KR102098064B1 - Method, Apparatus and System for Security Monitoring Based On Log Analysis - Google Patents

Abstract

A security monitoring method, apparatus and system based on log analysis is disclosed. The monitoring method based on log analysis is based on collecting logs generated from the client device and analyzing the logs in real time, detecting events requiring security measures, and based on logs corresponding to the detected events. Generates normalized log information corresponding to an event, determines whether the detected event is a risk level event that requires detailed analysis from the server, and based on the determination, includes the normalized log information to the server Either of sending a detailed analysis request or performing a security measure by a client device may be performed.

Description

Security monitoring method, device and system based on log analysis {Method, Apparatus and System for Security Monitoring Based On Log Analysis}

The present invention relates to a security monitoring method, apparatus, and system based on log analysis. More specifically, it collects logs according to actions occurring in a client device, analyzes the collected logs, and optionally performs security measures on the server. It is related to a log analysis-based security monitoring method, device, and system that reduces the load on the server and improves the speed and reliability of the analysis.

2. Description of the Related Art In recent years, with the frequent occurrence of illegal acts due to hacking in the Internet environment, monitoring systems and related technologies for detecting and responding to such illegal acts have been developed. For example, the monitoring system may analyze a client's behavior and perform processing such as a method and report on the behavior when the behavior is determined to be illegal.

In this case, logs generated in the client device may be used as a basis for analyzing the behavior of the client device. Conventional log analysis uses a batch method or relies on dedicated hardware. However, in this case, since it is not a real-time processing method, it is difficult to respond promptly to illegal activities and is expensive.

There is a method in which the log of the client device is collected and analyzed by the server in a different way in the related art, and the result and the response guidelines are transmitted to the client device. .

Accordingly, there is an urgent need to develop a new technology capable of easily determining and responding to abnormal signs occurring in a client device in real time while minimizing the load on the server and the network.

Korean Patent Publication No. 2005-0095399

The present invention is to solve such a problem, collects logs generated in the client device, analyzes the collected logs in real time, and performs a security measure corresponding to a critical event on the client device or server to perform server and network load The objective is to provide a security monitoring method, device, and system based on improved log analysis while minimizing the response time.

In order to achieve this object, the present invention provides a security monitoring method based on log analysis in one aspect. A security monitoring method based on the log analysis includes: a security monitoring method performed by a client device, comprising: collecting logs generated in the client device; Detecting an event requiring a security measure based on real-time analysis of the collected logs; Generating normalized log information corresponding to the event based on the logs corresponding to the detected event; Determining whether the detected event is a risk level event that requires a detailed analysis request from a server; And based on the determination, transmitting any one of the steps of transmitting a detailed analysis request including the normalized log information to the server and performing security measures by the client device. .

The step of detecting an event requiring the security measure may include analyzing the collected logs in real time to determine whether the event is an event that violates a predetermined rule set.

The log information may have information smaller than the collected logs, and may include information indicating a history of the event. The log information may include an application identifier, a target file name, an access type, a count value, and an event occurrence time.

Determining whether the detected event is a risk level event that requires requesting analysis from the server includes: generating a risk point of the event based on the collected logs; Querying a pre-stored table including reference points for each event and extracting reference points corresponding to the event; And determining whether the risk point is greater than or equal to the reference point.

In the step of performing any one of the steps, when the risk point is greater than or equal to the reference point, a detailed analysis request including the normalized log information is transmitted to the server, and when the risk point is less than the reference point, the server It may include the step of performing its own security measures by the client device without requesting an analysis.

The step of performing the security measure may include performing a security process provided in the client device. The security process may include at least one of locking a PC, backing up document data, displaying a warning message, and blocking access.

The security monitoring system based on the log analysis comprises: receiving a request to transmit collected logs in response to the log information from the server performing detailed analysis; Transmitting the collected logs to the server in response to the transmission request; And performing security measures instructed by the server.

On the other hand, in order to achieve the object of the present invention described above, the present invention provides a security monitoring device based on log analysis in another aspect. The security monitoring apparatus includes: a log collection unit that collects logs generated in the client device; Based on analyzing the collected logs in real time, an event requiring a security measure is detected, and normalized log information corresponding to the event is generated based on the logs corresponding to the detected event, and the detection A real-time log analysis unit to determine whether the event is at a risk level that requires a detailed analysis request from the server; And a local control unit that transmits a detailed analysis request including the normalized log information to the server based on the determination, or performs a security measure by the client device.

