KR102088308B1 - Cloud security analysing apparatus, apparatus and method for management of security policy based on nsfv - Google Patents

Abstract

An apparatus and method for cloud security analysis and security policy management based on network security function virtualization are disclosed. The security policy management apparatus based on network security function virtualization according to the present invention includes an analysis request receiving unit that receives an analysis request message including security data from a cloud security analysis unit, an analysis unit including at least one of a tenant unit and a user unit. Poorly, a correlation analysis unit for performing a correlation analysis of the security data, a security policy setting unit for setting at least one of a security control command and a security policy based on a result of performing the correlation analysis, and the set security control command and And a security policy transmission unit transmitting at least one of the security policies to the cloud security analysis device.

Description

Cloud security analysis device based on network security function, security policy management device and security policy management method {CLOUD SECURITY ANALYSING APPARATUS, APPARATUS AND METHOD FOR MANAGEMENT OF SECURITY POLICY BASED ON NSFV}

The present invention relates to a technology for managing security information based on network security function virtualization in a cloud environment, in particular, a technology for collecting, analyzing and managing security information based on network security function virtualization (NSFV) for each tenant unit and user unit. will be.

The existing computing environment, which relied on the independent hardware performance of each user terminal according to the development of computer networks, is in the form of cloud computing that provides the corresponding service at the request of the user terminal by utilizing all computing resources on the network. Is evolving. Recently, a network security function virtualization (NSFV) technology using a software-defined network (SDN) technology has been developed to efficiently configure and utilize the network.

Previously, the hardware and software of network security devices were located in one place, so the software was dependent on the hardware. In this structure, in order to apply the new software to the network security equipment, there was a disadvantage in that hardware must also be built. However, applying the network security function virtualization (NSFV) technology can separate hardware and software to solve the above disadvantages. That is, when applying the new software to the network security equipment, there is no need to construct a new hardware equipment separately, thereby reducing the investment cost and operation cost for the network security equipment.

Network security function virtualization (NSFV) refers to a technology that separates hardware and software components of network security equipment and virtualizes and provides network security functions on a general-purpose service virtualization basis. That is, it is a method of virtualizing the functions of a physical network security device and executing it on hardware equipped with a virtual machine server or a general-purpose processor. Network Security Function Virtualization technology can control various network security devices through high-performance servers, storage and virtualization switches to reduce operating costs of network security devices, increase efficiency, and respond quickly to security service response and harmful traffic detection.

Specifically, applying the network security function virtualization technology has the advantage of not having to install new equipment, thereby increasing efficiency, and also reducing investment and maintenance costs of new security equipment. In addition, the network security function virtualization technology is able to launch new security services and applications more quickly due to the structural characteristics made possible to run on a software basis, so that it can properly reflect the rapidly changing market conditions.

However, in this cloud computing environment, the security problem that can protect assets from external threats such as hacking attacks has emerged as the most important issue, but the existing security control system is only fragmented by relying only on fixed security equipment of the service provider. The security events that occurred are collected and managed.

In particular, since the prior art is focused only on the collection and analysis of security events based on physical security equipment such as a specific server, the network security function used by users and tenants is virtually changed in the cloud computing environment in which security information based on virtualization changes frequently. It was unable to effectively respond to changing security threats.

Therefore, there is a need to develop a security information management technology based on virtualization of network security functions that can manage dynamically changing security threats in a cloud computing environment.

Korean Registered Patent No. 10-1535502, Announced on July 09, 2015 (Name: Security embedded virtual network control system and method)

An object of the present invention is to collect, analyze, and manage security information in a virtualized network security system based on network security function virtualization, so that the virtualization security status, resource changes, attack relevance, and virtual network traffic status can be identified.

In addition, the object of the present invention is to analyze the association between the internal / external connection and internal connection information of the virtualization network and the attack detection information and the abnormal traffic information, making it difficult to detect at the security equipment level based on a single network security function virtualization It is to detect and block attacks or harmful traffic early so that they can respond.

