KR20230095351A - Apparatus, method and computer program for scheduling security event - Google Patents

Abstract

A device for scheduling a security event comprises: a detection unit that detects a plurality of security events occurring in a detection target network through monitoring; a risk score deriving unit that derives a risk score for each of the plurality of detected security events; and a scheduling unit that schedules a processing order of the plurality of security events by using either one of a static priority method or a dynamic priority method based on the derived risk score.

Description

Device, method and computer program for scheduling security events {APPARATUS, METHOD AND COMPUTER PROGRAM FOR SCHEDULING SECURITY EVENT}

The present invention relates to an apparatus, method and computer program for scheduling security events.

Recently, attacks on networks occur in various ways, and new types of sophisticated and complex attacks are emerging. As the network is attacked, network users may experience damage unintentionally, such as destruction of the network configuration, delay or interruption of normal operations, and leakage of information.

In particular, the frequency of attacks targeting networks of public institutions or companies is gradually increasing, and the scale of time and economic damage is also increasing.

The conventional integrated security management system (Enterprise Security Management, ESM) collects security events from various security devices and simply provides the collected information to the administrator, and considers the risk of security events individually according to each network configuration and situation. Couldn't.

Therefore, it was necessary to develop a security event scheduler that implements a priority algorithm that can effectively respond to the case where multiple security events occur simultaneously and utilizes it.

Japanese Unexamined Patent Publication No. 2021-034807 (published on March 1, 2021)

The present invention is to solve the problems of the prior art described above, and detects a plurality of security events occurring in a detection target network through monitoring, derives a risk score for each of the plurality of detected security events, and derives a risk score. It is intended to schedule the processing order of a plurality of security events using either a static priority method or a dynamic priority method based on scores.

An object of the present invention is to provide a security event scheduling device, method, and computer program capable of actively responding to the risk level of a security event and efficiently processing a plurality of security events.

However, the technical problem to be achieved by the present embodiment is not limited to the technical problems described above, and other technical problems may exist.

As a means for achieving the above-mentioned technical problem, an embodiment of the present invention, in an apparatus for scheduling security events, a detection unit for detecting a plurality of security events occurring in a detection target network through monitoring, the detected Scheduling the processing order of the plurality of security events using a risk score derivation unit for deriving a risk score for each of a plurality of security events, and using any one of a static priority method and a dynamic priority method based on the derived risk score It may include a scheduling unit that does.

In one embodiment, the detection unit may classify the plurality of security events as one of a network type, a host type, and a web event type.

In one embodiment, the detection unit may profile the information of the plurality of security events for each type, and when a new security event occurs, determine whether it corresponds to an intrusion based on the profiled information.

In one embodiment, the risk score derivation unit may derive the risk score using CVE analysis and CVSS analysis.

In an embodiment, the risk score derivation unit may perform the CVSS analysis by determining the risk of a security event based on a basic metric group, a temporary metric group, and an environmental metric group.

In one embodiment, the scheduling unit may schedule the processing sequence based on the static prioritization method for determining priorities of the plurality of security events at compile time.

In an embodiment, the scheduling unit may schedule the processing sequence based on the dynamic priority method of changing priorities of the plurality of security events while an application program is running.

Another embodiment of the present invention is a method for scheduling security events, comprising: detecting a plurality of security events occurring in a detection target network through monitoring; and deriving a risk score for each of the plurality of detected security events. and scheduling a processing sequence of the plurality of security events using one of a static priority method and a dynamic priority method based on the derived risk score.

Another embodiment of the present invention is a computer program stored in a computer readable recording medium including a sequence of instructions for scheduling a security event, wherein the computer program, when executed by a computing device, detects a target network through monitoring. A plurality of security events that occur are detected, a risk score is derived for each of the plurality of detected security events, and a static priority method or a dynamic priority method is used based on the derived risk score. It may include a sequence of instructions to schedule the processing order of a plurality of security events.

The above-described means for solving the problems is only illustrative and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description.

According to any one of the above-described problem solving means of the present invention, the present invention detects a plurality of security events occurring in the detection target network through monitoring, derives a risk score for each of the plurality of detected security events, and derives Based on the determined risk score, a processing sequence of a plurality of security events may be scheduled using any one of a static priority method and a dynamic priority method.

It can actively respond according to the degree of risk of security events and efficiently process multiple security events.