The real-time log analysis unit may analyze the collected logs in real time to determine whether the event is an event that violates a predetermined rule set. The log information may have information smaller than the collected logs, and may include information indicating a history of the event. The log information may include an application identifier, a target file name, an access type, a count value, and an event occurrence time.

The real-time log analysis unit generates a risk point of the event based on the collected logs, retrieves a pre-stored table including a reference point for each event, extracts a reference point corresponding to the event, and the risk point It may be determined whether or not is equal to or greater than the reference point.

The local control unit transmits a detailed analysis request including the normalized log information to the server when the risk point is greater than or equal to the reference point, and when the risk point is less than the reference point, the client without requesting analysis to the server You can perform your own security measures by the device.

The local control unit may perform a security process provided in the client device. The security process may include at least one of locking a PC, backing up document data, displaying a warning message, and blocking access.

The local control unit receives a request for transmission of logs collected corresponding to the log information from the server performing detailed analysis, transmits the collected logs to the server in response to the transmission request, and commands from the server Security measures.

On the other hand, in order to achieve the object of the present invention described above, the present invention provides a security monitoring system based on log analysis in another aspect. The security monitoring system based on the log analysis may include a client device and a server interworking with the client device.

The client device detects an event requiring a security measure based on collecting logs generated from the client device and analyzing the collected logs in real time, and based on logs corresponding to the detected event. To generate normalized log information corresponding to the event, to determine whether the detected event is a risk level event that requires detailed analysis to the server, and based on the determination, the normalized log to the server A detailed analysis request including information may be transmitted, or a security measure by the client device may be performed.

The client device may analyze the collected logs in real time to determine whether the event is an event that violates a predetermined rule set. The log information may have information smaller than the collected logs, and may include information indicating a history of the event. The log information may include an application identifier, a target file name, an access type, a count value, and an event occurrence time.

The client device generates a risk point of the event based on the collected logs, retrieves a pre-stored table including a reference point for each event, extracts a reference point corresponding to the event, and the risk point It may be determined whether or not the reference point is greater than or equal to.

The client device sends a detailed analysis request including the normalized log information to the server when the risk point is greater than or equal to the reference point, and when the risk point is less than the reference point, the client without an analysis request to the server You can perform your own security measures by the device.

The client device may perform a security process provided in the client device. The security process may include at least one of locking a PC, backing up document data, displaying a warning message, and blocking access.

The client device receives a request for transmission of logs collected corresponding to the log information from the server performing detailed analysis, transmits the collected logs to the server in response to the transmission request, and commands from the server Security measures.

Meanwhile, the present invention described above provides a computer program in another aspect. The computer program is a computer program that is loaded and executed in a memory by a processor of a client device, the method comprising: collecting logs generated in the client device; Detecting an event requiring a security measure based on real-time analysis of the collected logs; Generating normalized log information corresponding to the event based on the logs corresponding to the detected event; Determining whether the detected event is a risk level event that requires a detailed analysis request from a server; And based on the determination, executing any one of the steps of transmitting a detailed analysis request including the normalized log information to the server and performing a security measure by the client device. You can.

As described above, by collecting the logs generated from the client device, and analyzing the collected logs in real time, the client device or the server selectively performs security measures corresponding to the risk event, thereby minimizing the server and network load while speeding up the response. Can improve.

1 is a block diagram showing the configuration of a security monitoring system based on log analysis according to a preferred embodiment of the present invention.
FIG. 2 is a block diagram showing a detailed configuration of the client device shown in FIG. 1.
3 is a flowchart for explaining the operation flow of the security monitoring unit shown in FIG. 2.
4 is an exemplary view illustrating log information generated in response to logs generated at the time of a document open event by the real-time log analysis unit.
5 is a flowchart illustrating an operation process after a detailed analysis request is sent from a client device to a server.
6 is a block diagram showing a configuration of a server interworking with at least one client device.

The present invention can be applied to various changes and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from other components. For example, the first component may be referred to as a second component without departing from the scope of the present invention, and similarly, the second component may be referred to as a first component. The term and / or includes a combination of a plurality of related described items or any one of a plurality of related described items.

