KR102580835B1 - Security policy automation management system - Google Patents

Abstract

The present invention relates to a security policy automation management system. More specifically, a security policy that generates natural language-based question-and-answer information for each security policy and uses this to respond to the security policy design process through a chatbot conversation service. It is about automated management system. To this end, the security policy automation management system collects the log data, the security policy, and the traffic status of the target network equipment, and generates question-and-response information for each security policy through natural language generation (NLG); As a chatbot conversation service that uses question-and-answer information for each security policy is provided to employee terminals, an input unit receives a question request sentence, and the question request sentence is converted and processed through natural language understanding (NLU) based on the contextual information obtained. , a decision unit that determines one question-response information among the question-response information for each security policy, and an integrated management unit that feeds back the corresponding response information extracted from the one question-response information to the employee terminal through the chatbot conversation service. Includes.

Description

Security policy automation management system {SECURITY POLICY AUTOMATION MANAGEMENT SYSTEM}

The present invention relates to a security policy automation management system. More specifically, a security policy that generates natural language-based question-and-answer information for each security policy and uses this to respond to the security policy design process through a chatbot conversation service. It is about automated management system.

Recently, in the information age, information sharing and ease of access to information have been emphasized, but the importance of information security is increasing to prevent leakage of core technical documents and personal information data.

Security is intended to protect core technical documents and personal information that must not be leaked from within the company to the outside. For information security, data leak prevention (DLP) solutions, digital rights management (Digital Rights Management) It uses document security solutions, personal information protection solutions, and output control solutions using (DRM), protects internal information by separating the intranet, which is an internal business network, and the Internet network, which is an external network, and protects against intrusions from external networks through a network connection system. Internal information is protected by protecting the internal network and communicating with the external network to prevent disruption to business.

On the other hand, when personnel changes such as joining, leaving, promotion, or transfer of position occur, or when a new application is introduced or a compliance issue occurs, the security policy is changed. Typically, it is written in a handwritten document or groupware. Since you apply for a security policy change through (Group Ware), a problem arises where general tasks and usage rights are mixed within the application.

In addition, because it is too difficult for employees who are not in charge of permissions to fill out the application for permission to use, errors frequently occur when filling out the application for permission to use, which not only reduces work efficiency but also increases work load.

The present invention is to solve the above problems. The purpose of the present invention is to generate question-and-answer information for each security policy based on natural language, and to use this to respond to the design process for security policy through a chatbot conversation service. It is intended to provide an automated security policy management system.

The above and other objects and advantages of the present invention will become apparent from the following description of preferred embodiments.

In order to achieve the above object, a security policy automation management system that establishes a security policy according to log data monitored from a target network device and manages the device according to an embodiment of the present invention includes the log data, the security policy, and A generation unit that collects the traffic status of the target network equipment and generates question-and-answer information for each security policy through natural language generation (NLG), and provides a chatbot conversation service using the question-and-answer information for each security policy to employee terminals. An input unit that receives a query request sentence according to the above, and one of the question-and-answer information for each security policy based on the context information obtained by converting and processing the query request sentence through natural language understanding (NLU). It includes a decision unit that makes a decision and an integrated management unit that feeds back corresponding response information extracted from the single question-and-answer information to the employee terminal through the chatbot conversation service.

In an embodiment, when a new application for a security policy is confirmed from the context information, the integrated management unit serves a security policy application for creating a security policy for application through a chatbot conversation service, through the security policy application. Based on the input keyword, a recommendation unit that searches for and recommends one policy design template among a plurality of preset policy design templates, and a verification result output by simulating the application security policy through a preset diagnosis page. Based on this, it includes a diagnosis unit that diagnoses suitability for the security policy application.

In an embodiment, the service department responds to the input information for each item of the security policy application inputted from the employee terminal, and sequentially services step-by-step work screens through a chatbot conversation service, and the step-by-step work screens are provided by the operator. This refers to screens captured sequentially while designing a security policy.

In an embodiment, the service unit identifies a duplicate target screen based on a preset number of identical screen objects duplicated from each of the step-by-step work screens, and deletes the step-by-step task from which the duplicate target screen is removed. As the screens are cut and edited by time, a work guide video is created and served to the employee terminal.

