KR20080073112A - Network security system and method for process thereof - Google Patents

Abstract

A network security system and a processing method thereof are provided to cope with absence of a security manager or various viruses like a zero day attack which makes an attack via a weak security network. A network security system includes a predicting or alarming server(30), an update server(40), and a management unit(20). The predicting or alarming server compares increase ratio of information on system access attack packets with preset threshold, and transmits a setup instruction for detection and interception of the attack packets to the update server. The update server receives the setup instruction and transmits the setup instruction with the update policy to the management unit if there occurs an update request event. The management unit applies the security policy to an agent, where there occur the attack packets, and controls the detection and the interception of the attack packets according to execution of the update and the setup instruction.

Description

NETWORK SECURITY SYSTEM AND METHOD FOR PROCESS THEREOF}

1 is a block diagram of a network security system according to a first embodiment of the present invention.

2 is a flowchart illustrating a security processing in a network security system according to a first embodiment of the present invention.

3 is a block diagram of a network management unit connected to an agent according to a second embodiment of the present invention.

4 is a flowchart illustrating an operation of automatically changing and applying a security policy to all agents with respect to attack packet information detected by an agent according to a second embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

10: agent 20: management

22: log management unit 24: security policy management unit

26: communication unit 28: database unit

30: alarm server unit 40: update server unit

The present invention relates to a network security system, and more particularly, to a network security system and a method for processing the same, which can appropriately respond to network security threats without intervention of a security administrator.

Intrusion Prevention System (IPS) and Intrusion Detecting System (IDS) are used as security systems for network protection. The IPS and IDS correspond to a preventive approach among network security technologies for monitoring network traffic and recognizing potential threats and reacting immediately.

Normally, once an attacker has gained internal privileges, the malicious use of the system can proceed very quickly. Therefore, most security systems are designed to have the ability to take immediate action based on a set of rules set by the network security administrator. To this end, the security system inspects a packet and if it is determined that it is an invalid packet, blocks all incoming traffic from the corresponding IP address or port, and forwards the legitimate traffic to the receiver without any interruption or service delay.

Although such a security system is dealing with an unfair attack packet, the current security system has a problem that can not be applied immediately when an urgent security policy needs to be applied.

In other words, the current security system is equipped with an early forecast / alarm server to detect external attacks and apply appropriate security policies, but cannot respond to attacks that spread worldwide in a short time, such as the Slammer Worm. there is a problem.

For example, when an attack occurs, threat information is transmitted to the network security administrator by text message (SMS) or email (e-mail) and responded to it, so the response speed is significantly lower than the spread of the threat. If the security manager is absent, immediate response such as blocking cannot be executed. In this case, in case of hacking or malicious code attack that takes place before the security patch is released, such as a zero-day attack, the damage cannot but be spread.

Accordingly, an object of the present invention is to provide a network security system and a method for processing the same, by providing an automated security policy against an attack threat without the intervention of a security administrator. have.

In addition, another object of the present invention is to apply a changed security policy to other agents based on the threat log information of any agent.

In addition, another object of the present invention is to be able to restore the security policy before a specific point in time after applying the changed security policy.

A network security system according to an aspect of the present invention for achieving the above object, in the security system, compares the increase rate of attack packet information to access the system with a predetermined reference threshold value and transmits a setting command for detection and blocking Example / alarm server, an update server that receives the setting command and transmits the setting command together with a security policy when an update request occurs, performing the update of the security policy, and applying the security policy according to the setting command to remove the attack packet. And a management unit for controlling detection / blocking, wherein the example / alarm server and the update server establish a session only when the increase rate is greater than the reference threshold.

According to another aspect of the present invention, at least one agent for inspecting attack packet information flowing from the network, generating statistical data for the attack packet information, and the rate of increase with the last stored statistical data and the reference threshold value Example / alarm server for transmitting the setting command for detection and blocking according to the comparison, when the increase rate is greater than the reference threshold, connected to the example / alarm server to receive the setting command, and when an update request is received in advance An update server for transmitting the stored security policy and the setting command, and receiving and updating the security policy, and applying the updated security policy according to the setting command to control the detection and blocking of the attack packet. do.

The management unit requests an update from the update server, receives the security policy, performs an update, generates a timestamp value of update end time information each time the update is performed, and timestamps of the stored end time information at the next update request. Send a value to the update server.

