대규모 네트워크의 효과적 보안상황 인지를 위한 벌집 구조 시각화 시스템의 설계 및 구현

Abstract

ABSTRACT Due to the increase in size of the computer network, the network security systems such as a firewall, IDS, IPS generate much more vast amount of information related to network security. So detecting signs of hidden security threats has become more difficult. Security personnels’ ‘Network Security Situational A wareness(NSSA)' is effectively determining the security situation of overall computer network on the basis of the relation between t he security events that occur in the several views. The process of situational awareness is divided into three stages of the ‘identification,’ ‘understanding’ and ‘prediction’. And ‘identifi cation’ and ‘understanding’ are prerequisites for ‘predicting’ and the following appropriate responses. But ‘identification' and ‘understanding' in the vast amount of information became more d ifficult. In this paper, we propose Honeycomb security situational awareness visualization system that is designed to help NSSA in large-scale networks by using visualization techniques known effective to the ‘identification' and ’underst anding’ stages. And we identified the empirical effects of this system on the basis of the ‘VAST Challenge 2012’ data.Keywords: situational awareness, security visualization, honeycomb struc ture