KR100949805B1 - Apparatus and Method for Displaying Security Status of Administrative Domain Using Geographic Information - Google Patents

Abstract

The present invention utilizes geographic information to visualize the flow of security events flowing into the management domain on the map to display the security status of the management domain using geographic information to immediately determine the current security situation of the management domain and It is about a method. The present invention extracts geographic information based on the IP address of the security event flowing into the management domain from the security events transmitted from the network security equipment, and on the map based on the extracted geographic information and the characteristic information of the security event flowing into the management domain. By visualizing the flow of security events flowing into the management domain in three dimensions, the current security status of the management domain can be recognized in real time and the physical location of the network anomaly can be intuitively identified.

Description

Apparatus and method for visualizing security state of managed domain by using geographic information}

TECHNICAL FIELD The present invention relates to network security, and more particularly, to an apparatus and a method for visualizing a flow of security events flowing into a management domain.

The present invention is derived from the research conducted as part of the IT growth engine technology development project of the Ministry of Information and Communication and the Ministry of Information and Telecommunication Research and Development. [Task No. 2007-S-022-01, Research Title: Intelligent of All-IP Environment Cyber attack monitoring and tracking system development].

In the conventional network security field, a method of displaying a security situation on a network is often used by using security events generated from various security devices installed on the network.

Conventionally, information such as a source IP address, a destination IP address, a protocol, a source port, and a destination port constituting a security event is extracted. Display the extracted source IP address and destination IP address on the screen, and visualize the flow of security events through which destination port the security event generated using the source port of a specific protocol from the source IP address arrives at the destination IP address. do.

Since the conventional security status display method visualizes the flow of all security events occurring in a large amount, there is a great amount of data to be displayed on one screen. As a result, the screen becomes very complicated, which causes a problem of significantly lowering cognitive power.

In addition, since the source and destination of security events are represented on the screen by modifying the IP address represented by the number, it is difficult for the network administrator to intuitively recognize the point where the abnormality occurs in the domain managed by the user.

The present invention has been proposed to solve the above-mentioned problems, and by using the geographic information to visualize the flow of security events flowing into the management domain on a map to immediately determine the current security situation of the management domain It is an object of the present invention to provide an apparatus and method for displaying security status of an administrative domain using geographic information.

Another object of the present invention is to provide an apparatus and method for displaying a security situation of a management domain using geographic information that can display in detail the hierarchical destination of a security event flowing into the management domain.

In network security management, traffic to the management domain is important. If only security events flowing into the management domain are combined with geographic information and displayed on the screen, network administrators can intuitively recognize where anomalies occur in the domains they manage and enable quick response. The present invention is to solve the problem based on the above content.

In order to achieve the above object, the security status display apparatus of the management domain using geographic information according to the preferred embodiment of the present invention includes property information on the security event flowing into the management domain among security events from the outside and the property. A security event processor for extracting geographic information corresponding to a source IP address and a destination IP address of the information; And a security event display unit displaying a flow chart of a security event for each protocol flowing into the management domain based on the characteristic information of the security event provided from the security event processor and the geographic information corresponding to the IP address. And, wherein the security event display unit displays a flow of security events flowing into each destination port by using a circular security radar indicating a port number of a protocol.

The security event processing unit includes a security event collection module for collecting a security event from the outside; A security event filter module for extracting security events flowing into the management domain from the collected security events based on information of the first database and extracting characteristic information of the extracted security events; And a geographic information extraction module for extracting geographic information mapped to the source IP address and the destination IP address in the extracted characteristic information based on the information of the second database.

The security event filter module uses information including latitude and longitude for each IP of the management domain stored in the first database and a multi-level map file of the corresponding region.

The geographic information extraction module uses information including latitude and longitude for each IP stored in the second database.

The security event display unit displays a first map display area indicating a source location, a second map display area indicating a management domain as a destination, and a protocol information display area indicating a port number of the source or destination and the number of security events for each port. However, the source and destination are interconnected through the protocol information display area using the property information of the security event flowing into the management domain. Here, the protocol information display area includes a security radar, and the port number of the protocol is mapped to the perimeter of the circle, and the security is using the port number by the distance from the center of the circle to the perimeter to which the port number is mapped. Shows the number of events.

The security event display unit assigns a different color to the flow of security events for each port number.

The security event display unit hierarchically displays the second map display area based on the request signal.

The security event display unit hierarchically displays the management domains through a management domain map formed in a plurality of grids.

