KR20030023048A - Method for real-time auditing a Network - Google Patents

Abstract

PURPOSE: A real-time security audit method is provided to analyze thousands of event log-in occurring every time, in an IDS(Intrusion Detection System), a firewall and a system connected by a user. CONSTITUTION: An intrusion detection event log group, a firewall event log group and a system event log group stored in a database are simultaneously displayed on a display part of a real-time analyzer(52). The first event log for security audio is selected from the displayed intrusion detection event log group, firewall event log group or system event log group(54). The second event log group to be connectively analyzed from event log groups excepting the first event log group is selected(56). A connective analysis condition for connectively analyzing the first event log and the second event log group is selected(58). The first event log and the second event log group are compared and analyzed based on the selected connective analysis condition, and the second event logs meeting the connective analysis condition are searched from the second event log group(60,62). And the searched second event logs are displayed on the display part of the real-time analyzer(66).

Description

{Method for real-time auditing a network}

The present invention relates to a method for auditing abnormal symptoms such as hacking in a network environment. In particular, the present invention analyzes an intrusion detection event log, an intrusion blocking event log, and a system event log in real time to identify an intrusion pattern, whether an intrusion is blocked, and allow an intrusion The present invention relates to a real-time security auditing method that enables a real-time analysis of future system usage in case of failure.

The Internet, a combination of the word International and the word Network, can be found in the ARPANET, which was established in 1969 with the support of the US Department of Defense to link four universities in the United States. It was initially introduced for military purposes, but recently, thanks to the wave of commercialization, millions of people around the world are using the Internet, based on e-mail, remote computer connections, file transfers (FTP), Usenet News, Internet Information Search (Gopher), Internet Conversation and Discussion (IRC), Bulletin Board (BBS), Hypertext Information View (WWW: World Wide Web), Online Games, Movies, or Voice Data in Real Time New services, such as broadcasting services and video conferencing, were developed and available in turn. As the commercialization of the Internet spreads rapidly, the whole world is connected to one Internet network, and the convenience of modern people's life by the Internet is increasing day by day. However, there are risk factors such as information leakage other than the convenience of modern people on the other side of the Internet, which can be easily disrupted and destroyed by criminals called hackers, information leakage, and illegal intrusion. Problems have arisen. In order to prevent such hacking, security solutions are being used to secure the security of network security by preventing unauthorized intrusion by insiders or outsiders in advance. Representative examples include intrusion detection system (IDS), intrusion prevention system (Fire Wall) and server security system.

Intrusion detection system is a system that collects packet information on network and detects illegal intrusion by referring to intrusion pattern DB and informs administrator. Firewall has intrusion prevention system between networks to prevent unauthorized intrusion. It is a system to block.

Even if security solutions such as intrusion detection system and intrusion prevention system are installed, these solutions only provide administrators with information to determine abnormal symptoms on the network. If so, the administrator should conduct a security audit afterwards to see what illegal activities have been done. However, intrusion detection system and intrusion prevention system have certain limitations for comprehensive audit due to the characteristics of the system. To overcome these limitations, each event log must be comprehensively analyzed.

Hereinafter, a conventional security audit method will be described for the convenience of understanding the present invention.

The event log of the intrusion detection system only records the source address, the destination address, and the pattern of the detected type, so the intrusion detection system alone can determine how the detected packet was processed later (access allowed). none. In addition, since the event log of the intrusion prevention system records only the information about the packet to be allowed and the packet to be rejected according to the defined rule, the intrusion prevention system has the limitation that it cannot detect the allowed packet by tricking the intrusion prevention system. And since the system's event log only records what program was used by which user, it has a limitation of not knowing whether the user is an allowed user. Therefore, comprehensive security auditing is essential to the process of linking these various event logs. This security audit analyzes the event log of intrusion detection system, analyzes patterns of detected types, and analyzes the event log of intrusion prevention system. Review how the type of pattern detected by the detection system was handled (allowed) by the intrusion prevention system, and if allowed, analyze the event log of the system the user accessed to review what happened. It goes through. In this way, the intrusion detection system and the intrusion prevention system provide only information for the administrator to determine whether the intrusion, etc., and the administrator uses various log analyzers or manually compares one by one to analyze various events. You will have a security audit. As a result of this situation, it is common to know whether an invasion has occurred after an invasion has occurred in general, so that the problem of intrusion detection system and intrusion prevention system has not been fulfilled. Nowadays, when tens of thousands of event logs are generated, the problem becomes more serious and efficient security audits are more urgently needed than ever before.

The present invention has been made to solve the above problems of the prior art, an object of the present invention is to record in real time the thousands to tens of thousands of event log generated every hour in an intrusion detection system, intrusion prevention system and the user connected system It is to provide a security audit method that can be analyzed.

1 is a block diagram of a system in which the real-time security audit method of the present invention is implemented.

2 is a flow chart of a real time security audit method of the present invention.

Figure 3 is a flow diagram of an embodiment implementing the real time security audit method of the present invention.

