation analysis / display module 210 analyzes the entire security situation event / Is displayed on a two-dimensional plane coordinate system.

The overall security situation analysis / display module 210 outputs the entire attacker or the victim on the network according to the time trend or the IP address on the first screen implemented two-dimensionally on the display.

This first screen shows a plurality of time reference sources 41, 42, 43, 44 having the same center c and different radii as shown in Fig. 2, and also an indicator 31, 32, 33, 34, 35).

A line extending in the vertical direction from the center c of the time reference circles 41, 42, 43 and 44 is defined as a reference line 10 and a line extending between the center c and any of the display circles 31 The angle [theta] between the reference lines 10 can be defined as the initial occurrence time or IP address of the attack or defense event of the display source 31, specifically, the IP address divided by 2 ^ 32.

The length r between the center c and any of the display sources 31 may be defined as a final time value at which an attack or defense event by the corresponding display source 31 occurs.

In addition, the display sources 31, 32, 33, 34 and 35 represent attack events and can be displayed in a three-dimensional sphere shape. The attack type and the port number are represented by three-dimensional circles 32, . ≪ / RTI >

Here, the area of the display circle is determined according to the number of attack / damage accumulation frequencies, and the surface can be displayed with the flag of the corresponding country through the conversion of the location (area) information to the IP address.

The attack type or the port number can be allocated in the display circle according to the color set in advance and can be positioned on the generation connection time axis according to the occurrence time. For example, the display type can be set to one of the display sources 32, 33, 34, 35) may be located on the connecting link between the first time and the last time the attack or damage occurred.

Specifically, it is possible to identify the current attack or damage mode by referring to the display resources disposed on the connection line. Specifically, in case of the display source 32, it is possible to grasp the first occurrence time of the event. It is possible to confirm that a temporary event has occurred, and in the case of the display source of reference numeral 34, it can be confirmed that there is an event that occurred continuously (d) during a predetermined time interval, or in the case of a continuous event, It can be displayed in the form of a cylinder 34 as shown in FIG.

An actual implementation example of the first screen in which the attack status according to the time transition is displayed by the overall security situation analysis / display module 210 is shown in FIGS. 3 and 4. FIG.

FIG. 3 is a screen for analyzing / displaying the security status of the entire network due to an attack by collecting security alarm events occurring during one day, and monitoring an attack situation according to a time transition through four time reference sources per day (24 hours) can do.

Specifically, on the screen of FIG. 3, there are a first attack (①), a continuous attack (②), an attack of a different attack type (④), an attack by an unassigned IP address (⑤) , And one-time attack (⑦) are easily visualized, and the security situation can be easily recognized by filtering (⑧) and analyzing / displaying corresponding attacks according to each property.

4 is a screen for analyzing / displaying the security status of the entire network by IP address bands using the same security alert event, and IP addresses in the same sub-network have a similar θ value. Therefore, If you get hurt, you will be able to quickly recognize the situation.

In addition, the security situation analysis / display unit 200 in the network security situation visualization apparatus according to an embodiment of the present invention includes an individual attack / damage analysis / display module 220 in addition to the overall security situation analysis / display module 210, Respectively.

The individual attack / damage analysis / display module 220 analyzes the individual attack or damage situation of the attacker or the victim displayed on the two-dimensional plane coordinate system by the overall security situation analysis / display module 210 on the two-dimensional plane coordinate system Display.

In other words, the individual attack / damage analysis / display module 220 described above can detect an attack or defense event for any one of a plurality of attackers or victims displayed on the first screen, Wherein the second screen includes a plurality of time reference sources having the same center and different radii as the first screen and a display source indicating the attack or defense event, The victim is displayed.

The screen displayed by the individual attack / damage analysis / display module 220 will be described in more detail with reference to FIGS. 5 and 6. FIG.

As shown in FIG. 5, the screen displayed by the individual attack / damage analysis / display module 220 is represented by an individual circular attack / damage situation graph.

The attack or damage point coordinates shown in FIG. 3 or FIG. 4 described above become the center circle node in FIG. 5, and the attack or damage performed by the node is represented by the connection relationship with the center circle.

Here, the border (2) of the outline circle is allocated with a preset country color and displayed in a form of a spiral (①) centered on the center of the screen according to the attack frequency, the country, the IP address, and the sorting criterion (3) It can be energized and grouped by each criterion so that the security situation can be recognized more quickly.

For example, FIG. 6 shows an analysis / display of the association between attack and damage when the individual attacker 9, which is an attacker in FIG. 3, is selected as the screen displayed by the overall security situation analysis / display module 210.

The node is analyzed / displayed as 5 times attack (①) and 1 attack (②), and each damaged node (③) has attack type, attack time zone and attack continuity And can easily grasp the relationship with other attackers (④, ⑤).

Meanwhile, the security situation analysis / display unit 200 in the network security situation visualization apparatus according to an embodiment of the present invention may include an attack / damage relation analysis / display module 230.