1 is a block diagram of a security event scheduling device according to an embodiment of the present invention.
2 is a diagram for explaining CVSS analysis.
3 is an exemplary diagram for explaining a method of scheduling a security event according to an embodiment of the present invention.
4 is a flowchart of a security event scheduling method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail so that those skilled in the art can easily practice the present invention with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected" but also the case where it is "electrically connected" with another element interposed therebetween. . In addition, when a part "includes" a certain component, this means that it may further include other components, not excluding other components, unless otherwise stated, and one or more other characteristics. However, it should be understood that it does not preclude the possibility of existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

In this specification, a "unit" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. Further, one unit may be realized using two or more hardware, and two or more units may be realized by one hardware. On the other hand, '~ unit' is not limited to software or hardware, and '~ unit' may be configured to be in an addressable storage medium or configured to reproduce one or more processors. Therefore, as an example, '~unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. Functions provided within components and '~units' may be combined into smaller numbers of components and '~units' or further separated into additional components and '~units'. In addition, components and '~units' may be implemented to play one or more CPUs in a device or a secure multimedia card.

The "network" referred to below refers to a connection structure capable of exchanging information between nodes such as terminals and servers, such as a local area network (LAN) and a wide area network (WAN). , the Internet (WWW: World Wide Web), wired and wireless data communications networks, telephone networks, and wired and wireless television communications networks. Examples of wireless data communication networks include 3G, 4G, 5G, 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), World Interoperability for Microwave Access (WIMAX), Wi-Fi, Bluetooth communication, infrared communication, ultrasonic communication, visible light communication (VLC: Visible Light Communication), LiFi, and the like, but are not limited thereto.

In this specification, some of the operations or functions described as being performed by a terminal or device may be performed instead by a server connected to the terminal or device. Likewise, some of the operations or functions described as being performed by the server may also be performed in a terminal or device connected to the corresponding server.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a security event scheduling device according to an embodiment of the present invention. Referring to FIG. 1 , a security event scheduling device 100 may include a detection unit 110 , a risk score derivation unit 120 and a scheduling unit 130 .

For example, the security event scheduling apparatus 100 may provide a method of actively responding to a security event by considering the risk of the security event. Also, the security event scheduling apparatus 100 can efficiently process security events by scheduling the order of processing a plurality of security events according to a priority algorithm.

The detection unit 110 may detect a plurality of security events occurring in the detection target network through monitoring.

The detection unit 110 may normalize a plurality of security events occurring in the detection target network. For example, the detection unit 110 may classify a plurality of security events into one of a network type, a host type, and a web event type.

Network-type security events can occur, for example, against intrusion prevention systems, intrusion detection systems, or anti-virus products.

The contents of the security event that occurred for the intrusion prevention system include time of occurrence, device, source IP, source port, destination IP, destination port, protocol, event type (Accept, Drop, Reject, Error, Close, etc.), importance, product name, Information about the number of occurrences may be included.

The contents of the security event that occurred for the intrusion detection system are time of occurrence, device, source IP, source port, destination IP, destination port, protocol, risk level, attack type, attack name, packet size, product name, action details, and CVE code. It can include information about the value and the number of occurrences.

The contents of the security event generated for the anti-virus product may include information about occurrence time, generating device, source IP, destination IP, scanned file, scanned file location, virus name, action result, and product name.

Security events of the host type may occur, for example, against a mail security system, a server security system, or a document security system.

The contents of the security event that occurred for the mail security system are the time of occurrence, the device that occurred, the source IP, the destination IP, the recipient's e-mail address, the e-mail subject, the contents of the event (Accept, Drop, Info, etc.), the attached file name, the product name, and the number of occurrences. information may be included.

The content of the security event that occurred for the server security system is information about the occurrence time, occurrence device, occurrence event processing content, source IP, source port, destination IP, destination port, protocol, packet size, product name, event occurrence rule, and number of occurrences. can include

The content of the security event that occurred for the document security system may include information about the time of occurrence, the device that occurred, the user (IP address), the access target, the type of event (folder setting, deletion, etc.), the result of access, the product name, and the number of occurrences. can

A security event of the web event type may occur for example for a web log. Contents of the security event generated in the web log may include information about occurrence time, generating device, source IP, result code, method, query value, cookie value, and number of occurrences.

Profiling-based intrusion detection techniques assume that attack behavior has a different aspect from normal behavior. Intrusion detection techniques based on profiling include, for example, data mining for network traffic, statistical analysis through audit data analysis, and sequence analysis using operating system system calls.

The detection unit 110 may profile information of a plurality of security events for each type. For example, the detection unit 110 may profile corresponding security event information for each network type, host type, and web event type using a statistical analysis technique through audit data analysis.

