KR102540904B1 - A security total management system for weak security management based on big data and a total method of security - Google Patents

Abstract

A total security management system according to an embodiment of the present invention includes an asset management module that scans a target system, which is a system requiring security, and calculates asset information, which is information about assets in the target system; and a management interface module that calculates an interface for displaying the asset information on a display, wherein the asset information may be information that can be classified for each person in charge.

Description

Total security management system and total security management method for big data-based vulnerability security management

The present invention relates to a security total management system and a security total management method capable of managing big data-based security-vulnerable assets using a digital twin.

Along with the increase in information system assets, operating systems (OS) in various environments, application programs (APPLICATION) for mobile terminals, and security solutions are being developed and used. Security events recorded in such diverse environments are also stored in various forms, and their capacity is growing rapidly.

Security services in the early days were mainly basic services that operated the network security system and monitored various events occurring in the equipment. However, recently, as hacking techniques such as homepage alteration or leakage of important information have become increasingly intelligent, specialized, and advanced, a problem has arisen that basic security services cannot perfectly perform system security.

The present invention is to solve the above problems, and to provide a total security management system and a total security management method capable of autonomously analyzing and solving system security problems.

However, the technical problem to be achieved by the present embodiment is not limited to the technical problems described above, and other technical problems may exist.

A total security management system according to an embodiment of the present invention includes an asset management module that scans a target system, which is a system requiring security, and calculates asset information, which is information about assets in the target system; and a management interface module that calculates an interface for displaying the asset information on a display, wherein the asset information may be information that can be classified for each person in charge.

In addition, the asset management module may calculate the asset information based on the importance of the asset.

In addition, a schedule management module that performs mediation for application and approval for the inspection of the asset and calculates an asset inspection schedule, wherein the management interface module includes an interface on which the asset inspection schedule can be displayed. can be calculated

In addition, the schedule management module may provide a notification to a person in charge of inspection prior to a predetermined period from the inspection date of the asset.

In addition, an action module for calculating action status information, which is information on the action status of the assets determined to be vulnerable among the assets requested for inspection, further comprising, the management interface module, the action status information can be displayed interface can be calculated.

In addition, a vulnerability management module that calculates and stores processing details of assets requested for inspection; and the management interface module may calculate an interface that allows the processing details to be displayed.

In addition, a simulation module for creating a virtual system that is a virtual system corresponding to the target system by mimicking the target system in a virtual world, a control module for operating the virtual system in response to the operation of the target system, and the virtual system. A digital twin module including a simulation module that simulates the system and optimizes the security of the target system based on the simulation result; may be further included.

In addition, the digital twin module may further include an association module that links the individually configured virtual systems with each other and an autonomous module that recognizes a problem of the autonomously associated virtual systems and calculates a solution.

Total security management method according to an embodiment of the present invention, in the total security management method implemented by the total security management system, asset information that is information about assets in the target system by scanning a target system, which is a system requiring security. is calculated; Receiving a request for inspection of the asset; Calculating an inspection schedule for the asset; and receiving and displaying a result of inspection of the asset and a measure for a vulnerability, and the asset information may be information that can be classified for each person in charge.

In addition, the asset information may be information that can be classified based on the importance of the asset.

The security total management system for vulnerable security management based on the digital twin according to the present invention can increase the efficiency of asset management.

In addition, security performance can be maximized.

In addition, an integrated security service can be provided.

In addition, convenience of use can be maximized.

However, the effects of the present invention are not limited to the above-mentioned effects, and effects not mentioned will be clearly understood by those skilled in the art from this specification and the accompanying drawings.

1 is a relationship diagram of a total security management system according to an embodiment of the present invention
2 is a block diagram of a total security management system according to an embodiment of the present invention
3 is a diagram showing the relationship and functions of a first to fourth security module included in an automatic security management system of a total security management system according to an embodiment of the present invention.
4 is a flow chart of security management implemented by the security asset management system of the security total management system according to an embodiment of the present invention.
5 to 7 are examples of interfaces displayed by a management interface module included in a secure asset management system according to an embodiment of the present invention.
8 is a diagram for explaining the functions of a digital twin module included in an automated security management system according to an embodiment of the present invention.
9 to 11 are diagrams illustrating examples of interface screens provided by an interface module included in an automatic security management system according to an embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. However, the spirit of the present invention is not limited to the presented embodiments, and those skilled in the art who understand the spirit of the present invention may add, change, delete, etc. other elements within the scope of the same spirit, through other degenerative inventions or the present invention. Other embodiments included within the scope of the inventive idea can be easily proposed, but it will also be said to be included within the scope of the inventive concept.

