KR102678970B1 - Cyber Threat Detection Device and Method thereof based on Security Risk Score and Parallel Coordinates Visualization - Google Patents

Abstract

This disclosure provides a cyber threat detection device and method based on security risk index and parallel coordinate visualization. As an example, the present disclosure includes a plurality of heterogeneous security devices that collect abnormal traffic from the Internet and intranet; A computer device that receives event logs from multiple heterogeneous security devices and visualizes them in a dashboard with simultaneous security risk and parallel coordinate diagrams; and a display device that displays a dashboard with security risk and parallel coordinate diagrams.

Description

Cyber Threat Detection Device and Method its based on Security Risk Score and Parallel Coordinates Visualization}

This disclosure relates to a cyber threat detection device and method based on security risk index and parallel coordinate visualization.

Security control work involves detecting, analyzing, and responding to cyber threat events from security events occurring in various information protection systems. In security control activities, it is very important to select threat events and respond quickly.

However, unlike the past, the current corporate network environment is becoming increasingly large-scale and complex. The traffic generated from one security device per day can reach tens to hundreds of gigabytes. It is not easy to detect abnormal information by individually analyzing text logs from firewalls, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), etc.

Analysis systems must be automated to enable analysts to analyze networks quickly and efficiently. Additionally, analysts must be fully aware of key network scenarios. However, for this, tools to help with analysis are essential. This tool helps you quickly detect anomalous traffic from a vast array of events from security devices. Information visualization presents an efficient analysis method for high-dimensional data. This is because the human brain has a better ability to process images than text. In particular, security visualization is very helpful in intuitively identifying threat events among large amounts of security data.

The above-described information disclosed in the background technology of this invention is only for improving understanding of the background of the present invention, and therefore may include information that does not constitute prior art.

The problem to be solved by this disclosure is to select events based on security risk index with security events occurring in numerous heterogeneous devices and to quickly detect cyber threat traffic using parallel coordinate visualization. The goal is to provide a visualization-based cyber threat detection device and method.

An exemplary security risk index and parallel coordinate visualization-based cyber threat detection device according to the present disclosure includes a plurality of heterogeneous security devices that collect abnormal traffic from the Internet and intranet; A computer device that receives event logs from multiple heterogeneous security devices and visualizes them in a dashboard with simultaneous security risk and parallel coordinate diagrams; and a display device that displays a dashboard with a security risk level and a parallel coordinate diagram.

In some examples, the multiple heterogeneous security devices may include a firewall device, a Distributed Denial of Service (DDoS) blocking device, a Web Application Fire Wall (WAF) device, and an Intrusion Prevention System (IPS) device.

In some examples, the computer device may select event logs received from a plurality of heterogeneous security devices by scoring a security risk by substituting a predetermined security risk index for each of the plurality of heterogeneous security devices.

In some examples, a computer device is defined as being at low risk if it has a screened security risk score of 10 to 29, visualized on the dashboard as green, and if it has a screened security risk score of 30 to 49, it is defined as being at medium risk and displayed in yellow. It can be visualized on the dashboard, and if the selected security risk score is higher than 50 points, it can be defined as high risk and visualized on the dashboard in red.

In some examples, the computer device may visualize in a dashboard the threat IP address, detection history corresponding to the detection event name per security device, security risk score per event, and name of the security device that performed the detection.

In some examples, a computer device can be visualized in parallel coordinates on a dashboard with a source IP, destination port, destination IP, action corresponding to grant or deny, and detected security device name.

An exemplary security risk index and parallel coordinate visualization-based cyber threat detection method according to the present disclosure includes collecting abnormal traffic from the Internet and intranet by a plurality of heterogeneous security devices; Receiving event logs from a plurality of heterogeneous security devices by a computer device and visualizing them into a dashboard having simultaneously a security risk level and a parallel coordinate diagram; and displaying a dashboard with the security risk level and the parallel coordinate diagram by a display device.

This disclosure is a cyber threat detection device based on security risk index and parallel coordinate visualization that can select events based on security risk index with security events occurring from numerous heterogeneous devices and quickly detect cyber threat traffic using parallel coordinate visualization. and the method thereof are provided.