In an embodiment, the integrated management unit selectively activates the approval process for the security policy application when the security policy application is diagnosed as compliant, and the approval management unit receives an approval signal from the administrator terminal, and responds to the approval signal. In response, an information detection unit detects automated input information corresponding to an input keyword input through the security policy application form from the policy design template, and a preset firewall state of the network topology map confirmed through the target network equipment. It further includes a synchronization unit that applies the automation input information to the target network device based on the identified synchronization point.

In an embodiment, when the payment management unit determines that the security policy application is not compliant, it sends a notification message to the employee terminal to modify the security policy application.

In an embodiment, the service unit includes a collection unit that collects log data for each security policy and firewall maintenance time for each log data in advance, and a machine that inputs the log data for each security policy and outputs the firewall maintenance time for each log data. As it learns through learning, the modeling unit models the artificial intelligence-based firewall maintenance time output model and applies each log data monitored through the target network equipment to the firewall maintenance time output model according to the application security policy. It includes a task management unit that controls in detail the firewall task schedule for the target network device based on the output firewall maintenance time.

In an embodiment, the design further includes a design unit that designs an automated security policy solution for the target network equipment based on the log data, wherein the design unit includes a collection module that collects the log data in real time, and the log data. A preprocessing module that preprocesses through a set conversion process, an extraction module that extracts a data set from the preprocessed data by applying a preset rule set, a partition module that partitions the data set into a plurality of group data according to a preset partitioning parameter, It includes a clustering module that clusters and processes each group data according to preset clustering parameters, and a solution management module that derives the automated security policy solution by applying a preset policy derivation algorithm to each group data clustered.

According to an embodiment of the present invention, it supports designing security policies more easily by responding to the security policy design process through a chatbot conversation service that uses natural language-based question-and-answer information for each security policy.

FIG. 1A is a diagram schematically showing an automated security policy management system 1000 according to an embodiment of the present invention, and FIG. 1B is a block diagram specifically showing the automated security policy management system 1000 of FIG. 1A.
FIG. 2 is a block diagram showing an embodiment of the integrated management unit 400 of FIG. 1.
Figure 3 is an example of a security policy application.
Figures 4a to 4c show examples of step-by-step work screens.
Figures 5a and 5b illustrate embodiments for explaining an integrated management page.
Figure 6 shows an example of verification results.
Figure 7 is a block diagram showing another embodiment of the integrated management unit 400_1 of Figure 1.
FIG. 8 is a block diagram showing an embodiment of the service unit 410 of FIG. 1.
Figure 9 is a diagram schematically showing a security policy automation management system (1000_1) according to another embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to embodiments of the present invention and drawings. These examples are merely presented as examples to explain the present invention in more detail, and it will be apparent to those skilled in the art that the scope of the present invention is not limited by these examples. .

Additionally, unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as commonly understood by a person skilled in the art to which the present invention pertains, and in case of conflict, this specification including definitions The description will take precedence.

In order to clearly explain the proposed invention in the drawings, parts unrelated to the description have been omitted, and similar reference numerals have been assigned to similar parts throughout the specification. And, when it is said that a part "includes" a certain component, this means that it does not exclude other components, but may further include other components, unless specifically stated to the contrary. Additionally, “unit” as used in the specification refers to a unit or block that performs a specific function.

Collection codes (1st, 2nd, etc.) for each step are used for convenience of explanation. The collection codes do not explain the order of each step, and each step does not clearly state a specific order in context. It may be carried out differently from the order specified above. That is, each step may be performed in the same order as specified, may be performed substantially simultaneously, or may be performed in the opposite order.

FIG. 1A is a diagram schematically showing an automated security policy management system 1000 according to an embodiment of the present invention, and FIG. 1B is a block diagram specifically showing the automated security policy management system 1000 of FIG. 1A.

1A and 1B, the security policy automation management system 1000 can manage the target network device 10 by establishing a security policy according to log data monitored from the target network device 10.

Here, the target network equipment 10 is a network device that is individually connected to a plurality of PC devices (11_1 to 11_N, 12_1 to 12_N) through each network and monitors and controls the connection between each PC device and the external network. You can.

At this time, the security policy may refer to a policy for selectively granting access to and blocking access to an external network for a plurality of PC devices (11_1 to 11_N, 12_1 to 12_N) through the target network equipment (10).

This security policy automation management system (1000) includes a policy application automation container (NxPylon), an orchestration engine & Playbook, and a policy design template, and uses this to design a security policy within working hours and limit restrictions on the firewall API and CLI. can respond and automatically design security policies.

