KR102394702B1 - Fast Detection Device and method of Abnormal Network Traffic on Sankey and Parallel Coordinates Security Visualization - Google Patents

Abstract

An embodiment of the present invention relates to a rapid abnormal traffic detection apparatus and method using raw key and parallel coordinate security visualization. In one example, the present invention provides a security device for collecting abnormal traffic from the Internet and intranets; a computer device that receives the event log from the security device and visualizes it as a dashboard having a raw key diagram and a parallel coordinate diagram at the same time; and a display device for displaying a dashboard having a raw key diagram and a parallel coordinate diagram.

Description

Fast Detection Device and method of Abnormal Network Traffic on Sankey and Parallel Coordinates Security Visualization

An embodiment of the present invention relates to a rapid abnormal traffic detection apparatus and method using raw key and parallel coordinate security visualization.

Unlike the past, the current corporate network environment is getting larger and more complex. A single security device can generate tens to hundreds of gigabytes of traffic per day. It is not easy to detect abnormal (abnormal) information by analyzing text logs such as firewall, IDS, and IPS one by one.

The analysis system should be automated for the analyst to analyze the network quickly and efficiently. In addition, analysts must be fully aware of the key network scenarios. But for this to happen, tools to aid analysis are essential. This tool helps to quickly detect anomalous traffic from massive events of security equipment. Information visualization presents an efficient analysis method for high-dimensional data. This is because the human brain has a better ability to process images than text.

The above-described information disclosed in the background technology of the present invention is only for improving the understanding of the background of the present invention, and thus may include information that does not constitute the prior art.

The problem to be solved according to an embodiment of the present invention is to use a Sankey Diagram and Parallel Coordinates Diagram with security events that occur in numerous heterogeneous devices to quickly detect abnormal traffic using a Sankey and An object of the present invention is to provide a rapid abnormal traffic detection apparatus and method using parallel coordinate security visualization.

In addition, the problem to be solved according to the embodiment of the present invention is to provide a rapid abnormal traffic detection apparatus and method using raw key and parallel coordinate security visualization that can quickly determine not only network attacks but also traffic generation due to errors in network equipment. is doing

In addition, the problem to be solved according to the embodiment of the present invention is a rapid abnormal traffic detection device using raw key and parallel coordinate security visualization, which enables rapid abnormal traffic detection by simultaneously expressing the number of security events and traffic volume generated by the raw key diagram in the network equipment and to provide a method.

In addition, the problem to be solved according to the embodiment of the present invention is to use the raw key and parallel coordinate security visualization that can greatly reduce false positives through the action section, which is an event that a parallel coordinate diagram occurs in security equipment. An object of the present invention is to provide an apparatus and method for detecting abnormal traffic quickly.

A rapid abnormal traffic detection apparatus using a raw key and parallel coordinate security visualization according to an embodiment of the present invention includes: a security device for collecting abnormal traffic from the Internet and intranet; a computer device that receives the event log from the security device and visualizes it as a dashboard having a raw key diagram and a parallel coordinate diagram at the same time; and a display device for displaying a dashboard having a raw key diagram and a parallel coordinate diagram.

The raw key diagram visualized by the computer device may include a source IP, a destination IP, a number of detection events, and an amount of network traffic.

The parallel coordinate diagram visualized by the computer device may include a source IP, a destination IP, a destination port, a packet size, and an action (acceptance/detection determination of a packet).

The dashboard can provide searchable specific ports, specific IPs and actions (determining allow/detection of packets).

A rapid abnormal traffic detection apparatus using a raw key and parallel coordinate security visualization according to an embodiment of the present invention includes: collecting abnormal traffic from the Internet and intranet by a security device; receiving the event log from the secure device by the computer device and visualizing it as a dashboard having a raw key diagram and a parallel coordinate diagram at the same time; and displaying the dashboard having the sankey diagram and the parallel coordinate diagram by the display device.

The raw key diagram visualized by the computer device may include a source IP, a destination IP, a number of detection events, and an amount of network traffic.

The parallel coordinate diagram visualized by the computer device may include a source IP, a destination IP, a destination port, a packet size, and an action (acceptance/detection determination of a packet).

The dashboard can provide searchable specific ports, specific IPs and actions (determining allow/detection of packets).

An embodiment of the present invention uses a Sankey Diagram and Parallel Coordinates Diagram to quickly detect abnormal traffic with security events occurring in numerous heterogeneous devices using Sankey and Parallel Coordinates Security Visualization A rapid abnormal traffic detection apparatus and method are provided.

In addition, an embodiment of the present invention provides an apparatus and method for quickly detecting abnormal traffic using a raw key and parallel coordinate security visualization that can quickly determine not only a network attack but also a traffic occurrence due to an error of a network equipment.

In addition, an embodiment of the present invention provides an apparatus and method for rapid abnormal traffic detection using raw key and parallel coordinate security visualization, which enables rapid abnormal traffic detection by simultaneously expressing the number of security events and traffic volume generated by the raw key diagram in network equipment.

