NETWORK SECURITY CONTROL SYSTEM AND METHOD, AND SECURITY EVENT PROCESSING APPARATUS AND VISUALIZATION PROCESSING APPARATUS FOR NETWORK SECURITY CONTROL

• US 20120137361A1
• Filed: 08/04/2011
• Published: 05/31/2012
• Est. Priority Date: 11/26/2010
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Ki Young, An, Gaeil, Kim, Jonghyun, YI, Sungwon
• Application Number:
  US13/198,215
• Publication Number:
  US 20120137361A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

A network security control system includes: a network event generator for generating network events; a security event processing apparatus for collecting the network events from the network event generator via a network and processing the collected network events as a target data for visualization; and a visualization processing apparatus for visualizing the target data to display a security status as a third-dimensional (3D) visualization information on an organization basis.

Claims

1. A network security control system, comprising:

a network event generator for generating network events;

a security event processing apparatus for collecting the network events from the network event generator via a network and processing the collected network events as a target data for visualization; and

a visualization processing apparatus for visualizing the target data to display a security status as a third-dimensional (3D) visualization information on an organization basis.

2. The network security control system of claim 1, wherein the network event generator includes at least one among a traffic monitoring device, a firewall system, an intrusion detection system (IDS), an intrusion preventing system (IPS), and a distribute denial of service (DDoS) detection/response system.

3. The network security control system of claim 1, wherein the security event processing apparatus classifies the network events according to the kind of security event, searches for organization information based on the classified network events, and selects target data for visualization among the classified network events in consideration of the searched organization information and the degree of security threat to deliver the selected target data to the visualization processing apparatus.

4. The network security control system of claim 1, wherein the organization includes an internet service provider (ISP) and/or an autonomous system (AS).

5. The network security control system of claim 1, wherein the 3D visualization information is formed on a 3D multi-disc structure.

6. A security event processing apparatus for a control of a network security, comprising:

a security event classification unit for classifying network events supplied thereto into zombie PC logs and other security logs according to the kind of security event;

an organization information search unit for searching for organization information based on the security event classified by the security event classification unit; and

a security event summarization unit for selecting target data for visualization among the security logs, in consideration of the organization information searched by the organization information search unit and the degree of security threat.

7. The security event processing apparatus of claim 6, wherein the organization information search unit searches for information of an organization to which IPs included in the network events classified as the security logs belong.

8. The security event processing apparatus of claim 6, wherein the organization information includes information of an internet service provider (ISP) and/or an autonomous system (AS).

9. The security event processing apparatus of claim 6, wherein the target data for visualization is selected using several attack detection algorithms and attributes.

10. A visualization processing apparatus for a control of a network security, comprising:

a 3D security visualization unit for displaying, on a multi-disc structure, 3D visualization information representing security status of network events;

a target display unit for displaying visualization information indicating a target organization displayed by the 3D security visualization unit; and

an additional information display unit for displaying summarized security information regarding the target organization displayed by the 3D security visualization unit.

11. The visualization processing apparatus of claim 10, wherein the multi-disc structure is formed in a manner that several discs are piled and cut a part thereof.

12. The visualization processing apparatus of claim 10, wherein the 3D visualization information includes a name, a direction, an amount and/or a type of an attack of a zombie PC.

13. The visualization processing apparatus of claim 10, wherein among the 3D visualization information, an attack type is displayed in a diameter direction of the multi-disc structure, and an attack name is displayed in an arc direction of the multi-disc structure.

14. The visualization processing apparatus of claim 10, wherein the target display unit displays the visualization information using a radar structure.

15. The visualization processing apparatus of claim 14, wherein the visualization information using the radar structure includes a radar needle used to highlight the target organization displayed by the 3D security visualization unit.

16. The visualization processing apparatus of claim 10, wherein the target organization is one of an internet service provider (ISP) and an autonomous system (AS).

17. A network security control method, comprising:

classifying network events according to the kind of security event when the network events have occurred;

searching for organization information based on the classified network events;

selecting target data for visualization among the classified network events in consideration of the searched organization information and the degree of security threat; and

displaying the selected target data as 3D visualization information on a multi-disc structure.

18. The network security control method of claim 17, wherein the network events are classified into zombie PC logs and other security logs, and the target data for visualization is selected among the security logs.

19. The network security control method of claim 17, wherein the 3D visualization information includes a name, a direction, an amount and/or a type of an attack of a zombie PC.

20. The network security control method of claim 17, wherein the organization information includes information of an internet service provider (ISP) and/or an autonomous system (AS).