The profile content of the network type security event may include information about source IP, destination IP, destination port, protocol source IP, destination IP, and attack name (virus name).

The profile content of the host type security event may include information about the destination IP and occurrence event (name of attached file, mail subject, etc.).

The profile contents of the security event of the web event type may include information about the profile IP, parameters, and variables (defining permissible strings for each parameter).

The detection unit 110 may determine whether a new security event corresponds to an intrusion based on profiled information when a new security event occurs.

The detection unit 110 may regard a new security event as an abnormal behavior when it deviates from the profile value. For example, if a new security event deviates from a defined threshold based on statistical values profiled by time and by day, it may be regarded as an abnormal behavior and detected as an intrusion.

The risk score derivation unit 120 may derive a risk score for each of a plurality of detected security events.

The risk score derivation unit 120 may derive risk scores for each of a plurality of security events by using, for example, Common Vulnerabilities and Exposures (CVE) analysis and Common Vulnerability Scoring System (CVSS) analysis.

CVE analysis can determine the risk of a security event based on a list that provides a standard name corresponding to each publicly known vulnerability. CVE analysis is in a format closer to a dictionary than a database, and has the advantage of being able to search or download information directly from the Internet.

The risk score derivation unit 120 may perform CVSS analysis by determining the risk of a security event based on a base metric group, a temporary metric group, and an environmental metric group. there is.

2 is a diagram for explaining CVSS analysis. Referring to FIG. 2 , elements included in the basic metric group, temporary metric group, and environmental metric group of the CVSS analysis are shown.

The basic metric groups include attack location (Access Vector), attack complexity (Access Complexity), authentication requirement (Authentication), confidentiality impact (Confidentiality Impact), integrity impact (Integrity Impact), and availability impact (Availability Impact). can include

The risk score derivation unit 120 may calculate the basic metric risk by using the basic metric formula of the basic metric group.

The temporary metric group may include the realization complexity (Exploitability), the level of the vulnerability recovery method (Remediation Level), and the confidence level of the subject who released the vulnerability (Report Confidenc).

The risk score derivation unit 120 may calculate the temporary metric risk by using the temporary metric formula of the temporary metric group.

Environmental metric groups include Collateral Damage Potential, Target Distribution, Confidentiality Requirement, Integrity Requirement, and Availability Requirement. can do.

The risk score derivation unit 120 may calculate the environmental metric risk by using the environmental metric formula of the environmental metric group.

The risk score derivation unit 120 may derive a risk score of a security event based on the basic risk metric, the temporal risk metric, and the environmental metric risk.

The scheduling unit 130 may schedule a processing sequence of a plurality of security events based on the derived risk score.

The scheduling unit 130 may schedule a processing sequence of a plurality of security events using any one of a static priority method and a dynamic priority method.

A static prioritization method may be, for example, determining the priority of a plurality of security events at compile time. The static priority method has the advantage of easy implementation and low system overhead.

The scheduling unit 130 uses a static priority method, either Rate Monotonic (RM), which fixes a task with a shorter generation period to a higher priority, or Deadline Monotonic (DM), which fixes a task with a shorter deadline to a higher priority. is available.

The dynamic priority method may change priorities of a plurality of security events during execution of an application program, for example. The dynamic priority method has the advantage of being able to adapt to changing situations and responding more efficiently by increasing the response speed of the system.

The scheduling unit 130 may use any one of Earliest DeadLine Firest (EDF), Time Driven Scheduler (TDS), Least Laxity First (LLF), and Shortest Remaining Time (SRT) as a dynamic priority method.

EDF is a method in which a task with a shorter deadline has a higher priority, and the priority is adjusted whenever a new task occurs. EDF is an efficient algorithm with 100% utilization of the processor, but it has a disadvantage that it is difficult to implement.

Similar to EDF, TDS performs scheduling according to task deadlines, but it is a method that can control overload conditions. TDS stops work when an overload condition occurs, and removes tasks with a low proportion if the overload condition persists.

LLF is a method of assigning higher priority to tasks with less free time. Here, the slack time means the processing time remaining until the deadline.

SRT is a method of running a process that has a shorter CPU time by comparing the remaining CPU demand time of the two processes when a new process is running while it is running.

3 is an exemplary diagram for explaining a method of scheduling a security event according to an embodiment of the present invention.

(a) of FIG. 3 exemplarily shows a method of scheduling a task by RM, which is one of the static priority methods. According to RM, priorities are given to all targets at compile time, but higher priority is given to tasks with shorter initial creation cycles.

3(b) exemplarily shows a method of scheduling tasks by DM, which is another static priority method. According to the DM, priority is given to all targets at compile time, but the shorter the deadline, the higher priority is given.