Specifically, the security policy automation management system 1000 may include a creation unit 100, an input unit 200, a decision unit 300, and an integrated management unit 400.

First, the generator 100 learns the log data, security policy, and traffic status of the target network device 10, and converts them through natural language generation (NLG) to generate question-and-response information for each security policy. there is.

Here, the question-and-answer information for each security policy may include a plurality of keywords extracted from the security policy and data classified from log data and traffic status according to each keyword.

Next, the input unit 200 provides the employee terminal 20 with a chatbot conversation service that uses question-and-answer information for each security policy, so that a question request sentence regarding the security policy can be input.

Next, the decision unit 300 can determine one of the question-and-answer information for each security policy based on the context information obtained by converting and processing the question request sentence through natural language understanding (NLU). .

Specifically, the decision unit 300 may select one keyword from a plurality of keywords based on the context information and determine one question-and-answer information corresponding to one keyword among the question-and-answer information for each security policy. .

Next, the integrated management unit 400 can feed back the response information extracted from one question-answer information determined through the decision unit 300 to the employee terminal 20 through the chatbot conversation service.

According to one embodiment, when a request for security policy supplementation is confirmed from the context information obtained through the decision unit 300, the integrated management unit 400 corresponds to the traffic status among the plurality of security policy histories already collected, Recommendations can be made in order of number of security incidents.

According to another embodiment, the integrated management unit 400 deactivates the chatbot conversation service for a certain period of time based on the user's breathing and heart rate signals transmitted through the chatbot conversation service from a radar sensor (not shown) provided in the employee terminal 20. You can do it.

According to another embodiment, the integrated management unit 400 adjusts the response information by comprehension difficulty level and registers it in advance in the storage DB 1100, and confirms the response information through a camera (not shown) provided in the employee terminal 20. Based on the degree of asymmetry of the user's face object, the level of difficulty in understanding the response information can be adjusted.

Hereinafter, the configuration of the present invention and its effects will be described in more detail through specific examples and comparative examples. However, these examples are for illustrating the present invention in more detail, and the scope of the present invention is not limited to these examples.

FIG. 2 is a block diagram showing an embodiment of the integrated management unit 400 of FIG. 1B, FIG. 3 is an embodiment of a security policy application, FIGS. 4A to 4C are an embodiment of step-by-step work screens, and FIG. Figures 5a and 5b are examples for explaining the integrated management page, and Figure 6 is an example of the verification results.

1A to 6 , the integrated management unit 400 may include a service unit 410, a recommendation unit 420, and a diagnosis unit 430.

First, when a new application for a security policy is confirmed from the context information obtained through the decision department 300, the service department 410 sends the security policy application and the suitability diagnosis results for the application to the employee terminal (20) through a chatbot conversation service. ) can be serviced.

Here, the security policy application can temporarily create a security policy for application based on input information for each application policy item, as shown in FIG. 3.

According to one embodiment, the service unit 410 may respond to input information for each item of the security policy application form input from the employee terminal 20 and provide step-by-step work screens through a chatbot conversation service.

Here, step-by-step work screens may refer to guide screens captured sequentially while the operator designs one security policy.

For example, step-by-step work screens include, as shown in FIGS. 4A to 4C, a reception policy optimization progress screen, a work target firewall selection step screen, an object configuration step screen, a policy analysis step screen, a design verification step screen, and a work schedule. Can include setup step screen.

At this time, the service unit 410 can delete the screen by identifying it as a duplicate target screen based on the preset number of identical screen objects that are repeatedly detected from each of the step-by-step work screens.

In addition, the service unit 410 may generate a work guide video by cutting and editing step-by-step work screens from which duplicate target screens have been deleted by time, and may serve this to the employee terminal 20.

According to another embodiment, the service unit 410 may sequentially service step-by-step work screens through a chatbot conversation service, based on the capturing time difference confirmed from the step-by-step work screens.

Next, the recommendation unit 420 searches for one policy design template among a plurality of preset policy design templates based on the input keyword input through the security policy application form from the employee terminal 20 and displays the employee terminal 20. ) can be recommended.

Here, the policy design template is a page listing security policies, as shown in Figure 5a, and each security policy can be searched and searched for application, approval, design, application, and verification tasks as shown in Figure 5b. It may be an integrated management page.

Next, the diagnosis unit 430 diagnoses suitability for the security policy application based on the verification results output as the security policy for application is simulated through a preset diagnosis page and serves it to the employee terminal 20. You can.