4 is a view showing an embodiment of implementing the real-time security audit method of the present invention, in which the intrusion tower event log group, the intrusion blocking event log group, and the system event log group are integrated into one screen.

5A to 5C illustrate a process of implementing the real-time security auditing method of the present invention, and in particular, a process of security auditing in association with an intrusion detection event log and an intrusion prevention event log group.

The present invention provides an intrusion detection system, an event log collector for collecting an intrusion detection event log, an intrusion prevention event log, and a system event log from an intrusion detection system, an intrusion prevention system, and a general system, respectively, and various event logs collected by the event log collector. It consists of a database for storing the event log group, intrusion prevention event log group and system event log group, and a real-time analyzer with a central processing unit for security audit in conjunction with the database and a display unit for displaying the result. A method for security auditing an abnormal symptom of a computer network in a security audit system, the method comprising: simultaneously displaying an intrusion detection event log group, an intrusion prevention event log group, and a system event log group stored in the database on a display unit of the real-time analyzer; Selecting a first event log to be audited from an intrusion detection event log group, an intrusion prevention event log group, or a system event log group displayed on a display unit of the real-time analyzer; and a group to which the first event log belongs. A third step of selecting a second event log group to be linked and analyzed from the excluded event log group, a fourth step of selecting a linked analysis condition to be linked and analyzed the first event log and the second event log group, and the fourth step; A fifth step of comparing and analyzing the first event log and the second event log group based on the linkage analysis condition selected in the step and searching for second event logs satisfying the linkage analysis condition from the second event log group; And a sixth step of displaying second event logs generated through five steps on the display unit of the real-time analyzer. Steps to sixth step relates to a real-time security audit method, characterized in that the real-time analysis of the security audit system proceeds in real time.

The association analysis condition of the fourth step is selected from the group consisting of time, starting address, destination address, intrusion detection system address and intrusion prevention system address.

The first event log may be selected from an intrusion detection event log group, and the second event log group may be an intrusion prevention event log group.

The first event log may be selected from an intrusion detection event log group, and the second event log group may be a system event log group.

The first event log may be selected from an intrusion prevention event log group, and the second event log group may be a system event log group.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the overall configuration of a system for performing a real-time security audit method of the present invention. As shown in Figure 1, the system for performing the real-time security audit method of the present invention is linked to the database and the database for storing the various event logs collected by the event log collector and the event log collector in real time to the various event logs It consists of a real-time analyzer to analyze.

The event log collector 20 collects log information of the intrusion detection system 12, the intrusion blocking system 14, and the system 16 connected to the user and records the log information in the database 30.

The database 30 records various event logs collected by the event log collector by group, and the event logs collected from the intrusion detection system 12 include a user's source address, a destination address, an access time, It contains information about the detected pattern and the address of the intrusion detection system, and the event log collected from the intrusion prevention system 12 includes the source address, the destination address, the access time, the packet acceptance and the address of the intrusion prevention system. The event log of the system 16 includes information about a source address, a destination address, a connection time, and a system usage history (use time, use program, etc.) after the connection.

The real-time analyzer 40 includes a well-known central processing unit for performing analysis on various event logs stored in the database 30, a memory unit, and a display unit for displaying a processing result. Real-time security auditing is performed on various event log information stored in 30. The security auditing method will be described below with reference to FIGS.

2 to 3 show a flow chart of the security audit method of the present invention.

The present invention provides an event log collector 20 for collecting an intrusion detection event log, an intrusion prevention event log, and a system event log from the intrusion detection system 12, the intrusion blocking system 14, and the general system 16, respectively, and the event. A database 30 for storing various event logs collected by the log collector 20 for each group, and a known central processing unit (CPU) for interworking with the database 30 to perform security audits. And a real-time analyzer 40 including a memory (not shown) and a real-time analyzer 40 having a display unit (not shown) for displaying a result thereof. Intrusion detection event log group, intrusion prevention event log group and system event log group A second step of selecting a first event log from a group of intrusion detection event log groups, intrusion prevention event log groups, or system event log groups displayed on the display unit of the real-time analyzer; Step (54, 93, 116), a third step (56, 95, 105, 117) of selecting a second event log group to be linked and analyzed from the event log group other than the first event log group; A fourth step (58, 96, 106, 118) of selecting a linkage analysis condition for linkage analysis of the event log group; and a first event log and a second event log based on the linkage analysis conditions selected in the fourth step; A fifth step (62, 64, 100, 110, 122) of comparing and analyzing the group and searching the second event logs satisfying the association analysis condition from the second event log group; and the second event generated through the fifth step Remind logs The sixth step (66, 104, 128, 126) to be displayed on the display unit of the real-time analyzer is performed in real time by the real-time analyzer of the security audit system.

In the first step, as shown in FIG. 4, the intrusion detection event log group 142, the intrusion prevention event log group 144, and the system event log group 140 are integrated on one screen by a known programming technique. It is implemented by being represented 52.