The attack / damage relation analysis / display module 230 simultaneously displays the entire attacker and the entire victim displayed in the above-described entire security situation analysis / display module in the three-dimensional coordinate system, and displays the connection relationship between the entire attacker and all victims Function.

Specifically, as shown in FIG. 7, the screen output by the attack / damage relation analysis / display module 230 simultaneously analyzes / displays attacker nodes (1) and victim nodes (2) in a three-dimensional coordinate system (③) between attack and damage can be grasped on a single screen.

In particular, if an individual attacker (4) is selected, the victim associated with the attacker is preferably selected and displayed as a connection line.

In addition, the attacker (⑤), the attacker (⑥) and attack type and continuity can be grasped.

In addition, the network security situation visualization apparatus according to an embodiment of the present invention includes the overall security situation analysis / display module 210, the individual attack / damage analysis / display module 220, and the attack / The damage correlation analysis / display module 230 may display a screen to be displayed on one screen.

In particular, it is possible to recognize the security situation quickly. In particular, it is possible to select only a specific time interval, thereby enabling detailed analysis and display of security alarm events within the time interval, And may include a function of linking and analyzing / displaying the damaged node and the geographical information.

The embodiments and the accompanying drawings described in the present specification are merely illustrative of some of the technical ideas included in the present invention. Therefore, it is to be understood that the embodiments disclosed herein are not intended to limit the scope of the present invention but to limit the scope of the present invention. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims and their equivalents. It should be interpreted.

100: security alarm event collecting / extracting unit
110: Security alarm event collection / normalization module
120: Event characteristic extraction module
200: Security situation analysis / display
210: Overall security situation analysis / display module
220: Individual Attack / Damage Analysis / Display Module
230: Attack / Damage Correlation Analysis / Display Module
310: Security alarm generator
320: Security alarm event log file
330: Security alert event storage

Claims (9)

A security alarm event collecting / extracting unit for extracting security event characteristics based on security alarm event information and network traffic information received from the outside;
A security situation analysis / display unit for outputting a current security situation on a display based on the security event characteristic extracted by the security alarm event collection / extraction unit;
Lt; / RTI >
Wherein the security event characteristic includes at least one of attacker information, victim information, an association between an attacker and a victim, a type of an attack, and a number of attacks,
Wherein the security situation analysis / display unit comprises: a total security situation analysis / display module for displaying a security situation for the entire network on a two-dimensional plane coordinate system based on the security event characteristic; And an individual attack / damage analysis / display module for displaying, on the two-dimensional plane coordinate system, the individual attack or damage situation of the attacker or the victim displayed on the two-dimensional plane coordinate system by the overall security situation analysis / display module,
The overall security situation analysis / display module outputs all attackers or victims on the network according to a time transition or an IP address on a first screen implemented two-dimensionally on the display,
Wherein the first screen includes a plurality of time reference sources having the same center and different radii and at least one display source representing the attack or defense event, Network security situation visualization device placed between circles.
The security alarm system according to claim 1, wherein the security alarm event collecting /
A security alarm event collection / normalization module for collecting and normalizing the security alarm event information; And
A security alarm event feature extraction module for extracting a main attribute from the normalized security alarm event and extracting a security event feature based on the main attribute;
/ RTI >
Wherein the main attributes include at least one of a protocol number, a destination IP address, a destination port number, a destination IP address, and an attack type.
The security analyzer according to claim 1, wherein the security situation analyzing /
An attack / damage relation analysis / display module that simultaneously displays all attackers and all victims displayed in the overall security situation analysis / display module in a three-dimensional coordinate system, and displays a connection relationship between the entire attacker and all victims;
The network security context visualization device further comprising:
delete The method according to claim 1,
A line extending in the vertical direction from the center of the time reference circle is defined as a reference line,
The angle between the reference line and the first line segment between the center and the display circle is defined as an initial occurrence time of an attack or defense event of the display source or an IP address of the display source,
Wherein the distance between the center and the display circle is defined as the last occurrence time to the present point of attack or defense event of the indicator.
The method according to claim 1,
The individual attack / damage analysis / display module outputs an attack or defense event to an individual attacker or victim of a plurality of attackers or victims output on the first screen on a second screen implemented in two dimensions,
Wherein the second screen includes a plurality of time reference sources having the same center and different radii, and a display source indicating the attack or defense event, wherein individual attackers or individual victims are displayed at the center.
The method of claim 3,
The attack / damage relationship analysis / display module may include a plurality of attackers, a plurality of victims, and a plurality of attackers based on the analysis result of at least one of the overall security situation analysis / display module and the individual attack / damage analysis / A network security situation visualization apparatus for outputting a connection relationship between a plurality of attackers and a victim on a third screen implemented in a three-dimensional manner.
8. The method of claim 7,
Wherein when a plurality of attackers and a plurality of victims are selected, a connection line between the selected attacker or an associated victim or an associated attacker associated with the victim is displayed on the third screen.
The method of claim 3,
Wherein the screens output by the overall security situation analysis / display module, the individual attack / damage analysis / display module, and the attack / damage relationship analysis / display module are displayed on one screen.

Images