The management unit may further include a security policy management unit that checks whether the setting command is transmitted when the update of the security policy is completed, and detects / blocks the attack packet by changing the security policy only when the setting command is transmitted. It is configured by.

In addition, the management unit preferably stores the time stamp value for the security policy application time in the security policy history information.

The update server may further include a storage unit storing the security policy and a setting command, and comparing a time stamp value of previous update time information received according to an update request of the management unit with a time stamp value of time information at the time of receiving the setting command. And a comparison unit, and a transmission unit for transmitting a security policy and a setting command to be updated to the management unit when a time stamp value of the setting command time information is larger as a result of the comparison.

In addition, a new security policy and an update target security policy are stored in advance in the update server.

In addition, according to another feature of the present invention, a reference threshold for applying a security policy to each of at least one or more agents and the setting unit for setting whether or not, by referring to the attack packet information received from each agent or other network Log management unit for continuously generating / storing the main statistical data, a comparison unit for comparing the reference threshold value and the increase rate for the specific / unspecified attack name with reference to the last stored statistical data and the newly generated statistical data, the comparison result If the increase rate is greater than or equal to the reference threshold value, the inspection unit inspects the security policy applied to all the agents, and if the security policy applied to any agent is set to be unable to detect / block the attack packet, the detection and blocking is performed. Automatically activate the configuration command for the appropriate agent And it is configured to include a control unit for detection / prevention of the attack packets.

The management unit is preferably a graphical user interface (GUI) environment that can set the reference threshold and whether the security policy is applied.

The attack packet information includes 'Top N attack name', 'Top port usage', 'source IP', and 'target IP'.

When the security policy is applied to the agent, the controller repeats the application and change history information of the security policy for all agents.

When the security policy is set to apply to only a specific agent, the controller continuously checks the security policy for agents other than the set agent.

The control unit controls to recover the security policy at a specific time point after the security policy is automatically applied.

In addition, the security policy processing method according to another aspect of the present invention, (a) checking the attack packet information and generating statistical data, (b) the increase rate between the generated statistical data and the previous statistical data and a predetermined reference threshold Comparing the values, (c) a setting command for establishing a session with a server providing a security policy only when the statistical data growth rate is greater and applying the security policy to detect and block an attack packet. It is configured to include the step of transmitting to the server.

According to still another aspect of the present invention, (d) waiting for an update request from the network management unit, (e) a timestamp value at the time of performing a previous update and a setting command for detecting and blocking an attack packet upon the update request. Comparing a timestamp value, (f) transmitting a new security policy or a security policy to be updated and the setting command to the network management unit only when the timestamp value of the setting command is larger as a result of the comparison; g) changing the security policy according to the setting command and detecting / blocking the attack packet information.

Each time the update request of step (e), the timestamp value of the update end time is generated and stored, and the stored timestamp value is transmitted together with the next update request.

In the step (f), after the update of the security policy is finished, whether or not the setting command is transmitted is checked, and further comprising determining whether the setting command is applied.

In addition, according to another feature of the invention, (h) receiving the attack packet information from a plurality of agents to continuously generate / store the statistical data, (i) comparing the newly generated statistical data and the stored previous statistical data (J) checking the security policy applied to all agents when the rate of increase between the statistical data exceeds a predetermined threshold value; and (k) detecting / blocking the security policy applied to the agent. Determining whether or not to set, (l) If the detection, blocking setting is a security policy in the inactive state, it is activated and applied to the agent detects / blocks the attack packet is configured.

The method may further include storing the security policy application and change history information (m).

In the step (j), when the security policy is applied only to a specific agent or when a detection / blocking command is already set in the security policy, the security policy check for the agent is not performed.

The method may further include the step (n) of restoring the changed security policy to a pre-change security policy before a specific point in time.

The application of the setting command and the reference threshold value are manipulated by a graphical user interface (GUI) environment.

According to the present invention having such a configuration, it can be seen that even in the absence of a security manager, a sudden attack threat can be detected and responded with an automated security policy.

Hereinafter, a network security system and a processing method thereof according to the present invention will be described in detail with reference to the preferred embodiments shown in the accompanying drawings.

1 is a block diagram of a network security system according to a preferred embodiment of the present invention.

Referring to FIG. 1, a plurality of agents 10 ˜ 10 n are provided to detect threat information by analyzing all network packet information flowing from the outside. That is, the agent 10 to 10n inspects all the packet data passing through, and if the packet data meets the threat condition defined in the security policy, the agent 10 to 10n performs a response such as logging and blocking set in the security policy.