In addition, the object of the present invention is to manage the security threats that change dynamically in the cloud computing environment by enabling the collection, analysis, and management of security information based on the network security function virtualization for each tenant unit and user unit under the cloud computing environment. It is to be.

The security policy management device based on the network security function virtualization according to the present invention for achieving the above object comprises at least one of an analysis request receiving unit, a tenant unit, and a user unit receiving an analysis request message including security data from a cloud security analysis device. For each analysis unit including one, an association analysis unit for performing an associative analysis of the security data, a security policy setting unit for setting at least one of a security control command and a security policy, based on a result of performing the associative analysis, and And a security policy transmission unit transmitting at least one of the set security control command and the security policy to the cloud security analysis device.

In this case, the analysis request message may include at least one of user information, tenant information, and the security data.

In this case, the security unit information corresponding to the analysis target including at least one of the user and the tenant is requested, and an interface unit for providing an analysis result of the security situation corresponding to the analysis target may be further included.

In this case, the security data may include at least one of a security event, a flow event, a network packet stream, a service log, and a security system log based on network security function virtualization.

At this time, the association analysis unit may analyze the association of the security data through data mining analysis.

At this time, the security policy setting unit may set at least one of the security control command and the security policy to correspond to a security threat detected through data modeling analysis.

At this time, the security policy setting unit may set at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

At this time, the security policy management device based on the network security function virtualization may be operated on a virtual machine through a hypervisor.

In addition, the network security function virtualization-based cloud security analysis device according to an embodiment of the present invention, a network data collection unit for collecting network data corresponding to the cloud computing environment from the security system based on the network security function virtualization, collected The analysis analyzes the network data for each analysis unit including at least one of tenant units and user units, detects abnormal behavior, and analyzes the security situation to analyze the security situation, and transmits an analysis request message to the security policy management device It may include a requesting unit, a security policy receiving unit receiving a security control command and a security policy from the security policy management device, and a security policy transmitting unit transmitting the received security control command and security policy to the security system.

In this case, the analysis request unit may transmit the analysis request message including at least one of user information, tenant information, and the security data.

In this case, the network data may include at least one of a security event, a flow event, a network packet stream, a service log, and a security system log based on network security function virtualization.

At this time, the security situation analysis unit may process the network data based on the big data platform to detect the abnormal behavior and analyze the security situation.

In this case, the security control command and the security policy may include at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

In addition, the security policy management method performed by the network security function virtualization-based security policy management device according to an embodiment of the present invention includes receiving an analysis request message including security data from a cloud security analysis device, a tenant unit, and For each analysis unit including at least one of the user units, performing an association analysis of the security data, setting at least one of a security control command and a security policy based on a result of performing the association analysis, and And transmitting at least one of the set security control command and the security policy to the cloud security analysis device.

In this case, the analysis request message may include at least one of user information, tenant information, and the security data.

At this time, the step of receiving security context information corresponding to the analysis target including at least one of the user and the tenant, and may further include the step of providing an analysis result of the security situation corresponding to the analysis target.

In this case, the security data may include at least one of a security event, a flow event, a network packet stream, a service log, and a security system log based on network security function virtualization.

At this time, in the step of performing the association analysis of the security data, the association of the security data may be analyzed through data mining analysis.

At this time, the step of setting at least one of the security control command and the security policy may set at least one of the security control command and the security policy to correspond to a security threat detected through data modeling analysis.

At this time, the step of setting at least one of the security control command and the security policy may set at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

According to the present invention, by collecting, analyzing, and managing security information in a virtualized network security system based on network security function virtualization, it is possible to grasp the virtualization security status, resource change, attack association, and virtual network traffic status.

In addition, according to the present invention, it is difficult to detect at the level of a security equipment level based on a single network security function virtualization by analyzing the association between the internal / external connection of the virtualized network and the connection information between the internal and attack detection information and abnormal traffic information. However, it can respond by detecting and blocking harmful traffic early.