The second step is to select the first event log from the intrusion detection event log group, the intrusion prevention event log group, the system event log group, and the third step is the remaining two events except the event log group to which the first event log belongs A second event log group is selected from the log groups. The second or third step may vary depending on what the purpose of the security audit is (54, 56). As shown in FIG. 3, when an auditor wants to audit whether a user is allowed to access, a first event log is selected from an intrusion detection event log group (93), and a second event log group to be linked is an intrusion prevention event log group or a system event. Log group (95, 105), and the first event log is the intrusion event log group 116 when it is desired to audit system usage (e.g., how long and for what program use) after the connection is allowed. Alternatively, the intrusion detection event log group 93 may be selected, and the second event log group may be the system event log groups 95 and 117.

The fourth step is a step of selecting conditions for performing a cooperative analysis of the first event log and the second event log group selected in the second and third steps (58, 96, 106, 118, 152). The linkage analysis condition is a criterion for determining the scope of the security audit output to be provided to the administrator after linkage analysis of the first event log and the second event log group. The time, source address, destination address, and intrusion detection system 12 to The IP address of the intrusion prevention system 14 may be a criterion, and only one of them may be selected or a plurality may be selected (58, 146).

In the fifth step, the first event log and the second event log group are jointly analyzed based on the linkage analysis condition determined in the fourth step, and the second event log that satisfies the linkage analysis condition is searched from the second event log group. (62, 100, 110, 122)

The sixth step is a step of displaying the result of the linkage analysis according to the fifth step to the manager, which is embodied by displaying the result on the monitor screen of the manager (66, 104, 114, 126, 148).

Hereinafter, an actual implementation of auditing whether or not an intrusion attempt is permitted by a user by correlating and analyzing the first event log as the intrusion detection event log and the second event log group as the intrusion prevention event log group will be described with reference to FIGS. 4 and 5A. This will be described with reference to Fig. 5C.

4 shows an intrusion detection event log group 142, an intrusion prevention event log group 144, and a system event log group 140 integrated into one screen, and FIG. 5A shows an intrusion detection at the top of the screen. The event log group 142 shows a state in which the intrusion blocking event log group 144 is arranged at the bottom of the screen. The administrator first selects the first event log by clicking on the intrusion detection event log 142a to be audited in the intrusion detection event log group 142, selects the first event log and drags it to the intrusion prevention event group 144 to perform linkage analysis. Selecting the second event group 144 (see FIG. 5B), and as shown in FIG. 5B, the linkage analysis conditions [Date / Time (Time), Origin (IDS of IDS), Source (Source IP), and Destination (Destination Destination) IP)] window appears, specify the linkage analysis condition as 'time' to conduct security audits in the same 'time' band while repeatedly searching for the results of the intrusion prevention system at the same 'time'. FIG. 5C shows the search result. It can be seen that the intrusion detection system generated four intrusion prevention event logs for the first event log 142a and all the connections were dropped (156a).

The above embodiment is only one of the embodiments of the present invention, and various changes and modifications can be made without departing from the spirit of the present invention.

Due to the above configuration, the present invention can achieve the following effects.

The present invention enables an effective security audit for all event logs in real time without the use of manual labor or a separate log analyzer.

Claims (5)

An event log collector that collects intrusion detection event logs, intrusion prevention event logs, and system event logs from intrusion detection systems, intrusion prevention systems, and general systems, respectively, and various event logs collected by the event log collector. And a security audit system comprising a database for storing intrusion prevention event log groups and system event log groups separately, a central processing unit interoperating with the database, and a display unit for displaying the results. In the security audit of the abnormal signs of the computer network, A first step of simultaneously displaying an intrusion detection event log group, an intrusion prevention event log group, and a system event log group stored in the database on a display unit of the real-time analyzer; Selecting a first event log to be audited from an intrusion detection event log group, an intrusion prevention event log group, or a system event log group displayed on a display of the real-time analyzer; Selecting a second event log group to be linked and divided from the event log group except the first event log group; Selecting a linkage analysis condition for linkage analysis of the first event log and the second event log group; A fifth step of comparing and analyzing the first event log and the second event log group based on the linkage analysis condition selected in the fourth step and searching for second event logs satisfying the linkage analysis condition from the second event log group; And a sixth step of displaying the second event logs generated through the fifth step on the display unit of the real time analyzer, wherein the first to sixth steps are performed in real time by the real time analyzer of the security audit system. Real-time abnormal symptoms audit method, characterized in that. The real-time abnormal symptom audit method according to claim 1, wherein the association analysis condition of the fourth step is selected from the group consisting of time, starting address, destination address, intrusion detection system address and intrusion prevention system address. 3. The method of claim 1, wherein the first event log is selected from an intrusion detection event log group, and the second event log group is an intrusion prevention event log group. 3. The method of claim 1, wherein the first event log is selected from an intrusion detection event log group, and the second event log group is a system event log group. The method of claim 1, wherein the first event log is selected from an intrusion prevention event log group, and the second event log group is a system event log group.