Storing threat log information based on the threat information detected by the plurality of agents (10 to 10n), Top attack name, Top port usage, source IP, destination IP of the threat log information The management unit 20 is provided to generate main statistical data such as and the like, and to apply a security policy to block the spread of network security threats. In addition, the management unit 20 manages the security policy history that is automatically changed for stable network operation, and provides a function to restore the security policy to the security policy at any point in the past. Accordingly, the management unit 20 preferably supports a graphical user interface (GUI) environment so that the security manager can easily set the reference threshold and the automatic change of the security policy.

The management unit 20 stores the individual threat log information received from the agents 10-10n in the database 28 and main statistical data (for example, Top 10 attack information / source IP / target IP) based on the threat log information. Etc.), and a security policy management unit 24 for applying various security policies to the agents 10 to 10n by the update operation of the update server unit 40. The threat log information is used as primary data for measuring a threat state of a network. The statistical data refers to the top attack name (Top N attack name), the top port usage. For example, a sudden increase in attack name, information on a predetermined port in which a lot of incoming traffic is generated beyond the reference.

In addition, the management unit 20 is the first communication unit 26a for transmitting the statistical data to the early forecast / alarm server unit (hereinafter, abbreviated as "alarm server unit") 30 is connected to the Internet, and the alarm server The second communication unit 26b receives a security policy and a setting command for detection / blocking from the update server unit 40 according to the forecast / alarm transmitted from the unit 30. When the first and second communication units 26a and 26b exchange data with the alert server unit 30 and the update server unit 40, the confidentiality of the data transmitted by the encrypted connection should be guaranteed. In addition, although the first and second communication units 26a and 26b are configured independently, the first and second communication units 26a and 26b may be configured by one communication module.

Next, the alert server unit 30 has a structure that interoperates with the update server unit 40. The alarm server unit 30 receives statistical data from the management unit 20 and generates total statistical data every predetermined time. That is, the alarm server unit 30 receives statistical data on threat log information from a plurality of management units (that is, a system configured in each company or organization) and displays the screen for the administrator to check.

In addition, the alarm server unit 30 is provided with a reference threshold value for establishing a connection with the update server unit 40. The reference threshold is a value that can be arbitrarily set by the security manager, which is provided from the management unit 20. The reference threshold sets a connection with the update server unit 40 with reference to an increase rate of interlocking related information such as IP of the update server unit 40 or specific / unspecified threat log information extracted from the statistical data. . In general, when the increase rate is greater than or equal to a threshold value, the alert server unit 30 and the update server unit 40 are connected, and a detection / blocking setting command for detecting whether the threat log information is applied and whether to block the application is transmitted. do.

Next, the update server unit 40 functions to provide a security policy, and stores the detection / block setting command received from the alert server unit 30 in storage of its own database or disk. Only when an update request of a security policy is generated from the management unit 20, the second communication unit 26b transmits a security policy and the detection / block setting command to the security policy management unit 24. At this time, the update server unit 40 compares the time stamp value at the time of the previous update request transmitted from the management unit 20 with the time stamp value finally received from the alert server unit 30, and compares the time stamp value. The update and detection / block setting command is transmitted according to the result so that the security policy is changed and applied by the management unit 20.

Therefore, the update server unit 40 compares the time stamp value transmitted from the management unit 20 with the time stamp value finally received from the alarm server unit 30, and the comparison result of the alarm server unit. If the timestamp value of 30 is greater, it is preferable to provide a transmission function for transmitting the security policy information and the detection / blocking setting command to the management unit 20. In addition, the update server unit 40 includes a database for storing the detection / block setting command and the time stamp value until an update request is generated from the management unit 20.

Next, the security processing method by the network security system having the above configuration will be described in detail step by step.

2 is a flowchart illustrating a security process in a network security system according to an exemplary embodiment of the present invention.

First, the management unit 20 stores the threat log information based on the threat information of the attack packet detected by the plurality of agents 10-10n by the log management unit 22, and the top of the threat log information. Generate key statistical data such as attack name, top port usage (S50). The generated statistical data is transmitted to the alarm server unit 30 via the first communication unit 26a.

A plurality of management units are connected to the alarm server unit 30, and the alarm server unit 30 receives statistical data of threat log information from the management units, and generates the statistical data of the threat log information as overall statistical data every predetermined time. Do the work.