In addition, an embodiment of the present invention provides a rapid abnormal traffic detection device using a raw key and parallel coordinate security visualization that can greatly reduce false positives through the action section, where the parallel coordinate diagram is an event that occurs in security equipment, and provide a way

1 is a diagram illustrating a device configuration for data processing and visualization using a big data-based SIEM (SPLUNK).
2 is a diagram illustrating the configuration of an FDANT-PCSV (Fast Detection of Abnormal Network Traffic using Parallel Coordinates and Sankey Visualization) visualization system.
3 is a diagram illustrating a method for rapidly detecting network anomaly traffic using a raw key and parallel coordinate visualization.
4 is a diagram illustrating a rapid network anomaly traffic detection dashboard using raw key and parallel coordinate visualization.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Examples of the present invention are provided to more completely explain the present invention to those of ordinary skill in the art, and the following examples may be modified in various other forms, and the scope of the present invention is as follows It is not limited to an Example. Rather, these examples are provided so that this disclosure will be more thorough and complete, and will fully convey the spirit of the invention to those skilled in the art.

Further, an apparatus and/or other related device or component according to the present invention may be implemented using any suitable hardware, firmware (eg, application specific semiconductor), software, or any suitable combination of software, firmware and hardware. For example, the various components of an apparatus and/or other related apparatus or component according to the present invention may be formed on one integrated circuit chip or on separate integrated circuit chips. In addition, the various components of the device may be implemented on a flexible printed circuit film, formed on a tape carrier package, a printed circuit board, or on the same substrate as the device. In addition, various components of the apparatus, in one or more computing devices, may be processes or threads executing on one or more processors, which execute computer program instructions and other components to perform various functions mentioned below. elements can be interacted with. The computer program instructions are stored in a memory that can be executed in a computing device using a standard memory device, such as, for example, a random access memory. The computer program instructions may also be stored in other non-transitory computer readable media such as, for example, a CD-ROM, flash drive, and the like. In addition, those skilled in the art related to the present invention are skilled in the art that functions of various computing devices are combined with each other, integrated into one computing device, or functions of a specific computing device are one or more other computing devices without departing from the exemplary embodiments of the present invention. It should be recognized that they can be distributed among

For example, the device according to the present invention is a typical commercial computer comprising a central processing unit, a mass storage device such as a hard disk or a solid state disk, a volatile memory device, an input device such as a keyboard or mouse, and an output device such as a monitor or printer. can be operated in

1 is a diagram illustrating a device configuration for data processing and visualization using big data-based SIEM (SPLUNK). Here, SIEM (Security Information and Event Management) (SPLUNK) is a system that can process and use big data in real time and provide an appropriate visualization tool to efficiently detect abnormal traffic occurring in a large-scale network.

1, the abnormal traffic detection apparatus according to an embodiment of the present invention receives a security device that collects abnormal traffic from the Internet and/or an intranet, and an event log from the security device Thus, it may include a computer device that visualizes a dashboard having a raw key diagram and a parallel coordinate diagram at the same time, and a display device that displays a dashboard having a raw key diagram and a parallel coordinate diagram.

In some examples, the event log of the secure device may be transmitted in real time to the computer device in the form of a syslog or the like. Also, in some examples, the computer device may include a big data based SIEM (SPLUNK) system as described above.

FIG. 2 is a diagram illustrating the configuration of an FDANT-PCSV (Fast Detection of Abnormal Network Traffic using Parallel Coordinates and Sankey Visualization) visualization system.

As shown in FIG. 2 , the abnormal traffic detection apparatus according to an embodiment of the present invention includes an FDANT-PCSV visualization system, which uses events of a firewall, IPS, IDS, and DDoS as input data from a security device. In some examples, the SIEM parses the event of the real-time secure device and stores the transformed information to disk. In some examples, FDANT-PCSV extracts meaningful parameters (source IP, destination IP, destination port, packet length, allowed and blocked, number of events) from parsing events and visualized in real-time as raw key diagram and parallel coordinate diagram do.

3 is a diagram illustrating a method for rapidly detecting network anomaly traffic using a raw key and parallel coordinate visualization.

In FIG. 3, ① is an SP-visualized network anomaly traffic detection dashboard, ② is a raw key diagram for network anomaly detection, ③ is a parallel coordinate diagram for network anomaly traffic detection, ④ is a source IP (Source IP), and ⑤ is a destination IP ( Destination IP), ⑥ is the number of detection events, ⑦ is the amount of network traffic, and ⑧ is the 5-tuple of the parallel coordinate diagram: source IP, destination IP, destination port, packet size, and action (detection type). .

As shown in Fig. 3, the raw key diagram detects abnormal traffic quickly because the corresponding number of security events and traffic volume are expressed even if a pattern is not formed in the parallel coordinate diagram. The raw key diagram becomes thicker when the number of security events is large. Also, according to the number of security events, Sankey Flows are drawn sequentially from the top. In the raw key flow, the number of security events and the amount of security traffic for the corresponding traffic are displayed in real time.