Security situation display method of the management domain using geographic information according to an embodiment of the present invention, the characteristic information on the security event flowing into the management domain from the security event from the outside, the source IP address and destination IP in the characteristic information A security event processing step of extracting geographic information corresponding to the address; And a security event displaying process of displaying the flow of a security event for each protocol flowing into the management domain on a screen including a map shape based on the extracted security event characteristic information and the geographic information. The display process displays the flow of security events entering each destination port using a circular security radar indicating the port number of the protocol.

Security event processing, the first step of collecting a security event from the outside; Extracting a security event flowing into the management domain from the security events collected in the first step; A third step of extracting property information of the security event flowing into the management domain extracted in the second step; And a fourth step of extracting geographic information mapped to the source IP address and the destination IP address in the feature information extracted in the third step.

The security event display process includes a first map display area indicating a source, a second map display area indicating a management domain as a destination, and a protocol information display area indicating a port number of the source or destination and the number of security events for each port. Displayed on the screen, the source and destination are interconnected through the protocol information display area using the property information of the security event flowing into the management domain. In the security event display process, the security radar is displayed on the protocol information display area, and a port number of a corresponding protocol is mapped to a circumference of a circle, and a distance from the center of the circle to the circumference of the port number is mapped. Shows the number of security events using the port number.

The security event display process hierarchically displays the second map display area based on the request signal.

The security event display process hierarchically displays administrative domains through a management domain map composed of a plurality of grids.

According to the present invention having such a configuration, among the security events transmitted from the network security equipment, geographic information is extracted based on the IP address of the security event flowing into the management domain, and extracted geographic information and characteristic information of the security event flowing into the management domain. By visualizing the flow of security events flowing into the management domain on the map in three dimensions, the current security status of the management domain can be recognized in real time and the physical location of the network anomaly can be intuitively identified.

Hierarchical and detailed visualization of the destinations of security events entering the management domain enables quick and accurate identification of where an anomaly occurs in the network.

Hereinafter, an apparatus and method for displaying a security situation of a management domain using geographic information according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a block diagram illustrating an embodiment of a security status display device of a management domain using geographic information according to the present invention, and includes a security event processing unit 110 and a security event display unit 120.

The security event processor 110 extracts a security event flowing into the management domain from among security events from the network security equipment 100 such as a firewall, an intrusion detection system, a router, and the like. The security event processor 110 extracts geographic information (eg, latitude and longitude) corresponding to the IP address in the extracted security event characteristic information. In the specification of the present invention, the characteristic information means a small number of features that are considered sufficient to grasp anomalies of a network among various characteristics of network packets going from a source to a destination. Typically, network packets have several attributes in addition to the source IP address, destination IP address, protocol, destination port, and source port. For example, hereinafter, the above-described attributes (ie, source IP address, destination IP address, protocol, destination port, source port) are defined as characteristic information. The security event processing unit 110 uses information of the management domain geographic information database 140 when extracting security events flowing into the management domain. The security event processor 110 uses information from the geographic information database 130 when extracting geographic information.

The security event display unit 120 maps the characteristic information of the security event flowing into the management domain transmitted from the security event processing unit 110 and the corresponding geographic information and visualizes it on a 3D screen. The security event display unit 120 visually hierarchically visualizes the destination of the security event in the management domain through the management domain geographic information database 140 and a user interface (not shown). The flow of security events flowing into the management domain displayed by the security event display unit 120 may vary depending on how much data is displayed on one screen. For example, it may be based on information of security events flowing into the management domain accumulated continuously, or based on information of security events flowing into the management domain accumulated by predetermined time (for example, about 10 minutes). The flow of security events flowing into the management domain displayed by the security event display unit 120 may be different. Both methods may be used.

In the present invention, the flow of security events refers to the form of network packets from the source to the destination. In other words, the connection of the source address, the protocol, the destination port, and the destination address with a line can be referred to as the flow of security events.

The geographic information database 130 stores information such as latitude and longitude, country, city, and institution for each IP.

The management domain geographic information database 140 stores information such as latitude and longitude for each IP of the management domain, an address, a phone number, and a multi-level map file of a corresponding region.

The geographic information database 130 and the management domain geographic information database 140 may be implemented as one database. The first database described in the claims refers to the management domain geographic information database 140, and the second database refers to the geographic information database 130.

FIG. 2 is a diagram for describing an internal configuration of the security event processing unit 110 of FIG. 1. The security event processor 110 includes a security event collection module 210, a security event filter module 220, and a geographic information extraction module 230.

The security event collection module 210 collects security events coming from the network security equipment 100.