The statistical data is continuously updated every time (seconds / minutes / hours).

The alarm server unit 30 continuously compares the increase rate of the statistical data generated at the present time with the statistical data generated at the present time (S52). The operation of comparing the increase rate with a reference threshold set by the administrator in advance is performed. The reference threshold value is a value that can smoothly operate the network. For example, if the traffic growth rate is about 10% or more and suddenly increases more than 30%, it is determined that abnormal traffic flows into the network. And blocking policy to apply.

As a result of the comparison, when the increase rate is large (YES in S54), the alert server unit 30 establishes an encrypted session with the update server unit 40 (S56), and time for the current time. The detection / block setting command is transmitted to the update server 40 to detect an abnormality of the stamp value and the increase rate and to apply a security policy corresponding thereto (S58). In this case, the detection / block setting command is transmitted to the update server unit 40 so that the security policy can be applied to the worm virus information or zero attack information as well as the increase rate.

The update server unit 40 stores the time stamp value and the detection / block setting command in the internal DB (S60). And it maintains a standby state until the update request is generated from the management unit 20 (S62).

The update request is generated in the management unit 20 (S64). At this time, the management unit 20 stores the timestamp value of the time when the update is finished for each update request, and transmits the stored timestamp value to the update server unit 40 at the next update request.

When the update server unit 40 receives the update request, the management unit 20 mediates the second communication unit 26b so that new security policy information or update security policy information stored in the internal DB is first updated. To send.

When the update is completed, the detection / block setting command for applying the update to the real agent 10 should be transmitted.

The detection / block setting command is a time stamp value of a previous update transmitted together with the update request from the management unit 20, that is, the last update time information A and the detection / reception received from the alarm server unit 30 finally. The timestamp value B of the cutoff setting command is compared (S66). And only when the time stamp B of the detection / block setting command of the alarm server unit 30 is larger (that is, later in time) as a result of the comparison, the detection / block setting command is executed by the management unit ( 20) (S70). Therefore, if the security policy is updated but the detection and alarm information for the abnormal state is not transmitted from the alarm server unit 30, the updated security policy is not applied to the agents 10-10n. Even if the update request is generated, the update is not performed unless there is a newly provided security policy or a security policy to be updated.

Here, the timestamp value may be compared when the update request occurs, and when the timestamp value of the alert server is greater, the security policy and the detection / blocking setting command may be transmitted together.

In addition, the above-described update request is previously set by the administrator, which is periodically or randomly transmitted to the update server unit 40.

Next, the management unit 20 stores the security policy transmitted from the update server unit 40 in the database 28, and together with whether or not the detection / block setting command is transmitted, whether the detection / block setting command is applied or not. Check it. The setting command transmission / application is set in advance by the administrator. This configuration process is supported in the form of a graphical user interface for the administrator to facilitate.

When the detection / block setting command is transmitted, the management unit 20 determines whether the detection / block setting command has been applied by the security manager. If the determination result is applied (S80), the security policy management unit 24 changes the security policy by the setting command (S82), and applies the changed security policy to the agents 10-10n (S84). Accordingly, the agents 10 to 10n detect and block specific attack names or treat viruses by the applied security policy. In this case, when the security policy is applied to the agents 10 to 10n, the management unit 20 adds / stores the time stamp value for the applied time to the security policy history information (S86). This is to prevent the same security policy from being updated and applied when an update request occurs in the management unit 20 as described above.

Next, FIG. 3 is a block diagram of a network management unit connected to an agent according to the second embodiment of the present invention, and FIG. 4 illustrates attack packet information detected by any agent according to the second embodiment of the present invention. An operation flow diagram for automatically changing and applying a security policy to all agents is shown. This is an operation that is processed in the network manager 100 (hereinafter, abbreviated as "administrator").

Referring to FIG. 3, the management unit 100 includes a setting unit 102 for setting a reference threshold value and a detection / block setting command for applying a security policy between at least one or more agents 10 to 10n. . The setting operation can be easily operated by the graphic user interface environment.

A log management unit 104 is provided to continuously generate / store main statistical data with reference to the attack / threat information received from each agent or other network. And a comparison unit 106 which compares the increase rate for the specific / unspecified attack name with the reference threshold value with reference to the last stored statistical data and the newly generated statistical data, and when the increase rate is equal to or greater than the reference threshold value. In accordance with the control operation of the controller 110, the inspection unit 108 for inspecting the security policy applied to all the agents (10 ~ 10n) is provided.