(c) of FIG. 3 exemplarily shows a method of scheduling a task by EDF, which is one of the dynamic priority methods. According to EDF, priority is adjusted whenever a new task occurs, and a task with a shorter deadline is given a higher priority.

4 is a flowchart of a method for scheduling security events according to an embodiment of the present invention. The security event scheduling method 400 performed by the security event scheduling apparatus 100 shown in FIG. 4 includes steps processed time-sequentially by the security event scheduling apparatus 100 according to the embodiment shown in FIG. include Therefore, even if the content is omitted below, it is also applied to the method for determining malicious code performed in the security event scheduling apparatus 100 according to the embodiment shown in FIG. 1 .

In step S410, the security event scheduling apparatus 100 may detect a plurality of security events occurring in the detection target network through monitoring.

In step S420, the security event scheduling apparatus 100 may derive a risk score for each of a plurality of detected security events.

In step S430, the security event scheduling apparatus 100 may schedule a processing sequence of a plurality of security events using any one of a static priority method and a dynamic priority method based on the derived risk score.

In the foregoing description, steps S410 to S430 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. Also, some steps may be omitted as needed, and the order of steps may be switched.

The method of scheduling security events in the security event scheduling apparatus described with reference to FIGS. 1 to 4 may be implemented in the form of a computer program stored in a medium executed by a computer or a recording medium including instructions executable by a computer. there is.

Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer readable media may include computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts should be construed as being included in the scope of the present invention. do.

100: security event scheduling device
110: detection unit
120: risk score derivation unit
130: scheduling unit

Claims (15)

An apparatus for scheduling security events,
a detection unit that detects a plurality of security events occurring in a detection target network through monitoring;
a risk score derivation unit deriving a risk score for each of the plurality of detected security events; and
A scheduling unit to schedule a processing sequence of the plurality of security events using any one of a static priority method and a dynamic priority method based on the derived risk score.
To include, a security event scheduling device.
According to claim 1,
The detection unit classifies the plurality of security events into one of a network type, a host type, and a web event type.
According to claim 2,
The security event scheduling apparatus of claim 1 , wherein the detection unit profiles information of the plurality of security events for each type, and determines whether a new security event corresponds to an intrusion based on the profiled information when a new security event occurs.
According to claim 1,
Wherein the risk score derivation unit derives the risk score using CVE analysis and CVSS analysis.
According to claim 4,
wherein the risk score derivation unit performs the CVSS analysis by determining a risk of a security event based on a basic metric group, a temporary metric group, and an environmental metric group.
According to claim 1,
wherein the scheduling unit schedules the processing sequence based on the static prioritization method for determining priorities of the plurality of security events at compile time.
According to claim 1,
wherein the scheduling unit schedules the processing sequence based on the dynamic priority method of changing priorities of the plurality of security events while an application program is running.
A method for scheduling security events,
Detecting a plurality of security events occurring in the detection target network through monitoring;
deriving a risk score for each of the plurality of detected security events; and
Scheduling a processing sequence of the plurality of security events using any one of a static priority method and a dynamic priority method based on the derived risk score.
Which includes, security event scheduling method.
According to claim 8,
The security event scheduling method further comprising classifying the plurality of security events as one of a network type, a host type, and a web event type.
According to claim 9,
profiling the information of the plurality of security events for each type; and
Determining whether a new security event corresponds to an intrusion based on the profiled information when a new security event occurs
Further comprising, security event scheduling method.
According to claim 8,
Wherein the step of deriving the risk score derives the risk score using CVE analysis and CVSS analysis.
According to claim 11,
wherein the step of deriving the risk score performs the CVSS analysis by determining a risk of a security event based on a basic metric group, an ad hoc metric group, and an environmental metric group.
According to claim 8,
wherein the step of scheduling the processing order schedules the processing order based on the static prioritization method for prioritizing the plurality of security events at compile time.
According to claim 8,
wherein the scheduling of the processing sequence schedules the processing sequence based on the dynamic prioritization method of changing priorities of the plurality of security events during execution of an application program.
A computer program stored on a computer readable recording medium comprising a sequence of instructions for scheduling a security event,
When the computer program is executed by a computing device,
Detect multiple security events that occur in the detection target network through monitoring,
Derive a risk score for each of the plurality of detected security events;
A computer stored on a computer-readable recording medium comprising a sequence of instructions for scheduling a processing sequence of the plurality of security events using any one of a static priority method and a dynamic priority method based on the derived risk score. program.

Images