이기종 시스템 환경에서 연계 분석을 위한 계층적 구조 기반의 로그 데이터 정규화 시스템 연구

Abstract

XDR(eXtended Detection and Response) is a new topic in the security industry. It is a solution to achieve security goals within the enterprise more effectively through integrated linkage analysis of all information in the endpoint and network area. However, for the integrated linkage analysis of XDR, it is necessary to solve the problem of different protocols and information storage methods between heterogeneous security solutions operated within the enterprise. Standardization approaches such as alliance and unified labeling to integrate and analyze different types of data have been proposed. However, those approaches suffer from some practical difficulties that all interworking security solutions are developed based on standard APIs. To overcome the difficulties, in this paper, we propose a new method to normalize the hierarchical structure-based data of the unstructured log, which is the most basic and essential data in the security solution data. The unstructured log data refined through the normalization model algorithm composed of common CODE and Corpus is output in the form of normalized data having a hierarchical structure.