And a control unit 110 for selectively setting a detection / block setting command for the applied security policy according to the inspection result, applying the security policy to the agents 10 to 10n, and processing a change history of the security policy. do.

There is also provided a database (DB) 120 for storing the various information.

The management unit 100 in such a configuration is to manage a plurality of agents (10 ~ 10n), to apply a security policy to other agents for the threat log information generated from any of the agents.

Therefore, the security manager first sets a reference threshold to apply the security policy and whether the detection / blocking is performed using the graphic user interface in the setting unit 102.

In the state where the reference threshold value and detection / blocking are set, the log management unit 104 refers to the threat log information detected by the plurality of agents 10 to 10n, and the top attack name and the top port. Main statistical data such as usage is periodically generated and stored in the DB 120 (S130).

Thereafter, when the new statistical data is generated, the comparison unit 106 compares the statistical data generated at the present time with the last statistical data generated at the previous time, and compares the increase rate C for the specific / unspecified attack name with the reference threshold value. It compares with (D) (S132).

As a result of the comparison, when the increase rate C is greater than the reference threshold value D (YES in S134), the inspection unit 108 is applied to all agents 10 to 10n managed by the management unit 100. Check the policy (S136).

In addition, when the checked security policy is inactive so as not to detect serious attack information flowing into an arbitrary agent or is not set to block attack information, the control unit 110 detects the detection set by the administrator. Enable / disable block and apply changed security policy to agents (10 ~ 10n).

That is, the security policy of all agents 10 to 10n is sequentially or randomly inquired, and if detection is not set, detection is set (S138) (S149), and if blocking is not set, block is set (S140). (S142). The security policy is changed and applied to the agents (10 ~ 10n) to detect serious attack information, as well as block the network service by the detected attack information (S142) (S144).

The changed security policy history is stored in the DB 120 (S146).

If the security policy is set to be applied only to a specific agent by the management unit 100 or if it is a security policy of an agent that does not need to be applied or if detection and blocking are already set in the security policy, the security policy check process for the agent is performed. Is skipped and the security policy of the next agent is checked.

On the other hand, after applying the changed security policy to the specific / non-specific attack as described above, if the application of the changed security policy is not necessary to restore to the security policy at a predetermined time by the administrator (S148) (S150). This is to detect and block the attack information, and then return to the environment where the security policy is not applied. If the modified security policy is applied as it is, there is a possibility of false positives, and thus a network failure occurs. .

As described above, the present invention can quickly apply detection and security policy for threat log information generated by an agent.

As described above, it has been described with reference to the illustrated embodiment of the present invention, which is merely exemplary, and those skilled in the art to which the present invention pertains various modifications without departing from the spirit and scope of the present invention. It will be apparent that other variations and equivalent embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the network security system and processing method thereof according to the present invention have the following effects.

First, it can automatically detect and block various illegal attack situations generated by the agent, and apply security policy for them, so that it can promptly respond to various viruses such as zero day attacks that attack the vulnerable security network without the security manager. There is an effect that I can cope with.

In addition, the security policy standards for threat / attack information flowing into any agent can be shared with other agents, thereby preventing the spread of threat / attack information.

In addition, the administrator can easily set the baseline threshold for applying security policy and whether the security policy is applied by the graphical user interface environment, and when the security policy is not required, it can be manipulated to apply the security policy at some point in the past. It also has the effect of preventing false positives and network failures.

Claims (22)