Here, the verification result may be a graph visualized by estimating various analysis states for the target network device 10 according to the security policy for application, as shown in FIG. 6.

FIG. 7 is a block diagram showing another embodiment of the integrated management unit 400_1 of FIG. 2.

1A to 7, the integrated management unit 400_1 includes a service unit 410, a recommendation unit 420, a diagnosis unit 430, an approval management unit 440, an information detection unit 450, and a synchronization unit ( 460). Hereinafter, duplicate descriptions of the service unit 410, recommendation unit 420, and diagnosis unit 430 of the same number as described in FIG. 6 will be omitted.

First, when the security policy application is diagnosed as compliant, the approval management unit 440 can receive an approval signal from the manager terminal 21 by selectively activating the approval process for the security policy application.

For example, the employee terminal 20 refers to a terminal owned by an employee belonging to a company network connected through the target network equipment 10, and the manager terminal 21 refers to a terminal owned by the manager who manages the company network. It can mean.

Additionally, if the security policy application is diagnosed as non-compliant, the payment management unit 440 may send a notification message to the employee terminal 20 to modify the security policy application.

Next, the information detection unit 450 may detect automated input information corresponding to the input keyword input through the security policy application form from any one policy design template in response to the approval signal.

Here, the automated input information may be input data for automatic firewall determination, object analysis, and design for applying security policies.

Next, the synchronization unit 460 applies a security policy for application according to the automated input information to the target network device based on the synchronization point identified according to the preset firewall state of the network topology map confirmed through the target network device 10. It can be applied to (10).

Depending on the embodiment, the synchronization unit 460 may transmit a notification message suggesting whether to extend the deadline to the manager terminal 21 based on the scheduling deadline set in the application security policy.

FIG. 8 is a block diagram showing an embodiment of the service unit 410 of FIG. 2.

1A to 8 , the service unit 410 may include a capturing unit 411, a guide generation unit 412, and a work management unit 413.

First, the collection unit 411 may collect log data for each security policy and firewall maintenance time for each log data in advance and store them in the storage DB 1100.

Next, the modeling unit 412 can model an artificial intelligence-based firewall maintenance time output model by learning through machine learning that uses log data for each security policy as input and firewall maintenance time for each log data as output. .

Here, the artificial intelligence-based firewall maintenance time output model is an algorithm that can estimate the firewall maintenance time by receiving log data monitored from target network equipment, including artificial neural network, SVM (Support Vector Machine), It may be one of Decision Tree and Random Forest algorithms.

For example, artificial neural networks are mainly used in deep learning, are statistical learning algorithms inspired by machine learning and neural networks in biology, and can be convolutional neural networks that include feature extraction neural networks and classification neural networks. At this time, the convolutional neural network is a type of deep, feed-forward artificial neural network used to analyze visual images. It can be divided into the process of extracting image features and classifying classes, extracting and extracting features of a specific image, and Images can be recognized based on the features provided.

Next, the task management unit 413 applies each log data monitored through the target network device 10 according to the security policy for application to the firewall maintenance time output model, and calculates the target network device 10 based on the output firewall maintenance time. The firewall task schedule for (10) can be adjusted in detail.

Figure 9 is a diagram schematically showing a security policy automation management system (1000_1) according to another embodiment of the present invention.

When described with reference to FIG. 9 , the security policy automation management system 1000_1 may include a creation unit 100, an input unit 200, a decision unit 300, an integrated management unit 400, and a design unit 500. Hereinafter, duplicate descriptions of the generation unit 100, input unit 200, decision unit 300, and integrated management unit 400 of the same member number described in FIG. 1B will be omitted.

The design unit 500 of the present invention includes a collection module 510 and a preprocessing module 520 to design an automated security policy solution for the target network device 10 based on log data monitored from the target network device 10. ), extraction module 530, division module 540, clustering module 550, and solution management module 560.

Specifically, the collection module 510 can collect log data monitored from the target network device 10 in real time.

Next, the preprocessing module 520 may preprocess the log data collected through the collection module 510 through a preset conversion process. Here, the preset conversion process may include a parsing process that parses log data into traffic status graphics and a geotagging process that converts log data into a network topology map.

Next, the extraction module 530 can extract a dataset from the data preprocessed through the preprocessing module 520 by applying a preset rule set.