The security event filter module 220 extracts only security events flowing into the management domain from the collected security events. That is, the security event filter module 220 uses only the IP event of the network security equipment 100, which transmits the security event in the collected security event, and the security event flowing into the management domain using information such as a destination IP address of the security event. Extract. The security event filter module 220 extracts characteristic information of the extracted security event.

The geographic information extraction module 230 geographically maps geographic information (eg, latitude and longitude of the source, latitude and longitude of the destination) mapped to the source IP address and the destination IP address in the feature information extracted by the security event filter module 220. Extracted from information database 130.

As a result, the security event processing unit 110 outputs the characteristic information of the security event flowing into the management domain, and also outputs geographic information mapped to the IP address of the source and destination in the characteristic information.

In the above description, the geographic information database 130 and the management domain geographic information database 140 are configured separately from the security event processing unit 110. If necessary, the geographic information database 130 and the management domain geographic information database 140 may be provided in the security event processing unit 110. In addition, the management domain geographic information database 140 may be provided in the security event display part 120 which is demonstrated in detail below.

FIG. 3 is a diagram for describing an internal configuration of the security event display unit 120 of FIG. 1. The security event display unit 120 includes a security event visualization module 310, a user interface module 320, and a management domain geographic information extraction module 330.

The security event visualization module 310 stores geographic information (ie, information mapped to the source IP address and the destination IP address of the extracted security event) and the destination port information and the protocol information from the security event processor 110. To visualize. The security event visualization module 310 may include a first map display area for displaying a source and a second map display area and a protocol for displaying a management domain as a destination (for example, a destination port number or a source port number, and security for each port). The protocol information display area for displaying the number of events, etc.) is displayed on one screen. The first map display area is displayed on a world map, for example. The second map display area displays a national map of the management domain, for example. The security event visualization module 310 interconnects the source in the first map display area with the destination in the second map display area through a protocol information display area.

The user interface module 320 allows a specific area to be selected on the second map display area through a user's mouse or keyboard input.

The management domain geographic information extraction module 330 extracts detailed information about the specific area from the management domain geographic information database 140 according to a specific area selection signal in the second map display area through the user interface module 320. . The management domain geographic information extraction module 330 transmits detailed information on the extracted specific region to the security event visualization module 310. Accordingly, the security event visualization module 310 displays the destination of the detailed security event of the specific region on the screen based on the received detailed information about the specific region.

4 is a diagram illustrating an example in which the security event flowing into the management domain from the security event display unit 120 is visualized by mapping it with geographic information. A world map 500 for indicating the country of the source IP address, an administrative domain map 510 for indicating the country of the destination IP address, and a destination port for displaying a plurality of protocols (eg, UDP, TCP, etc.) The security radars 520, 530, and 540 are displayed on one screen. The first map display area described above in the claims is the area where the world map 500 is located. The second map display region described in the claims becomes the region where the management domain map 510 is located. The protocol information display area described in the claims becomes the area where the security radars 520, 530, and 540 are located. The positions of the world map 500 and the administrative domain map 510 may be interchanged. Depending on the situation, the first and second map display areas may be displayed as a globe. Naturally, the number of security radars can be added or subtracted.

The security event display unit 120 extracts latitude and longitude from the characteristic information of the security event (that is, the security event flowing into the management domain) received from the security event processing unit 110 based on the source IP address. The security event display unit 120 determines a corresponding country (ie, a source country) based on the extracted latitude and longitude. The security event display unit 120 maps a destination IP address among geographic information (latitude and longitude) received from the security event processing unit 110 and characteristic information of the security event to determine a region to be a destination. The security event display unit 120 connects the determined source country and the area of the destination by a line. At this time, the security event display unit 120 connects the source country on the world map 500 and the destination area on the management domain map 510 through the security radar 520, 530, 540.

In FIG. 4, a dotted line means that a security event is flowing into a specific region of the management domain by using the destination port number 3 of the TCP protocol generated in a specific country. The security event display unit 120 applies a color having identification for each specific port number. Accordingly, the administrator can easily and intuitively recognize network abnormalities such as concentration to a specific port.

