대규모 네트워크의 효과적 보안상황 인지를 위한 벌집 구조 시각화 시스템의 설계 및 구현
Design and implementation of the honeycomb structure visualization system for the effective security situational awareness of large-scale networks
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
컴퓨터 네트워크 규모의 지속적 확장과 함께 방화벽, IDS, IPS 등의 각종 보안 시스템들은 네트워크 보안과 관련해더욱더 막대한 양의 정보를 생성하고 있어 보안 담당자가 그 속에 숨겨진 보안 위협의 징후를 탐지하는 일은 더욱 어려워지고 있다. 보안 담당자들의 ‘네트워크의 보안상황 인지’(Network Security Situational Awareness)는 여러관점에서 발생하는 보안 이벤트들 사이의 관계에 기초하여 전체적인 컴퓨터 네트워크의 보안 상황을 효과적으로 판단하는 것으로 이의 과정은 크게 ‘식별’, ‘이해’, ‘예측’의 3단계로 나눠지며, ‘식별’과 ‘이해’는 그 뒤에 이어지는 ‘예측’과 적절한 대응의 전제 조건이 된다. 그러나 다량의 정보들 속에서 ‘식별’과 ‘이해’ 과정은 더욱 어려워지고 있다. 본 논문은 다량의 정보들의 ‘식별’과 ‘이해’ 단계에 효과적인 것으로 알려져 있는 시각화 기법을 적용하여 대규모 네트워크의 보안상황 인지를 돕기 위해 설계한 ‘허니컴’ 시각화 시스템을 제안하고, VAST Challenge 2012의 데이터를 기반으로 실증적인 효과를 확인하였다.
Abstract
Due to the increase in size of the computer network, the network security systems such as a firewall, IDS, IPS generate muchmore vast amount of information related to network security. So detecting signs of hidden security threats has become moredifficult. Security personnels’ ‘Network Security Situational Awareness(NSSA)' is effectively determining the security situation ofoverall computer network on the basis of the relation between the security events that occur in the several views. The processof situational awareness is divided into three stages of the ‘identification,’ ‘understanding’ and ‘prediction’. And ‘identification’and ‘understanding’ are prerequisites for ‘predicting’ and the following appropriate responses. But ‘identification' and‘understanding' in the vast amount of information became more difficult. In this paper, we propose Honeycomb securitysituational awareness visualization system that is designed to help NSSA in large-scale networks by using visualizationtechniques known effective to the ‘identification' and ’understanding’ stages. And we identified the empirical effects of thissystem on the basis of the ‘VAST Challenge 2012’ data.
참고문헌 (17)
- Mica R. Endsley, "Toward a Theory of Situation Awareness in Dynamic Systems", Human Factors, 37(1), pp.32~64 (1995)
- A. D’Amico, "Information Assurance Visualizations for Specific Stages of Situational Awareness and Intended Uses: Lessons Learned", Proc. of VizSEC'05, pp.107~112 (2005), IEEE
- Jang Beom-Hwan, "Security Situational Awareness technique using security event visualization", Review of KIISC, 16(2), pp.18~25 (2006)
- K. Lakkaraju, "NVisionIP: netflow visualizations of system state for security situational awareness", Proc. of VizSEC 2004, pp.65~72 (2004), ACM Press
- X. Yin, "VisFlowConnect: netflow visualizations of link relationships for security situational awareness", Proc. of VizSEC'04, pp.26~34 (2004), ACM Press
- T. Taylor, "Flovis: Flow visualization system", Conference For Homeland Security, 2009. CATCH'09. Cybersecurity Applications & Technology, pp.186~198 (2009)
- S. Krasser, "Real-Time and Forensic Network Data Analysis Using Animated and Coordinated Visualization", Proc. of sixth IEEE Systems, Man and Cybernetics Information Assurance Workshop, pp.42~49 (2005)
- G. Conti, "Passive Visual Fingerprinting of Network Attack Tools", Proc. of VizSEC'04, pp.45~54 (2004)
- Stephen Lau, "The Spinning Cube of Potential Doom", Communications of the ACM, 47(6), pp.25~26 (2004)
- A. Kulsoom, "IDS RainStorm: visualizing IDS alarms", IEEE Workshop on Visualization for Computer Security, pp.1~10 (2005)
- K. Hideki, "SnortView : visualization system of snort logs", The 2004 ACM work-shop on Visualization and data mining for computer security, pp.143~147 (2004)
- S. Hadi, "IDS alert visualization and monitoring through heuristic host selection", ICICS'10Proceedings of the 12th international conference on Information and communications security, 6476, pp.445~458 (2010)
- J. Fuchs, "BANKSAFE: A visual situational awareness tool for large-scale computer networks: VAST 2012 challenge award:Outstanding comprehensive submission, including multiple vizes", Proceedings of the 2012 IEEE Conference on Visual Analytics Science and Technology, pp.257~258 (2012)
- Yarden Livnat, "A visualization paradigm for network intrusion detection", Information Assurance Workshop, 2005. IAW '05. Proceedings from the Sixth Annual IEEE SMC, pp.92~99 (2005)
- Y. Zhao, "a real-time visualization framework for IDS alerts", VINCI '12 Proceedings of the 5th International Symposium on Visual Information Communication and Interaction, pp.11~17 (2012)
- K. Hideki, "SnortView : visualization system of snort logs", The 2004 ACM work-shop on Visualization and data mining for computer security, 143(147), pp.143~147 (2004)
- M. L. Fadel, "Comparing a Text-and Visual-based Interface Presenting Social Information in an Online Environment", Visual Languages and Human-Centric Computing, pp.143~146 (2006)