When an element is said to be 'connected' or 'connected' to another component, it is understood that other components may be directly connected to or connected to the other component, but other components may exist in the middle. It should be. On the other hand, when a component is said to be 'directly connected' or 'directly connected' to another component, it should be understood that no other component exists in the middle.

The terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, terms such as 'include' or 'have' are intended to indicate that a feature, number, step, action, component, part, or combination thereof described in the specification exists, and that one or more other features are present. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the present invention pertains. Terms such as those defined in a commonly used dictionary should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Does not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the overall understanding in describing the present invention, the same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

1 is a block diagram showing the configuration of a security monitoring system based on log analysis according to a preferred embodiment of the present invention.

As shown in FIG. 1, the security monitoring system 1 based on log analysis according to a preferred embodiment of the present invention can be implemented as at least one client device 10 and server 20. For example, the security monitoring system 1 including the client device 10 and the server 20 may be a system based on a local network requiring security, such as an intranet in the workplace to which Digital Right Management (DRM) is applied. .

The client device 10 is a network computer terminal that can interwork with the server 20 or other devices through a communication network. For example, the client device 10 may be a personal computer (PC), a notebook, a tablet PC, a notepad, a smartphone, and the like. The client device 10 is not shown, but at least, a processor for performing an operation, a memory for storing data for execution of a program, a hard disk for storing digital information, an input unit for inputting information, and an output for displaying information It may include a communication unit for interworking with the communication network.

The processor may load and execute software stored in the hard disk in memory according to a user's request through the input unit. The input unit may be, for example, a keyboard or a virtual keyboard, and the output unit may mean information display means including a display panel such as a monitor. The input unit and the output unit may be implemented as an integrated touch screen.

The client device 10 is operated through an operating system provided by Windows, Apple, Android, etc., and content software for using documents or digital content, such as word processors, PowerPoint, Excel, Korean, Photoshop, and Autocad, the Internet Various applications, such as a browser that can be connected to, may be provided.

The client device 10 is equipped with a security monitoring unit. The security monitoring unit collects logs generated in the client device 10, analyzes the collected logs in real time, detects an event requiring a security measure, and automatically detects the event in need of the detected event, according to the level of risk of the detected event Security measures may be performed, or detailed analysis may be requested by requesting the server 20.

The server 20 associates with at least one client device 10 and analyzes a risky event in detail in response to a detailed analysis request of the client device 10 and responds to the client device 10 according to the analyzed content To order. The server 20 stores and manages the information of these events in a database.

FIG. 2 is a block diagram showing a detailed configuration of the client device 10 shown in FIG. 1, and FIG. 3 is a flowchart for explaining the operation flow of the security monitoring unit shown in FIG. 2.

2 and 3, at least one application (AP) and a security monitoring unit 100 may be provided in the client device 10. The log collection unit 110 of the security monitoring unit 100 may collect logs generated in the client device 10 (step: S1). For example, when a user requests an action, such as an application, to open, modify, store, or copy a specific document to the client device 10 through the input unit, the client device 10 generates logs accordingly. You can. The log collection unit 110 may collect these logs.

The real-time log analysis unit 120 may analyze the collected logs in real time to detect an event requiring a security measure (step: S2). Specifically, the real-time log analysis unit 120 may analyze logs collected from the client device 10 to compare with a previously stored rule set and detect an event that violates the rule set. The rule set may be a scenario set that defines various risk scenarios that may occur in the client device 10.

For example, the rule set "Can not open more than 10 documents in 1 minute on the device of the department XXX", "Cannot open more than 10 documents at the same time", "Delete more than 5 documents in 10 seconds "No device", "000 permission class device cannot copy or transmit document", and the like.

The rule set may be variously set according to factors such as a permission level of the device, an application type, a target document (file), an access type, an access count value, an event occurrence time, and an event occurrence period. The rule set may be set by the administrator of the server 20 through the user interface of the client manager, and may be stored in the server repository. The rule set may be stored and managed in the local storage 150 of the client device 10 after being transferred from the client manager to the client agent 160 of the client device 10.