In addition, according to the present invention, the network security function virtualization-based security information can be collected, analyzed, and managed for each tenant unit and user unit under a cloud computing environment to manage dynamically changing security threats in the cloud computing environment. .

1 is a diagram illustrating a security information management system based on virtualization of a network security function according to an embodiment of the present invention.
2 is a block diagram showing the configuration of a cloud security analysis device based on network security function virtualization according to an embodiment of the present invention.
3 is a block diagram showing the configuration of a security policy management device based on network security function virtualization according to an embodiment of the present invention.
4 is a flowchart illustrating a cloud security analysis method according to an embodiment of the present invention.
5 is a flowchart illustrating a security policy management method according to an embodiment of the present invention.
6 is an exemplary view showing an example of a security information management system based on virtualization of a network security function according to an embodiment of the present invention.
7 is an exemplary view showing an example of a security policy management apparatus according to an embodiment of the present invention.
8 is a block diagram showing a computer system according to an embodiment of the present invention.

As the inventive concept allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description.

However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

The terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts or combinations thereof described herein, one or more other features. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the present invention pertains. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings, it will be described in detail a preferred embodiment of the present invention. In order to facilitate the overall understanding in describing the present invention, the same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

1 is a diagram illustrating a security information management system based on virtualization of a network security function according to an embodiment of the present invention.

As shown in FIG. 1, the network security function virtualization-based security information management system includes a network security function virtualization (NSFV) -based cloud security analysis device 100 and a network security function virtualization (NSFV) -based security policy management device ( 200).

First, the network security function virtualization (NSFV) based cloud security analysis device 100 may mean a security analysis tool capable of processing and analyzing large data based on a big data processing platform.

The network security function virtualization (NSFV) -based cloud security analysis apparatus 100 collects network data corresponding to a cloud computing environment from a network security function virtualization (NSFV) -based security system.

In addition, the network security function virtualization (NSFV) -based cloud security analysis device 100 analyzes the collected network data for each analysis unit including at least one of tenant units and user units to detect anomalies and detect security conditions. Analyze.

In addition, the network security function virtualization (NSFV) -based cloud security analysis device 100 transmits an analysis request message to the network security function virtualization (NSFV) -based security policy management device 200, and the network security function virtualization (NSFV) At least one of a security control command and a security policy is received from the based security policy management device 200. In addition, the network security function virtualization (NSFV) -based security policy management device 200 may transmit security control commands and security policies to the security system.

Next, the network security function virtualization (NSFV) -based security policy management device 200 receives an analysis request message including security data from the network security function virtualization (NSFV) -based cloud security analysis device 100.

In addition, the network security function virtualization (NSFV) -based security policy management apparatus 200 analyzes the association of security data for each analysis unit including at least one of a tenant unit and a user unit.

Based on the result of the association analysis, the network security function virtualization (NSFV) -based security policy management device 200 sets at least one of the security control command and the security policy, and at least one of the set security control command and the security policy One may be transmitted to the network security function virtualization (NSFV) based cloud security analysis device 100.

Hereinafter, a configuration of a network security function virtualization (NSFV) -based cloud security analysis device and a security policy management device according to an embodiment of the present invention will be described in more detail with reference to FIGS. 2 and 3.

2 is a block diagram showing the configuration of a cloud security analysis device based on network security function virtualization according to an embodiment of the present invention.

As shown in FIG. 2, the network security function virtualization (NSFV) -based cloud security analysis device 100 includes a network data collection unit 110, a security situation analysis unit 120, an analysis request unit 130, and a security policy It may include a receiving unit 140 and the security policy distribution unit 150.

First, the network data collection unit 110 collects network data corresponding to a cloud computing environment from a security system based on a network security function virtualization. Here, the network data may include at least one of a security event, a flow event, a network packet stream, a service log, and a network security function virtualization-based security system log (vAgent log).

In addition, the security situation analysis unit 120 analyzes the collected network data for each analysis unit including at least one of tenant units and user units to detect abnormal behaviors and analyzes the security situation.