Next, the partition module 540 may partition the data set extracted through the extraction module 530 into a plurality of group data according to a preset partitioning parameter.

Next, the clustering module 550 can process each group data partitioned through the division module 540 into clusters according to preset clustering parameters.

Next, the solution management module 560 can derive an automated security policy solution by applying a preset policy derivation algorithm to each group data clustered through the clustering module 550.

Here, the preset policy derivation algorithm may refer to an algorithm that objectifies clustered data into range objects, class objects, and group objects.

At this time, the solution management module 560 can automatically apply the automated security policy solution to the target network device 10 based on the application approval signal that is fed back as it provides the automated security policy solution to the administrator terminal 21. .

In this specification, only a few examples of various embodiments implemented by the present inventors are described, but the technical idea of the present invention is not limited or limited thereto, and of course, it can be modified and implemented in various ways by those skilled in the art.

100: Generation unit
200: input unit
300: decision part
400: Integrated Management Department
500: Design Department
1000: Security policy automation management system

Claims (8)

It is an automated security policy management system that establishes a security policy based on log data monitored from target network equipment and manages the equipment.
a generator that collects the log data, the security policy, and the traffic status of the target network equipment and generates question-and-response information for each security policy through natural language generation (NLG);
An input unit that receives a question request sentence by providing a chatbot conversation service using the question-and-answer information for each security policy to an employee terminal;
a decision unit that determines one of the question-and-answer information for each security policy based on context information obtained by converting and processing the question request sentence through natural language understanding (NLU); and
An integrated management unit that feeds back corresponding response information extracted from the single question-and-answer information to the employee terminal through the chatbot conversation service,
The integrated management unit includes a service unit that serves a security policy application for creating a security policy for application through a chatbot conversation service when a new application for a security policy is confirmed from the context information;
a recommendation unit that searches for and recommends one policy design template among a plurality of preset policy design templates based on the input keyword input through the security policy application form; and
An automated security policy management system comprising a diagnosis unit that diagnoses suitability for the security policy application based on verification results output as the application security policy is simulated through a preset diagnosis page. delete According to paragraph 1,
The service department responds to the input information for each item of the security policy application form input from the employee terminal, and sequentially services step-by-step work screens through a chatbot conversation service,
The step-by-step work screens refer to screens captured sequentially while the operator designs one security policy. A security policy automation management system. According to paragraph 3,
The service unit identifies the screen as a duplicate target screen based on a preset number of identical screen objects detected duplicated from each of the step-by-step work screens and processes them for deletion,
A security policy automation management system that generates a work guide video and serves it to the employee terminal by cutting and editing the step-by-step work screens from which the duplicate target screens have been removed by time. According to paragraph 3,
The integrated management unit includes: an approval management unit that receives an approval signal from an administrator terminal by selectively activating an approval process for the security policy application when the security policy application is diagnosed as suitable;
an information detection unit that detects automated input information corresponding to an input keyword input through the security policy application form from the one policy design template in response to the approval signal; and
A security policy automation management system further comprising a synchronization unit that applies the automation input information to the target network device based on a synchronization point identified according to a preset firewall state of the network topology map confirmed through the target network device. According to clause 5,
The payment management unit is a security policy automation management system that sends a notification message to the employee terminal to modify the security policy application when the security policy application is diagnosed as non-compliant. According to paragraph 1,
The service unit includes a collection unit that collects log data for each security policy and firewall maintenance time for each log data in advance;
A modeling unit that models an artificial intelligence-based firewall maintenance time output model by learning through machine learning that inputs log data for each security policy and outputs firewall maintenance time for each log data; and
By applying each log data monitored through the target network device according to the application security policy to the firewall maintenance time output model, the firewall work schedule for the target network device is adjusted in detail based on the output firewall maintenance time. A security policy automation management system that includes a task management unit. According to paragraph 1,
Based on the log data, it further includes a design unit that designs an automated security policy solution for the target network device,
The design unit includes a collection module that collects the log data in real time;
A preprocessing module that preprocesses the log data through a preset conversion process;
An extraction module that extracts a data set from the preprocessed data by applying a preset rule set;
a partition module that partitions the data set into a plurality of group data according to preset partitioning parameters;
A clustering module that clusters each group data according to preset clustering parameters; and
An automated security policy management system comprising a solution management module that derives the automated security policy solution by applying a preset policy derivation algorithm to each of the clustered group data.