The real-time log analysis unit 120 may detect an event requiring a security measure using this rule set. For example, assuming that the client device 10 is a device registered to belong to the "XXX department", and the rule set determines that "10 or more documents cannot be opened in 1 minute in the client terminal of the XXX department". If an event occurs that the client device 10 "opens 15 documents in MS Word from 10:10 to 1 minute" through log analysis, "the real-time log analysis unit 120 illegally acts on the event Because it is occurring, it can be determined as an event that requires security measures to detect the event.

When an event requiring a security measure is detected, the real-time log analysis unit 120 generates normalized log information corresponding to the event based on the logs corresponding to the detected event (step: S3). The log information may have information smaller than the information amount of the collected logs, and may include information indicating the history of the event. For example, the log information may include an application identifier associated with the event, a target document (file) name, an access type, a count value indicating the number of times the access was performed, an event occurrence time, an event occurrence period, and the like.

FIG. 4 is an exemplary view illustrating log information generated in response to logs generated at the document open event by the real-time log analysis unit 120.

As shown in FIG. 4, when a text document “a.txt” is opened using, for example, the application “note pad”, a plurality of logs as shown in the list shown on the left of FIG. 4 corresponding to the open event Will occur. The real-time log analysis unit 120 may generate log information such as "Notepad.exe open c: \\ a.txt" by normalizing the logs in a predetermined format. The log information represents the history of the event that the "a.txt" document was opened in the application "notepad.exe", and it can be seen that the amount of information is much reduced because a plurality of logs are converted into brief log information.

As mentioned above, the log information may include an application identifier associated with the event, a target document (file) name, an access type, a count value indicating the number of times the access was performed, an event occurrence time, an event occurrence period, etc. If the event of "opening 15 documents in MS Word from 10:10 to 1 minute occurs", the real-time log analysis unit 120 normalizes hundreds of log information generated according to the event, for example, "MSword .exe open c: \\ b.doc pm10: 10: 01 "," MSword.exe open c: \\ c.doc pm10: 10: 02 "," MSword.exe open c: \\ d.doc pm10: 10:04 ",… , "MSword.exe open c: \\ f.doc pm10: 11: 00" can generate log information including the details of 15 open events. The generated log information is stored and managed in the local storage 160 in association with the detected event identification information and collected logs.

Subsequently, the real-time log analysis unit may determine whether the detected event is a risk level event that requires requesting detailed analysis from the server 20 (step: S4). That is, the real-time log analysis unit 120 judges that there is a risk of illegal activity, and the event detected as an event requiring security measures is processed by the client device 10 according to the risk level or the server 20 You can decide whether to request detailed analysis.

More specifically, the real-time log analysis unit 120 analyzes the collected logs corresponding to the event to generate a risk point of the event, and queries a pre-stored table including reference points for each event to correspond to the event Mood points can be extracted. In addition, the real-time log analysis unit 120 may determine whether the generated risk point is greater than or equal to the extracted reference point.

In this case, the real-time log analysis unit 120 determines that the event is a high-risk event such that the event needs to request detailed analysis from the server 20 when the risk point is greater than or equal to the reference point. It can be determined that the event is a relatively low risk event that may be handled by the client device 10 itself.

Here, the risk point extracted from the event may be, for example, a count value that is the number of times access is performed. The reference point may be a minimum risk point for requesting detailed analysis from the server 20. These reference points can be managed by being included in a table form in the rule set of the local storage.

For example, in the event of "opening 15 documents with MS Word for 10 to 1 minute from 10:10", the risk point may be "15". If the reference point of the "number of document openings using MS word for 1 minute" is "12", the risk point of the event is greater than or equal to the reference point, so the real-time log analysis unit 120 analyzes the event in detail in the server 20 It can be judged as a high-risk event that needs to be requested.

On the other hand, assuming that the reference point of "the number of document open times using an MS word for 1 minute" is "30", the risk point is less than the reference point, so the real-time log analysis unit 120 requests detailed analysis of the risk level of the event. It can be judged to be lower than the level of risk. In this case, the client device 10 secures itself to the event.

The result value of the determination may be transmitted to the local control unit 140. When the real-time log analysis unit 120 determines that the server 20 requests detailed analysis for the event, the local control unit 140 sends a detailed analysis request including standardized log information corresponding to the event to the client agent It can be transmitted to the server 20 through (160) (step: S6).