At this time, the security situation analysis unit 120 may process and analyze a large amount of network data based on the big data platform. In particular, the security situation analysis unit 120 may process network data based on the big data platform to detect anomalies and analyze the security situation.

Next, the analysis request unit 130 transmits an analysis request message to the network security function virtualization (NSFV) -based security policy management device 200. In this case, the analysis request unit 130 may transmit an analysis request message including at least one of user information, tenant information, and security data to the network security function virtualization (NSFV) -based security policy management device 200.

Here, the security data may include at least one of a security event, a flow event, a network packet stream, a service log, and a security system log based on network security function virtualization.

In addition, the security policy receiving unit 140 may receive at least one of a security control command and a security policy from the network security function virtualization (NSFV) -based security policy management device 200.

Here, the security control command and the security policy may include at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

Finally, the security policy distribution unit 150 transmits the received security control command and security policy to a security system based on network security function virtualization (NSFV) to distribute the security policy.

As described above, the network security function virtualization (NSFV) -based cloud security analysis device 100 performs integrated security control for the entire cloud infrastructure to virtualize each network security function for security control commands and security policies for responding to intrusions. (NSFV) based network security system.

3 is a block diagram showing the configuration of a security policy management device based on network security function virtualization according to an embodiment of the present invention.

As shown in FIG. 3, the network security function virtualization (NSFV) -based security policy management device 200 includes an analysis request receiving unit 210, a relevance analysis unit 220, a security policy setting unit 230, and a security policy transmission It includes a unit 240 and the interface unit 250.

First, the analysis request receiving unit 210 receives an analysis request message including security data from the network security function virtualization (NSFV) -based cloud security analysis device 100.

The received analysis request message may include at least one of user information, tenant information, and security data, and the security data includes security event, flow event, network packet stream, service log, and security system log based on virtualization of network security function It may include at least one.

In addition, the association analysis unit 220 performs association analysis of security data for each analysis unit including at least one of a tenant unit and a user unit. At this time, the association analysis unit 220 may analyze the association of security data through data mining analysis.

The association analysis unit 220 provides a data mining function to analyze and detect abnormal behavior through correlation / correlation analysis of security data, and processes and processes security data based on a data mining analysis model. In addition, the association analysis unit 220 provides a standard threat analysis model, so that the user can selectively apply it.

Next, the security policy setting unit 230 may set at least one of a security control command and a security policy based on a result of performing the association analysis. The security policy setting unit 230 may detect a security threat through data modeling analysis and set at least one of a security control command and a security policy to correspond to the security threat.

At this time, the security policy setting unit 230 may set a security control command and a security policy including at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

And the security policy transmission unit 240 transmits at least one of the set security control command and security policy to the network security function virtualization (NSFV) based cloud security analysis device 100.

Finally, the interface unit 250 may be requested for security situation information corresponding to an analysis target including at least one of a user and a tenant. In addition, the interface unit 250 may provide an analysis result of a security situation corresponding to the analysis target.

Hereinafter, a cloud security analysis method and a security policy management method based on network security function virtualization (NSFV) according to an embodiment of the present invention will be described in more detail with reference to FIGS. 4 and 5.

4 is a flowchart illustrating a cloud security analysis method according to an embodiment of the present invention.

First, the network security function virtualization (NSFV) -based cloud security analysis device 100 collects network data corresponding to the cloud computing environment (S410).

The network security function virtualization (NSFV) -based cloud security analysis device 100 collects network data corresponding to the cloud computing environment from the network security function virtualization-based security system. In this case, the network data may include at least one of a security event, a flow event, a network packet stream, a service log, and a network security function virtualization-based security system log (vAgent log).

Then, the network security function virtualization (NSFV) -based cloud security analysis device 100 detects abnormal behavior and analyzes the security situation (S420).

The network security function virtualization (NSFV) -based cloud security analysis device 100 analyzes the collected network data for each analysis unit including at least one of tenant units and user units to detect anomalies and analyze security conditions. can do.