In particular, this disclosure makes it possible to supplement threat screening and initial response, which depended on human resources, through intuitive visualization in security control activities to protect information assets from ever-increasing cyber threats.

In other words, in general, abnormal behavior was determined using security events and Sankey & Parallel Coordinates visualization, but screening according to risk and recent heterogeneous environments were not suitable. Therefore, in this disclosure, screening according to risk and where to identify abnormal behavior were not suitable. Provides a device and method suitable for security control by adding a factor that can confirm whether it has been detected.

Through this, when performing security control, response events can be selected according to risk level, and quick response and judgment are possible through intuitive visualization.

Figure 1 is a diagram illustrating the concept of rapid network abnormal traffic detection using Sankey & Parallel Coordinates visualization.
FIG. 2 is a diagram illustrating the concept of a security risk index-based dashboard and process. FIG. 2A is a diagram illustrating a security risk index-based dashboard, and FIG. 2B is a diagram illustrating a security risk index calculation process.
Figure 3 is a diagram showing a cyber threat detection dashboard based on security risk index and parallel coordinate visualization.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the attached drawings.

The embodiments of the present invention are provided to more completely explain the present invention to those skilled in the art, and the following examples may be modified into various other forms, and the scope of the present invention is as follows. It is not limited to the examples. Rather, these embodiments are provided to make the disclosure more faithful and complete, and to fully convey the spirit of the invention to those skilled in the art.

Additionally, the device and/or other related devices or components according to the present invention may be implemented using any suitable hardware, firmware (e.g., custom semiconductor), software, or an appropriate combination of software, firmware, and hardware. For example, the various components of the device and/or other related devices or components according to the present invention may be formed on one integrated circuit chip or on separate integrated circuit chips. Additionally, the various components of the device may be implemented on a flexible printed circuit film, formed on a tape carrier package, a printed circuit board, or the same substrate as the device. Additionally, the various components of the device may, in one or more computing devices, be processes or threads running on one or more processors, which execute computer program instructions and other components to perform various functions mentioned below. You can interact with elements. Computer program instructions are stored in memory that can be executed on a computing device using standard memory devices, such as random access memory. Computer program instructions may also be stored on other non-transitory computer readable media, such as, for example, a CD-ROM, flash drive, etc. Additionally, those skilled in the art will understand that the functions of various computing devices can be combined with each other, integrated into a single computing device, or the functions of a particular computing device can be combined with one or more other computing devices without departing from the exemplary embodiments of the present invention. It must be recognized that it can be dispersed throughout the field.

For example, the device according to the present invention is a typical commercial computer consisting of a central processing unit, a mass storage device such as a hard disk or solid state disk, a volatile memory device, an input device such as a keyboard or mouse, and an output device such as a monitor or printer. can be operated in

Figure 1 is a diagram illustrating the concept of rapid network abnormal traffic detection using Sankey & Parallel Coordinates visualization.

As shown in Figure 1, Ki-Hoon Han presented a technology to quickly detect abnormal traffic through events from security devices in the paper “FDANT-PCSV: Rapid Abnormal Traffic Detection Using Parallel Coordinates and Sankey Visualization 2020)”.

As shown in Figure 1, a Sankey diagram is generally used to calculate the number of detection events and traffic volume among security events, and a parallel coordinates diagram is created using 5 factors (5-tuple). was used to detect various abnormal behaviors and attacks such as routing errors and slow port scans.

However, due to the nature of security control performed by personnel, all events and visualizations cannot be confirmed, and response by event selection is necessary depending on the degree of risk.

Additionally, with the recent increase in information systems, a variety of heterogeneous security devices are being introduced in most corporate environments to protect information assets. The technology shown in Figure 1 does not show where an event occurred and is not efficient because it requires several steps to use in a heterogeneous environment.

In other words, abnormal traffic was identified using the Sankey Diagram and Parallel Coordinates patterns, but it was not possible to select threat events that could be used during security control and discern the level of risk.

To put it another way, it was not suitable for use in a heterogeneous security device environment because it used five factors (Source IP, Destination IP, Destination Port, Packet Length, Action) among security events and could not show where it occurred.

Accordingly, in this disclosure, a security risk index was added to select the risk level, and the risk level was classified into high, medium, and low based on the index. That is, the present disclosure provides a cyber threat detection device and method based on security risk index and parallel coordinate visualization as a solution to this problem.