On the other hand, if the local control unit 140 determines that the real-time log analysis unit 120 is a low-risk event that may be handled by the client device 10 for the event itself, the client device 10 terminal itself It is possible to immediately respond to the event in real time using a security process capable of performing security measures (step: S5). The security process may be, for example, locking a PC, backing up document data, displaying a warning message, blocking access, and the like.

5 is a flowchart illustrating an operation process after the detailed analysis request is transmitted from the client device 10 to the server 20.

5, after transmitting the detailed analysis request to the server 20, the client device 10 may receive a request to transmit logs corresponding to the event from the server 20 (step: S11). The request of the server 20 is received through the client agent 160 of the client device 10 and then transmitted to the local control unit 140.

Then, the local control unit 140 may extract the logs stored in the local storage 150 (step: S12), and transmit the extracted logs to the server 20 through the client agent 160 (step: S13) ).

6 is a block diagram showing a configuration of a server 20 interworking with at least one client device 10.

As shown in FIG. 6, the server 20 may include a client manager 210, a detailed analysis unit 220, a server control unit 230, and a server storage 240. The client manager 210 may transmit and receive information in cooperation with the client agent 160 of the client device 10. The client manager 210 may manage at least one client device 10.

When a detailed analysis request for an event is received from the client device 10, the detailed analysis unit 220 may analyze log information included in the detailed analysis request and display it to the administrator through a user interface. The detailed analysis unit 220 may request logs corresponding to the log information to the client device 10, and when logs are received from the client device 10, store them in the server storage 240 and analyze the logs in detail. It can be analyzed based on.

The server control unit 230 may determine a security measure corresponding to the event based on the analysis result of the detailed analysis unit 220 and deliver a response guideline to the client device 10 according to the determined security measure. The server control unit 230 may store and manage the history of the event requesting the detailed analysis from the client device 10, the result of the detailed analysis analysis, and the security action history in the server storage 240. The history of the event stored in the server storage 240, the detailed analysis result, and the security action history can be viewed and viewed by the administrator through the user interface.

As described above, according to the present invention, the client device 10 monitors logs generated in the client device 10 to detect an event related to the possibility of illegal activity, and real-time when the risk level of the event is not high As a result, the client device 10 performs security measures on its own, and requests detailed analysis to the server 20 only when the risk level is high. Therefore, the server 20 does not need to be involved in all events that may be illegal, and the load of the server 20 is significantly reduced because normalized log information with a small amount of information is transmitted only for a part of the events. . In addition, since the security measures are performed on the client device 10 for events with a low risk level, a quick response is possible.

The preferred embodiments of the present invention have been exemplified and described, but those skilled in the art variously modify and change the present invention without departing from the technical details and scope of the present invention as set forth in the claims below. You can understand that you can do it. Therefore, changes in the embodiments of the present invention will not be able to escape the technology of the present invention.

AP: Application
1: Security monitoring system based on log analysis
10: client device
20: server
100: security monitoring unit
110: log collection unit
120: real-time log analysis unit
140: local control
150: local storage
160: client agent
210: client monitor
220: detailed analysis unit
230: Server control
240: server storage

Claims (25)