In particular, the network security function virtualization (NSFV) -based cloud security analysis device 100 may process network data based on a big data platform to detect anomalies and analyze security conditions.

In addition, the network security function virtualization (NSFV) based cloud security analysis device 100 may analyze network data in real time to analyze the security situation.

Next, the network security function virtualization (NSFV) -based cloud security analysis device 100 generates an analysis request message and transmits it to the network security function virtualization (NSFV) -based security policy management device 200 (S430).

The network security function virtualization (NSFV) -based cloud security analysis device 100 generates an analysis request message including at least one of user information, tenant information, and security data, and the network security function virtualization (NSFV) -based security policy It can be transmitted to the management device 200.

Here, the security data may mean network data collected in step S410 or data obtained by processing network data. In addition, the security data may include at least one of a security event, a flow event, a network packet stream, a service log, and a security system log based on network security function virtualization.

Finally, the network security function virtualization (NSFV) -based cloud security analysis device 100 receives security control commands and security policies from the network security function virtualization (NSFV) -based security policy management device 200, and receives the security The control command and security policy are distributed as a security system based on network security function virtualization (S440).

The security control command and the security policy may include at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set, and a cloud based on network security function virtualization (NSFV) The security analysis device 100 may distribute the received security control command and security policy to a security system based on network security function virtualization.

5 is a flowchart illustrating a security policy management method according to an embodiment of the present invention.

First, the network security function virtualization (NSFV) -based security policy management device 200 receives an analysis request message from the network security function virtualization (NSFV) -based cloud security analysis device 100 (S510).

In this case, the received analysis request message may include at least one of user information, tenant information, and security data, and the security data is security event, flow event, network packet stream, service log, network security function virtualization-based security It may include at least one of the system log.

For convenience of description, it has been described that the network security function virtualization (NSFV) -based security policy management device 200 receives an analysis request message directly from the network security function virtualization (NSFV) -based cloud security analysis device 100. Rather, the network security function virtualization (NSFV) -based security policy management device 200 may communicate with the network security function virtualization (NSFV) -based cloud security analysis device 100 through a virtualization agent.

Then, the network security function virtualization (NSFV) -based security policy management apparatus 200 performs association analysis of security data (S520).

The network security function virtualization (NSFV) -based security policy management apparatus 200 may perform association analysis of security data for each analysis unit through data mining analysis. In this case, the analysis unit may include at least one of a tenant unit and a user unit.

That is, the network security function virtualization (NSFV) -based security policy management apparatus 200 may process and process security data based on a data mining analysis model to analyze association of security data.

Next, the network security function virtualization (NSFV) -based security policy management apparatus 200 sets security control commands and security policies based on the analysis result (S530).

The network security function virtualization (NSFV) -based security policy management apparatus 200 sets at least one of a security control command and a security policy based on a result of performing an association analysis. At this time, the network security function virtualization (NSFV) -based security policy management apparatus 200 may detect a security threat through data modeling analysis and set at least one of security control commands and security policies to correspond to the security threat. .

The network security function virtualization (NSFV) -based security policy management device 200 includes a security control command including at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set, and The security policy may be set, and the types of security control commands and security policies are not limited thereto.

Finally, the network security function virtualization (NSFV) -based security policy management device 200 transmits a security control command and security policy set to the network security function virtualization (NSFV) -based cloud security analysis device 100 (S540). .

Hereinafter, an example of a network security function virtualization (NSFV) based security information management system according to an embodiment of the present invention will be described in more detail with reference to FIGS. 6 and 7.

6 is an exemplary view showing an example of a security information management system based on virtualization of a network security function according to an embodiment of the present invention.

In FIG. 6, security information may mean network data, security data, security control commands, and security policies, and the network security function virtualization-based security information management system may collect, analyze, and manage the security information.

6, the NSFV-based cloud security analysis device 600 collects network data from the NSFV-based security system 500.