Specifically, in this disclosure, by using five device factors (Source IP, Destination IP, Destination Port, Action, Device) instead of the underutilized Packet Length factor, it is possible to determine where the event occurred. Able to know. It greatly helps in rapid response by identifying the detection location in the security environment according to the current information system.

For example, in this disclosure, cyber threat events can be quickly selected during security control by classifying the risk level into color (red, yellow, green) and stage (high, medium, low) using the security risk index.

In addition, the present disclosure improves the efficiency of security control in the recent heterogeneous device environment by adding a device factor that allows you to know where the detection occurred in parallel coordinates.

FIG. 2 is a diagram illustrating the concept of a security risk index-based dashboard and process. FIG. 2A is a diagram illustrating a security risk index-based dashboard, FIG. 2B is a diagram illustrating a security risk index calculation process, and FIG. 3 is a diagram showing a cyber threat detection dashboard based on security risk index and parallel coordinate visualization.

For example, a cyber threat detection device based on security risk index and parallel coordinate visualization according to the present disclosure may include a plurality of heterogeneous security devices, computer devices, and display devices.

Multiple heterogeneous security devices can collect abnormal traffic from the Internet and intranet. In some examples, the multiple heterogeneous security devices may include a firewall device, a Distributed Denial of Service (DDoS) blocking device, a Web Application Fire Wall (WAF) device, and/or an Intrusion Prevention System (IPS) device.

A computer device can receive event logs from multiple heterogeneous security devices and visualize them in a dashboard with simultaneous security risk and parallel coordinate diagrams.

The display device can display a dashboard with the above-described security risk and parallel coordinate diagram.

In some examples, the computer device may select event logs received from a plurality of heterogeneous security devices by scoring a security risk by substituting a predetermined security risk index for each of the plurality of heterogeneous security devices.

In some examples, a computer device can select threat IPs and visualize them on a dashboard by classifying risk levels based on a security risk index using data from the security device.

In some instances, risk levels can be categorized as high (red), medium (yellow), or low (green) to allow for rapid screening.

In some examples, the security risk score uses events from four security devices to give each score, for example:

- Firewall device (TOP 100 blocked IPs per day): score 3 points

- DDOS blocking device (TOP 100 blocked IPs by person): score 4 points

- WAF device (when blocking risk level events): score 5 points

- WAF device (when blocking a normal level event): score 5 points

- WAF device (when blocking low-level events): score 5 points

- IPS device (when blocking critical level events): score 5 points

- IPS device (when blocking high-level events): score 4 points

- IPS (when blocking device Medium level events): score 3 points

- IPS (when blocking low-level events): score 2 points

- IPS (when blocking a Very Low level event): 1 point

In some examples, a computer device is defined as being at low risk if it has a screened security risk score of 10 to 29, visualized on the dashboard as green, and if it has a screened security risk score of 30 to 49, it is defined as being at medium risk and displayed in yellow. It can be visualized on the dashboard, and if the selected security risk score is higher than 50 points, it can be defined as high risk and visualized on the dashboard in red.

In other words, the risk level can be calculated and the color determined using events and scores. For example, it could be as follows.

- High risk (over 50 points): red

- Medium risk (30 to 50 points): Yellow

- Low risk (10 to 30 points): Green

In some examples, the computer device may visualize in a dashboard the threat IP address, detection history corresponding to the detection event name per security device, security risk score per event, and/or name of the security device that performed the detection.

In some examples, a computer device may be visualized in parallel coordinates on a dashboard using a source IP, destination port, destination IP, action corresponding to grant or deny, and/or detected security device name.

For example, as shown in Figure 3, the dashboard provided based on the security risk index and parallel coordinate visualization distinguishes the risk level into high, medium, and low based on the security risk index so that security control personnel can intuitively understand it. It can be configured to show the threat IP, detection content (detection event name for each security device), security risk score for each event, and information on detected devices at the bottom of the dashboard, allowing you to identify the cause of the increased risk. It has been done.

In addition, based on the threat IP, five factors (source IP, destination port, destination IP, action (permit or deny), security device) were used and standardized into parallel coordinate visualization to enable early response to cyber threats. .