In the security monitoring method performed by the client device,
Collecting logs generated at the client device;
Detecting an event requiring a security measure based on real-time analysis of the collected logs;
Generating normalized log information corresponding to the event based on the logs corresponding to the detected event;
Determining whether the detected event is a risk level event that requires a detailed analysis request from a server; And
Based on the determination, transmitting any one of the steps of transmitting a detailed analysis request including the normalized log information to the server and performing a security measure by the client device,
Characterized in that it performs a security measure according to a detailed analysis based on communication with the server only when the risk level is above a predetermined level, and performs a security measure by the client device itself when the risk level is below a predetermined level. Security monitoring method based on log analysis.
The method of claim 1, wherein the step of detecting the event that requires the security measures,
And analyzing the collected logs in real time to determine whether the event is an event that violates a predetermined rule set, or security monitoring method based on log analysis.
The method of claim 1, wherein the log information has a smaller amount of information than the collected logs, and the security monitoring method based on log analysis, characterized in that it includes information indicating the history of the event.
The method of claim 3, wherein the log information,
A security monitoring method comprising an application identifier, a target file name, an access type, a count value, and an event occurrence time.
The method of claim 1, wherein determining whether the detected event is a risk level event that requires requesting analysis from the server,
Generating a risk point of the event based on the collected logs;
Querying a pre-stored table including reference points for each event and extracting reference points corresponding to the event; And
And determining whether the risk point is greater than or equal to the reference point.
The method of claim 5, wherein performing any one of the steps,
If the risk point is greater than or equal to the reference point, a detailed analysis request including the normalized log information is transmitted to the server, and when the risk point is less than the reference point, the client device does not request an analysis to the server. Security monitoring method based on log analysis characterized in that it comprises the step of performing a security measure.
The method of claim 1, wherein the step of performing the security measures,
And performing a security process provided in the client device,
The security process is a security monitoring method based on log analysis, characterized in that it comprises at least one of PC lock, document data backup, warning message display, access blocking.
The method of claim 1, further comprising: receiving a request to transmit collected logs in response to the log information from the server performing detailed analysis;
Transmitting the collected logs to the server in response to the transmission request; And
Security monitoring method based on the log analysis, characterized in that it further comprises the step of performing a security measure commanded by the server.
A log collection unit for collecting logs generated in the client device;
Based on analyzing the collected logs in real time, an event requiring a security measure is detected, and normalized log information corresponding to the event is generated based on the logs corresponding to the detected event, and the detection A real-time log analysis unit to determine whether the event is at a risk level that requires a detailed analysis request from the server; And
Based on the determination, a detailed analysis request including the normalized log information is transmitted to the server, or a local control unit for performing security measures by the client device,
Characterized in that it performs a security measure according to a detailed analysis based on communication with the server only when the risk level is above a predetermined level, and performs a security measure by the client device itself when the risk level is below a predetermined level. Security monitoring device based on log analysis.
The method of claim 9, wherein the real-time log analysis unit,
A security monitoring device based on log analysis, characterized in that the collected logs are analyzed in real time to determine whether the event is an event that violates a predetermined rule set.
The security monitoring device based on log analysis according to claim 9, wherein the log information includes information indicating a small amount of information than the collected logs and indicating the history of the event.
The method of claim 11, wherein the log information,
A security monitoring device comprising an application identifier, a target file name, an access type, a count value, and an event occurrence time.
The method of claim 9, wherein the real-time log analysis unit,
Based on the collected logs, a risk point of the event is generated, a pre-stored table including a reference point for each event is searched to extract a reference point corresponding to the event, and whether the risk point is greater than or equal to the reference point Security monitoring device based on the log analysis, characterized in that to determine.
The method of claim 13, wherein the local control unit,
If the risk point is greater than or equal to the reference point, a detailed analysis request including the normalized log information is transmitted to the server, and when the risk point is less than the reference point, the client device does not request an analysis to the server. Security monitoring device based on log analysis characterized by performing security measures.
The method of claim 9, wherein the local control unit performs a security process provided in the client device,
The security process is a security monitoring device based on log analysis, characterized in that it comprises at least one of PC lock, document data backup, warning message display, access blocking.
The method of claim 9, wherein the local control unit,
Receive a request to transmit the collected logs in response to the log information from the server performing detailed analysis, transmit the collected logs to the server in response to the transmission request, and perform security measures commanded by the server Security monitoring device based on the log analysis, characterized in that.
Client devices; And
And a server interworking with the client device,
The client device,
Based on collecting logs generated in the client device and analyzing the collected logs in real time, an event requiring a security measure is detected, and the event is responded to based on logs corresponding to the detected event Generates normalized log information, determines whether the detected event is a risk level event that requires a detailed analysis request from the server, and based on the determination, details including the normalized log information to the server Sending an analysis request, or performing security measures by the client device,
Characterized in that it performs a security measure according to a detailed analysis based on communication with the server only when the risk level is above a predetermined level, and performs a security measure by the client device itself when the risk level is below a predetermined level. Security monitoring system based on log analysis.
The method of claim 17, wherein the client device,
A security monitoring system based on log analysis, characterized in that the collected logs are analyzed in real time to determine whether the event is an event that violates a predetermined rule set.
The security monitoring system based on log analysis according to claim 17, wherein the log information comprises less information than the collected logs, and includes information indicating the history of the event.
The method of claim 19, wherein the log information,
Security monitoring system characterized by including the application identifier, the target file name, access type, count value, event occurrence time.
delete delete delete delete delete

Images