The NSFV-based security system 500 may refer to a system including at least one of a hypervisor-based virtualization network attack detection and response system (vIPS, vFW, vIDS) and a network traffic collection system (vNetMon).

In addition, the NSFV-based security system 500 transmits network data to the NSFV-based cloud security analysis device 600, a network data transmission function, and an NSFV-based cloud security analysis device 600 for security control commands and security policies. It can perform functions such as receiving and executing.

In addition, the NSFV-based cloud security analysis device 600 may mean a cloud security operations center (Cloud SOC) that performs integrated security control for the entire cloud infrastructure.

In addition, the NSFV-based cloud security analysis device 600 is NSFV-based security system 500 from the network data collection function, network data normalization processing function, big data processing and storage function, anomaly detection using network data and The security situation analysis function, an interworking function with the NSFV-based security policy management device 720, a security control command, and a security policy distribution function may be performed.

In particular, the NSFV-based cloud security analysis device 600 is an NSFV-based security system 500 from a service log (Service Log), security event (Security Event), system log (Syslog), application event (App Event), Network data including at least one of a vAgent event, an end-point security event, a network packet stream, and a flow event may be collected.

In addition, the NSFV-based cloud security analysis device 600 may transmit the collected network data or security data processing network data to the NSFV-based security policy management device 720.

At this time, the NSFV-based cloud security analysis device 600 may communicate with the NSFV-based security policy management device 720 through the virtualization agent 710 provided in the virtualization system 700.

The virtualization system 700 may include an NSFV-based security policy management device 720, a virtualization agent 710, and a hypervisor 730. In addition, the virtualization system 700 may drive a plurality of virtual machines on a single hardware device, and each virtual machine may operate independently and drive different operating systems (OSs).

The virtualization agent 710 relays communication between the NSFV-based cloud security analysis device 600 and the NSFV-based security policy management device 720. The virtualization agent 710 receives an analysis request message including at least one of user information, tenant information, and security data from the NSFV-based cloud security analysis device 600, and the received analysis request message is an NSFV-based security policy It is delivered to the management device 720.

In addition, the virtualization agent 710 may receive at least one of an analysis result, a security control command, and a security policy from the NSFV-based security policy management device 720 and provide the NSFV-based cloud security analysis device 600. .

The NSFV-based security policy management device 720 receives an analysis request message from the NSFV-based cloud security analysis device 600, sets a data mining model, and receives data from the NSFV-based cloud security analysis device 600. Perform relevance analysis for.

In addition, the NSFV-based security policy management device 720 may set a security control command and a security policy based on the analyzed result, and transmit it to the NSFV-based cloud security analysis device 600 through the virtualization agent 710. . The NSFV-based cloud security analysis device 600 receiving the security control command and the security policy may distribute the received security control command and security policy to the NSFV-based security system 500.

The hypervisor 730 allocates and schedules physical resources such as a central processing unit (CPU), memory, storage, and network to a plurality of virtual machines in order to drive a plurality of virtual machines in the virtualization system 700. In addition, the hypervisor 730 may access virtual machines in the virtualization system 700 and resources used by the virtual machines.

In addition, the hypervisor 730 may include a software-type virtual switch (vSwitch) relaying virtual network packets for communication between virtual machines and a firewall packet filter filtering virtual network packets according to established rules.

7 is an exemplary view showing an example of a security policy management apparatus according to an embodiment of the present invention.

As illustrated in FIG. 7, the NSFV-based security policy management device 720 includes security event and alert information collection function, analysis data pre-processing function, security event association analysis function, security policy and signature management function, analysis result, and alarm reporting Functions, etc.

The NSFV-based security policy management device 720 may receive security event and alert information from the virtualization agent 710 through a security event and alert information collection function. Here, the security event and alarm information collection function may refer to an operation performed by the analysis request receiving unit 210 of FIG. 3, and a redundant description will be omitted. In addition, the NSFV-based security policy management device 720 may provide an analysis result and a security policy to the virtualization agent 710 through an analysis result and an alarm reporting function.