In the security system, Example / alarm server, which transmits the setting command for detection and blocking by comparing the increase rate of attack packet information accessing the system with a preset reference threshold value, An update server for receiving the setting command and transmitting the setting command together with a security policy when an update request occurs; Including the management unit for controlling the detection and blocking of the attack packet by applying the security policy in accordance with the update of the security policy and the setting command, The example / alarm server and the update server, wherein a session is established only if the increase rate is greater than the reference threshold. At least one agent for inspecting attack packet information coming from the network, An example / alarm server that generates statistical data on the attack packet information and transmits a setting command for detection and blocking according to a comparison between an increase rate with the last stored statistical data and a reference threshold value; An update server connected to the example / alarm server to receive the setting command only when the increase rate is greater than the reference threshold value, and transmitting a pre-stored security policy and the setting command when an update request is received; And a management unit configured to receive and update the security policy, and control to detect / block the attack packet by applying the updated security policy according to the setting command. The method according to claim 1 or 2, The management unit, Request an update to the update server, Receive the security policy, perform an update, generate a timestamp value of update end time information every time the update is performed, and transmit a timestamp value of the stored end time information to the update server at the next update request Network security system. The method of claim 3, wherein The management unit, When the update of the security policy is finished, the security policy management unit for checking whether or not the transmission of the setting command is transmitted, and changing the security policy only when the setting command is transmitted to detect / block the attack packet. Characterized by a network security system. The method of claim 4, wherein The management unit, And storing a timestamp value for the security policy application time in security policy history information. The method of claim 3, wherein The update server, A storage unit for storing the security policy and a setting command; A comparison unit for comparing a timestamp value of previous update time information received according to an update request of the management unit with a timestamp value for time information when the setting command is received; And a transmission unit for transmitting a security policy and a setting command to be updated to the management unit when the time stamp value of the setting command time information is larger as a result of the comparison. The method of claim 6, The update server, the network security system, characterized in that the new security policy and the update target security policy is stored in advance. A setting unit for setting a reference threshold and whether to apply the security policy to each of at least one agent, Log management unit for continuously generating / storing the main statistical data with reference to the attack packet information received from each agent or other network, A comparison unit comparing the reference threshold with an increase rate for a specific / unspecified attack name by referring to the finally stored statistical data and newly generated statistical data; A inspection unit for inspecting a security policy applied to all agents when the comparison result is greater than or equal to the reference threshold value; If the security policy applied to any agent is set to be unable to detect / block the attack packet, the control unit automatically activates a setting command for detection and blocking to apply to the agent and detects / blocks the attack packet. Network security system provided with a network management unit configured to include. The method according to any one of claims 1, 2 or 8, The management unit is a network security system, characterized in that provided with a graphical user interface (GUI) environment for setting the reference threshold and whether the security policy is applied. The method according to any one of claims 1, 2 or 8, The attack packet information includes 'Top N attack name', 'Top port usage', 'source IP', and 'destination IP'. The method of claim 8, When the control unit applies the security policy to the agent, the network security system, characterized in that to repeat the application of the security policy and change history information for all agents. The method of claim 8, The control unit continuously checks the security policy for agents other than the set agent when the security policy is set to apply only to a specific agent. The method of claim 8, The control unit controls to restore to the security policy of a specific time after the security policy is automatically applied. (a) inspecting attack packet information and generating statistical data, (b) comparing an increase rate between the generated statistical data and previous statistical data and a preset reference threshold value; (c) establishing a session with a server providing a security policy only when the rate of increase of the statistical data is greater, and transmitting a setting command to the server to detect and block an attack packet by applying the security policy; Security policy processing method in a network security system configured to include. (d) waiting for an update request from the network management unit, (e) comparing the timestamp value of the previous update when performing the update request with the timestamp value of a setting command for detecting and blocking an attack packet; (f) transmitting a new security policy or a security policy to be updated and the setting command to the network management unit only when the timestamp value of the setting command is larger as a result of the comparison; (g) modifying the security policy according to the setting command and detecting / blocking the attack packet information. The method of claim 15, Each time the update request of step (e), the timestamp value of the update end time is generated and stored, and the stored timestamp value is transmitted together with the next update request. The method of claim 15, In the step (f), after the update of the security policy is finished, whether or not the setting command is transmitted is checked, and determining whether or not the setting command is applied is secured in the network security system. How policy is handled. (h) continuously generating / storing statistical data by receiving attack packet information from a plurality of agents, (i) comparing newly generated statistical data with previously stored statistical data, (j) checking the security policy applied to all agents when the increase rate between the statistical data exceeds a preset threshold; (k) determining whether a detection / blocking state is set for the security policy applied to the agent; (l) The security policy in the network security system comprising the step of activating the detection / blocking setting is inactive if the detection result, and detecting and blocking the attack packet by applying to the agent Treatment method. The method of claim 18, And (m) storing the security policy application and change history information. The method of claim 18 or 19, In the step (j), when the security policy is applied only to a specific agent or a detection / blocking command is already set in the security policy, the security policy check for the agent is not performed. How to handle security policy. The method of claim 19, And restoring (n) the changed security policy to a security policy before the change before the specific time. The method according to any one of claims 14, 15, 18, 19 or 21, Whether or not the setting command is applied and the threshold value is controlled by a graphical user interface (GUI) environment.

Images