In addition, as shown in FIG. 3 , the parallel coordinate diagram makes it possible to quickly detect abnormal traffic when network traffic forms a specific pattern and the corresponding event is allowed or blocked in Action. In the embodiment of the present invention, the parallel coordinate diagram uses the following five factors (5-tuple) as a basis. The arrangement order of the five factors (5-tuple) is as follows.

- Src IP (source address)

- Dst IP (Destination IP)

- Dst Port

- Pkt Len (packet length)

- Actions (determining acceptance/detection of packets, etc.)

In this way, the embodiment of the present invention visualizes and displays the Sankey diagram and the improved parallel coordinate diagram. Also, the two diagrams are displayed on one dashboard.

4 is a diagram illustrating a rapid network anomaly traffic detection dashboard using raw key and parallel coordinate visualization.

In Fig. 4, ① is a selection of a security event time range, ② is a screen display type selection, ③ is an index selection: a security equipment selection, ④ is a screen display criterion: selects the number of source-destination IP pairs to be displayed on the screen, ⑤ is a source IP selection : External, internal, all IP band selection, ⑥ Target IP selection: External, internal, all IP band selection, ⑦ Search action: Allowed by security equipment, blocking status, ⑧ Search source IP, ⑨ Search destination IP, ⑩ indicates port range-start, ⑪ indicates port range-end, ⑫ indicates sankey diagram, and ⑬ indicates parallel coordinate diagram.

As shown in Fig. 4, the dashboard displays the search source IP, search destination IP, search action, target IP and source IP selection range (internal, external, full), display criteria, search time range selection, port range ( It can be configured to enable real-time anomaly traffic detection based on various input information for start and end). In some examples, when a real-time detection situation is to be detected in more detail, information on a specific IP and a specific port is input so that abnormal traffic information can be quickly detected and analyzed.

In this way, the embodiment of the present invention makes it possible to quickly detect abnormal traffic from numerous security events of heterogeneous security equipment when operating a small-scale security control manpower in an environment in which a large number of information protection systems are operated. For example, in the prior art, a network attack could be determined only when a specific pattern was matched on a parallel coordinate diagram with information provided by a network security event. As long as a specific pattern is not formed in the coordinate diagram, it is possible to quickly detect traffic. Accordingly, even with a small number of security control personnel, it is possible to quickly detect abnormal traffic among numerous security events. Moreover, it is possible to quickly detect abnormal traffic without increasing manpower during security control operation, and it is possible to reduce the security control operation cost.

What has been described above is only one embodiment for implementing the apparatus and method for rapid abnormal traffic detection using raw key and parallel coordinate security visualization according to the present invention, and the present invention is not limited to the above embodiment, and the following patent As claimed in the claims, without departing from the gist of the present invention, it will be said that the technical spirit of the present invention exists to the extent that various modifications can be made by anyone with ordinary knowledge in the field to which the invention pertains.

Claims (8)

a security device that collects anomalous traffic from the Internet and intranets;
a computer device that receives the event log from the security device and visualizes it as a dashboard having a raw key diagram and a parallel coordinate diagram at the same time; and
A display device for displaying a dashboard having a raw key diagram and a parallel coordinate diagram;
The raw key diagram visualized by the computer device includes source IP, destination IP, number of detection events and network traffic volume,
Parallel coordinate diagram visualized by computer device includes source IP, destination IP, destination port, packet size and action (determining allow/detection of packets),
The dashboard includes the security event time range selection area, screen display type selection area, index selection area (security equipment selection area), screen display standard area (selection area for the number of source-destination IP pairs to be displayed on the screen), source IP selection area ( External, internal, all IP band selection area), target IP selection area (external, internal, all IP band selection area), search action area (allowed by security equipment, blocked status area), search source IP area, search destination IP area , Anomaly traffic detection device that provides a specific port, a specific IP, and an action (permission/detection determination of a packet) in a searchable manner by providing a port range-start area and a port range-end area. delete delete delete collecting anomalous traffic from the Internet and intranets by the secure device;
receiving the event log from the secure device by the computer device and visualizing it as a dashboard having a raw key diagram and a parallel coordinate diagram at the same time; and
Displaying a dashboard having a raw key diagram and a parallel coordinate diagram by a display device,
The raw key diagram visualized by the computer device includes source IP, destination IP, number of detection events and network traffic volume,
Parallel coordinate diagram visualized by computer device includes source IP, destination IP, destination port, packet size and action (determining allow/detection of packets),
The dashboard includes the security event time range selection area, screen display type selection area, index selection area (security equipment selection area), screen display standard area (selection area for the number of source-destination IP pairs to be displayed on the screen), source IP selection area ( External, internal, all IP band selection area), target IP selection area (external, internal, all IP band selection area), search action area (allowed by security equipment, blocked status area), search source IP area, search destination IP area , anomaly traffic detection method that provides a specific port, a specific IP, and an action (permission/detection determination of a packet) to be searchable by providing a port range-start zone and a port range-end zone. delete delete delete

Images