In addition, the NSFV-based security policy management device 720 analyzes and detects abnormal behavior through a data mining analysis model, processing and processing the collected data through an analysis data pre-processing function, and a security event association analysis function. You can. Here, the analysis data pre-processing function and the security event association analysis function may refer to an operation performed by the association analysis unit 220 of FIG. 3, and a duplicate description is omitted.

The NSFV-based security policy management device 720 may request the security situation information of the cloud service provided for each user or tenant through the external interface 740, and each user or tenant based on the association analysis result of the security event It is possible to report the security status information of each star. In particular, the NSFV-based security policy management apparatus 720 may report the security situation threat detected through the association analysis through the analysis result and the alarm reporting function to the external interface 740.

In addition, the NSFV-based security policy management device 720 may receive an environment setting value for performing functions of internal modules through the lifecycle state management unit 750, and state information of the NSFV-based security policy management device 720 Can provide.

The process of receiving and providing security status information through the external interface 740 and the process of receiving environment setting values through the lifecycle state management unit 750 and providing status information are performed by the interface unit 250 of FIG. 3. It may be, and redundant descriptions will be omitted.

In addition, the NSFV-based security policy management device 720 performs a security policy and signature management function, detects a threat through a data modeling technique, and generates and manages a security policy and signature rule set for the detected threat. . Here, the function of creating a security policy and signature rule set and deploying it to the NSFV-based cloud security analysis device 600 through the virtualization agent 710 includes a security policy setting unit 230 and a security policy transmission unit 240 of FIG. 3 ), And redundant description is omitted.

8 is a block diagram showing a computer system according to an embodiment of the present invention.

8, an embodiment of the present invention may be implemented in a computer system 800, such as a computer-readable recording medium. As shown in FIG. 8, computer system 800 includes one or more processors 810, memory 830, user input device 840, user output device 850, and storage that communicate with each other via bus 820. 860. In addition, the computer system 800 may further include a network interface 870 connected to the network 880. The processor 810 may be a central processing unit or a semiconductor device that executes processing instructions stored in the memory 830 or the storage 860. The memory 830 and the storage 860 may be various types of volatile or nonvolatile storage media. For example, the memory may include ROM 831 or RAM 832.

Accordingly, an embodiment of the present invention may be embodied as a computer-implemented method or a non-transitory computer-readable medium on which computer-executable instructions are recorded. When computer readable instructions are executed by a processor, computer readable instructions may perform the method according to at least one aspect of the present invention.

As described above, the apparatus and method for cloud security analysis and security policy management based on network security function virtualization according to the present invention are not limited to the configuration and method of the described embodiments, and the embodiments are All or part of each of the embodiments may be selectively combined to constitute various modifications.

100: network security function virtualization-based cloud security analysis device
110: network data collection unit 120: security situation analysis unit
130: analysis request unit 140: security policy receiving unit
150: Security Policy Distribution
200: network security function virtualization-based security policy management device
210: analysis request receiving unit 220: association analysis unit
230: security policy setting unit 240: security policy transmission unit
250: interface unit 500: NSFV-based security system
600: NSFV-based cloud security analysis device
700: Virtualization system 710: Virtualization agent
720: NSFV-based security policy management device
730: hypervisor 740: external interface
750: life cycle state management unit 800: computer system
810: processor 820: bus
830: memory 831: ROM
832: RAM 840: user input device
850: user output device 860: storage
870: network interface 880: network

Claims (20)