5 is a diagram illustrating an example of actual visualization in the security event display unit 120 of FIG. 5 shows an actual example of visualizing security events flowing into Korea from countries around the world by setting an administrative domain in Korea. Security events are categorized in different colors to make it easier to identify the flow of security events into the management domain according to the destination port number. Geographic information of latitude and longitude was extracted from the source IP address and mapped to the world map 500. In addition, three security radars 520, 530, and 540 are used to represent TCP, UDP, and other protocols to visualize security events flowing into the destination port. IP addresses are mapped to geographic information and the destination ports are represented using security radars 520, 530, and 540. As a result, it is possible to intuitively recognize a phenomenon in which security events are concentrated in a specific region in Korea, and a phenomenon where security events are concentrated in a specific destination port number. In addition, it is possible to intuitively recognize which area the security event focused on a specific destination port is directed to.

FIG. 6 is a diagram for describing the protocol information display area of FIGS. 4 and 5, and is a diagram of security radars 520, 530, and 540 used for displaying a destination port number in the security event display unit 120.

The security radar shown in Figs. 6A and 6B has a circular shape. Around the circle, the port number of the protocol is mapped at an angle. In FIG. 6A, the port number is increased on a log scale, and in FIG. 6B, the port number is linearly increased. The distance from the center of each of the security radars 520, 530, and 540 to the perimeter to which the port number is mapped represents the number of security events currently using the port number in the corresponding port number. The security radar 520, 530, 540 may display the source port number instead of the destination port number.

In FIG. 6, the shape of the security radar is circular, but may be replaced with another shape as necessary.

FIG. 7 is a diagram illustrating a hierarchical display of the second map display area of FIGS. 4 and 5, in which the management domain map 510 includes management domain map level 0 710 and management domain map level 1 720. , And admin domain map level 2 (730).

The security event visualization module 310 of the security event display unit 120 maps the destination IP address of the security event to geographic information on a map corresponding to the management domain map level 0 710 when there is no user intervention. If the user selects a specific region in admin domain map level 0 710, the admin domain geographic information extraction module 330 corresponds to admin domain map level 1 720 which enlarges the selected region in admin domain geographic information database 140. Bring a map. The security event visualization module 310 displays the flow of the security event on management domain map level 1 720 using the destination IP address of the security event and the information obtained from the management domain geographic information extraction module 330.

If the user selects a specific region in the management domain map level 1 720, the above-described operation is performed again to display the flow of the security event in the management domain map level 2 730 in more detail.

If administrative domain map level 0 (710) represents a national map of Korea, administrative domain map level 1 (720) means city and province, and administrative domain map level 2 (730) means administrative district such as Gu, Dong. can do.

By hierarchically configuring the management domain map 510, a network administrator can quickly identify a region where an abnormality of a security event occurs through several selection processes.

In FIG. 7, the management domain map has three levels (level 0, level 1, level 2), but may be added or subtracted as necessary.

On the other hand, the security event display unit 120 also displays the management domain hierarchically through the management domain map as shown in FIG. That is, the management domain map as shown in FIG. 8 is separately displayed on the security event display unit 120 by the user's selection. When FIG. 7 represents a physical space, FIG. 8 may be regarded as representing a logical space. The management domain map is configured in a grid of N × N. Each grid represents a representative network of multiple network security devices. When one grid is selected in management domain map level 0 810, it is displayed as management domain map level 1 820 composed of K × K. When one grid is selected in management domain map level 1 820, management domain map level 2 830 representing network security devices in detail is displayed on the screen.

Assuming that one grid of management domain map level 0 810 is one logical network composed of multiple routers, one grid is represented as one router in management domain map level 1 820. In the management domain map level 2 830, one grid refers to a server and a client PC connected to one router. The management domain map is hierarchically configured like the management domain map, and is represented hierarchically according to the user's selection in the security event display unit 120. In other words, a typical network is hierarchically organized. For example, suppose an organization uses an IP of "129.143. *. *". Under this assumption, management domain map level 0 810 divides the space according to the third digit of the IP address. At this time, a security event directed to "129.143.1. *" Is displayed in one rectangle. In administrative domain map level 1 820, the space is divided according to the fourth digit of the IP address. At this time, a security event directed to "129.143.1.1" is displayed in one rectangle.

As shown in FIG. 7, it is possible to easily identify the geographic location where the anomaly occurs, and by using FIG. 8, it is possible to easily identify the IP address network equipment where the anomaly occurs.

The present invention described above can be embodied as computer readable codes on a computer readable recording medium. The recording medium refers to any type of recording device that stores data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like. It also includes the implementation in the form of a carrier wave (for example, transmission over the Internet). The computer readable recording medium can be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. Functional programs, code and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Although one embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, but may be modified and modified without departing from the scope of the present invention. The technical spirit in which such modifications and variations are applied should also be considered to be within the scope of the following claims.