In this way, this disclosure makes it possible to supplement threat screening and initial response, which depended on human resources, through intuitive visualization in security control activities to protect information assets from ever-increasing cyber threats.

In other words, in general, abnormal behavior was determined using security events and raw keys and parallel coordinate visualization, but it was not suitable for screening according to risk and recent heterogeneous environments. Therefore, in this disclosure, screening according to risk and confirming where it was detected was performed. By adding factors, devices and methods suitable for security control are provided.

Through this, when performing security control, priority response events can be selected according to risk, and quick response and judgment are possible through intuitive visualization.

A cyber threat detection method based on security risk index and parallel coordinate visualization according to the present disclosure includes collecting abnormal traffic from the Internet and intranet by a plurality of heterogeneous security devices, and receiving event logs from a plurality of heterogeneous security devices by a computer device. This may include a step of visualizing a dashboard having both a security risk and a parallel coordinate diagram, and a step of displaying the dashboard having the security risk and a parallel coordinate diagram by a display device.

What has been described above is only one embodiment for implementing the exemplary security risk index and parallel coordinate visualization-based cyber threat detection device and method according to the present disclosure, and the present invention is not limited to the above-described embodiments. As claimed in the patent claims, it will be said that the technical spirit of the present invention exists to the extent that anyone skilled in the art can make various changes and implementations without departing from the gist of the present invention.

Claims (12)

Multiple heterogeneous security devices that collect abnormal traffic from the Internet and intranet;
A computer device that receives event logs from multiple heterogeneous security devices and visualizes them in a dashboard with simultaneous security risk and parallel coordinate diagrams; and
a display device that displays a dashboard with a security risk level and a parallel coordinate diagram;
The computer device is selected by scoring the security risk by substituting the event logs received from multiple heterogeneous security devices into the security risk index predetermined for each multiple heterogeneous security devices,
If the selected security risk score is 10 to 29 points, the computer device is defined as low risk and visualized on the dashboard in green, and if the selected security risk score is 30 to 49 points, it is defined as medium risk and displayed in yellow on the dashboard. If the selected security risk score is higher than 50 points, it is defined as high risk and visualized in red on the dashboard.
The computer device visualizes the threat IP address, detection history corresponding to the detection event name for each security device, security risk score for each event, and the name of the security device that performed the detection on the dashboard.
A cyber threat detection device that visualizes computer devices in parallel coordinates on a dashboard using source IP, destination port, destination IP, action corresponding to permission or denial, and detected security device name. According to claim 1,
A number of heterogeneous security devices include cyber threat detection devices, including firewall devices, Distributed Denial of Service (DDoS) blocking devices, Web Application Fire Wall (WAF) devices, and Intrusion Prevention System (IPS) devices. delete delete delete delete Collecting abnormal traffic from the Internet and intranet by a plurality of heterogeneous security devices;
Receiving event logs from a plurality of heterogeneous security devices by a computer device and visualizing them into a dashboard having simultaneously a security risk level and a parallel coordinate diagram; and
comprising displaying a dashboard with a security risk level and a parallel coordinate diagram by a display device;
The computer device is selected by scoring the security risk by substituting the event logs received from multiple heterogeneous security devices into the security risk index predetermined for each multiple heterogeneous security devices,
If the selected security risk score is 10 to 29 points, the computer device is defined as low risk and visualized on the dashboard in green, and if the selected security risk score is 30 to 49 points, it is defined as medium risk and displayed in yellow on the dashboard. If the selected security risk score is higher than 50 points, it is defined as high risk and visualized in red on the dashboard.
The computer device visualizes the threat IP address, detection history corresponding to the detection event name for each security device, security risk score for each event, and the name of the security device that performed the detection on the dashboard.
A cyber threat detection method in which computer devices are visualized in parallel coordinates on a dashboard using source IP, destination port, destination IP, action corresponding to permission or denial, and detected security device name. According to claim 7,
A method for detecting cyber threats, where multiple heterogeneous security devices include firewall devices, Distributed Denial of Service (DDoS) blocking devices, Web Application Fire Wall (WAF) devices, and Intrusion Prevention System (IPS) devices.

delete delete delete delete