Analysis request receiving unit for receiving an analysis request message containing the security data from the cloud security analysis device,
For each analysis unit including at least one of a tenant unit and a user unit, an association analysis unit performing an association analysis of the security data,
A security policy setting unit that sets at least one of a security control command and a security policy based on the result of performing the association analysis, and
Security policy transmission unit for transmitting at least one of the set security control command and the security policy to the cloud security analysis device
Including,
The association analysis unit
Network security function virtualization-based security policy management device characterized by analyzing association based on security data processed based on data mining analysis model and security data selected from users based on standard analysis model. According to claim 1,
The analysis request message,
A network security function virtualization-based security policy management device comprising at least one of user information, tenant information, and the security data. According to claim 2,
Network security function virtualization-based, characterized in that it further comprises an interface for receiving security situation information corresponding to an analysis target including at least one of a user and a tenant, and providing an analysis result of the security situation corresponding to the analysis target. Security policy management device. According to claim 2,
The security data,
A security policy management device based on network security function virtualization, comprising at least one of security events, flow events, network packet streams, service logs, and network security function virtualization-based security system logs. delete According to claim 1,
The security policy setting unit,
Network security function virtualization-based security policy management device, characterized in that at least one of the security control command and the security policy is set to correspond to the security threat detected through data modeling analysis. The method of claim 6,
The security policy setting unit,
Network security function virtualization-based security policy management device, characterized by setting at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set. According to claim 1,
The network security function virtualization-based security policy management device,
Network security function virtualization-based security policy management device, characterized in that it runs on a virtual machine through a hypervisor. Network security function A network data collection unit that collects network data corresponding to a cloud computing environment from a virtualization-based security system,
A security situation analysis unit that analyzes the collected network data for each analysis unit including at least one of tenant units and user units to detect abnormal behaviors and analyze security conditions.
Analysis request unit that sends analysis request message to security policy management device,
Security policy receiving unit for receiving a security control command and security policy from the security policy management device, and
And a security policy transmission unit transmitting the received security control command and security policy to the security system,
The security policy management device
For each analysis unit, correlation analysis of security data included in the analysis request message is performed, and correlation is analyzed based on security data processed from the data mining analysis model and security data selected from the user based on a standard analysis model. Network security function virtualization-based cloud security analysis device characterized in that. The method of claim 9,
The analysis request unit,
Network security function virtualization-based cloud security analysis device, characterized in that for transmitting the analysis request message containing at least one of user information, tenant information, the security data. The method of claim 10,
The network data,
A network security function virtualization-based cloud security analysis device comprising at least one of a security event, a flow event, a network packet stream, a service log, and a network security function virtualization-based security system log. The method of claim 11,
The security situation analysis unit,
A network security function virtualization-based cloud security analysis device characterized by processing the network data based on a big data platform, detecting the abnormal behavior, and analyzing the security situation. The method of claim 10,
The security control command and security policy,
A network security function virtualization-based cloud security analysis device comprising at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set. In the security policy management method performed by the network security function virtualization-based security policy management device,
Receiving an analysis request message including security data from the cloud security analysis device,
For each analysis unit including at least one of a tenant unit and a user unit, performing a correlation analysis of the security data,
Setting at least one of a security control command and a security policy based on the result of performing the association analysis, and
Transmitting at least one of the set security control command and the security policy to the cloud security analysis device
Including,
The step of performing association analysis of the security data is
A network security function virtualization-based security policy management method characterized by analyzing association based on security data processed based on a data mining analysis model and security data selected from a user based on a standard analysis model. The method of claim 14,
The analysis request message,
Network security function virtualization-based security policy management method comprising at least one of user information, tenant information, and the security data. The method of claim 15,
Receiving security situation information corresponding to an analysis target including at least one of a user and a tenant, and
Providing an analysis result of a security situation corresponding to the analysis target
Network security function characterized in that it further comprises a security policy management method based on virtualization. The method of claim 15,
The security data,
A security policy management method based on network security function virtualization, comprising at least one of security events, flow events, network packet streams, service logs, and network security function virtualization-based security system logs. delete The method of claim 14,
The setting of at least one of the security control command and the security policy may include:
A security policy management method based on network security function virtualization, characterized in that at least one of the security control command and the security policy is set to correspond to a security threat detected through data modeling analysis. The method of claim 19,
Setting at least one of the security control command and the security policy,
A network security function virtualization-based security policy management method characterized by setting at least one of a security setting control command, a virtual network traffic control command, an attack response policy, a detection response policy, and a signature rule set.

Images