1 is a block diagram illustrating an embodiment of an apparatus for displaying a security status of an administrative domain using geographic information according to the present invention.

FIG. 2 is a diagram for describing an internal configuration of the security event processor of FIG. 1.

FIG. 3 is a diagram for describing an internal configuration of the security event display unit of FIG. 1.

FIG. 4 is a diagram for describing a method of visualizing in the security event display of FIG. 1.

FIG. 5 is a diagram illustrating an example of actual visualization in the security event display of FIG. 1.

FIG. 6 is a diagram for describing the protocol information display area of FIGS. 4 and 5.

FIG. 7 is a diagram illustrating a hierarchical display of the second map display area of FIGS. 4 and 5.

FIG. 8 is a diagram illustrating a configuration of hierarchically displaying a management domain through a management domain map in the security event display of FIG. 1.

Claims (15)

A security event processor extracting feature information on a security event flowing into a management domain from a security event from outside and geographic information corresponding to a source IP address and a destination IP address of the feature information; And A security event display unit displaying a flow chart of a security event for each protocol flowing into the management domain based on the characteristic information of the security event provided from the security event processor and the geographic information corresponding to the IP address; Including, The security event display unit, the security status display device of the management domain using geographic information, characterized in that for displaying the flow of security events flowing into each destination port using a circular security radar indicating the port number of the protocol . The method according to claim 1, The security event processing unit, A security event collection module for collecting security events from the outside; A security event filter module for extracting security events flowing into the management domain from the collected security events based on information of a first database and extracting characteristic information of the extracted security events; And And a geographic information extraction module for extracting geographic information mapped to the source IP address and the destination IP address in the extracted characteristic information based on information of the second database. Device. The method according to claim 2, The security event filter module uses the information including the latitude and longitude of each IP of the management domain stored in the first database and a multi-level map file of a corresponding region. Status display. The method according to claim 2, And the geographic information extraction module uses information including latitude and longitude for each IP stored in the second database. The method according to claim 1, The security event display unit may include a first map display area for displaying a source, a second map display area for displaying a management domain as a destination, and a protocol information display area for displaying a port number of the source or destination and the number of security events for each port. Mark it, And the source and destination are interconnected through the protocol information display area using the characteristic information of the security event flowing into the management domain. The method according to claim 5, The protocol information display area, And a security radar, wherein a port number of a corresponding protocol is mapped to a circumference of the circle of the security radar, and a port of the security event using the port number by a distance from the center of the circle to the circumference of the port number is mapped. Security status display device of the management domain using geographic information, characterized in that indicating the number. The method according to claim 5, The security event display unit is a security status display device of the management domain using geographic information, characterized in that to assign a different color to the flow of the security event for each port number. The method according to claim 5, And the security event display unit hierarchically displays the second map display area based on a request signal. The method according to claim 1, And the security event display unit hierarchically displays the management domains through a management domain map composed of a plurality of grids. A security event processing step of extracting feature information on a security event flowing into a management domain from security events from outside and geographic information corresponding to a source IP address and a destination IP address in the feature information; And And a security event displaying process of displaying the flow of security events for each protocol flowing into the management domain on a screen including a map shape based on the extracted security event property information and the geographic information. The security event display process, the security status display of the management domain using geographic information to display the flow of security events flowing into each destination port using a circular security radar indicating the port number of the protocol Way. The method according to claim 10, The security event processing process, Collecting a security event from the outside; Extracting a security event flowing into the management domain from the security events collected in the first step; A third step of extracting property information of a security event flowing into the management domain extracted in the second step; And And a fourth step of extracting geographic information mapped to the source IP address and the destination IP address in the feature information extracted in the third step. The method according to claim 10, The security event display process includes a first map display area for displaying a source, a second map display area for displaying a management domain as a destination, and a protocol information display area for displaying a port number of the source or destination and the number of security events for each port. On your screen, And using the geographic information to interconnect the source and destination through the protocol information display area by using the characteristic information of the security event flowing into the management domain. The method according to claim 12, The security event display process, The security radar is displayed on the protocol information display area, and the port number of the corresponding protocol is mapped to the perimeter of the circle, and the port number is used by the distance from the center of the circle to the perimeter to which the port number is mapped. Security status display method of the management domain using geographic information, characterized in that indicating the number of security events. The method according to claim 12, The security event display process may include displaying the second map display area hierarchically based on a request signal. The method according to claim 10, The security event display process is a security status display method of the management domain using geographic information, characterized in that to display the management domain hierarchically through a management domain map consisting of a plurality of grid forms.

Images