1 is a relationship diagram of a total security management system according to an embodiment of the present invention, FIG. 2 is a configuration diagram of a total security management system according to an embodiment of the present invention, and FIG. It is a diagram showing the relationship and functions of the first to fourth security modules included in the automated security management system of the total security management system according to FIG.

Referring to FIG. 1 , a total security management system according to an embodiment of the present invention may include an automatic security management system 100 and a secure asset management system 200 .

The automatic security management system 100 may be a system that performs tasks such as management, control, simulation, prediction, and response in order to implement network security of a target system composed of devices 10 .

To this end, the automatic security management system 100 may be communicatively connected to the device by wire/wireless, and may collect logs generated in operation from the device.

Here, the device may include a computing device, a server, a computer peripheral, an input/output device, a communication device, a security device, and the like, and the present invention is not limited to those listed, and various modifications are apparent to those skilled in the art. possible.

The network referred to in the present invention may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet, etc. It can mean a worldwide open computer network structure that provides HTTPS (Hyper Text Transfer Protocol Secure), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), etc. It comprehensively means a data communication network capable of transmitting and receiving data in various forms without being limited thereto.

The server referred to in the present invention may include other configurations for performing the server environment of the server. The server may include any type of device.

As an example, the server may be a digital device, such as a laptop computer, a notebook computer, a desktop computer, a web pad, or a mobile phone, which includes a processor and a memory and arithmetic capability.

As an example, the server may be a web server. However, it is not limited to this, and the type of server can be variously changed at a level obvious to those skilled in the art.

A computing device referred to in the present invention may refer to a device capable of processing information processing operations.

For example, the computing device may include a mobile terminal including a desktop computer, a laptop computer, a smart phone, a personal digital assistant (PDA), a portable multimedia player (PMP), a portable terminal, and/or a smart TV.

The automatic security management system 100 may be connected wired/wireless to enable information communication with a user terminal.

A user terminal is a terminal used by a user and may be referred to as a user below.

The user terminal may include a mobile terminal including a desktop computer, a laptop computer, a smart phone, a portable multimedia player (PMP), a portable terminal, and/or a smart TV as well as a wireless communication device, a mobile phone, and a PDA.

The security asset management system 200 may provide a management platform for inspecting vulnerabilities of assets of a target system and inspecting and taking action on assets.

Here, the asset includes the device and includes an application program installed on the device, an operating system, and the like, and may also include a web, an app, and the like.

The security asset management system 200 may communicate information with the automatic security management system 100 to receive a solution to a vulnerability of an asset.

2 and 3, the automatic security management system 100 according to an embodiment of the present invention implements the security of a target device, which is a device constituting a target system, which is an arbitrary system, or software installed on the target device. A first security module 110 that collects logs transmitted from the target device, a log collection module 150 that collects logs from the log collection module 150, the first security module 110 provides The second security module 120 that provides a security solution for integrated security management, the third security module 130 that provides a big data-based security solution through the logs collected by the log collection module 150, and the log A fourth security module 140 that provides an artificial intelligence-based security solution through logs collected by the collection module 150 may be included.

In addition, the automatic security management system 100 includes a digital twin module 160 that creates, simulates, and manages a virtual system corresponding to the target system and an interface module that provides an interface for displaying information about the virtual system ( 170) may be further included.

In addition, the automatic security management system 100 may further include a feedback module 180 that compares the log predicted by the digital twin module 160 with the actual log of the target system.

In addition, the automatic security management system 100 may further include a check module 190 disposed in the device and transmitting an input signal to the feedback module 180 by an external force.

The first security module 110 may implement device terminal security, network (NMS) security connecting devices, and log-based management.

As a specific example, the first security module 110 may implement USB security management, DRM encryption, output security, file forgery prevention, operating system security management, DLP (patch control), and e-mail security.

In addition, the first security module 110 may implement security such as APT, DDoS, IPS/IDS, web spam blocking, network forensic, NAS, wireless IPS, and firewall.

The firewall installs routers or application gateways so that all information flows only through them, so that information transmitted between a network inside a company or organization and the Internet can be selected and accepted, rejected, or modified.

The intrusion detection system (IDS) collects and analyzes security events occurring in the management target system, and when it detects malicious network traffic, it can perform a function of alerting an administrator of this fact.

The intrusion prevention system (IPS) collects and analyzes security events occurring in the management target system, and when it detects malicious network traffic, it alerts an administrator of this fact and can perform a function of immediately blocking it.

Since the above-described security algorithm utilizes a known technology, a detailed description thereof may be omitted.

In addition, the security method provided by the first security module 110 is not limited to the specific security method described above and can be modified in various ways at a level obvious to those skilled in the art.

The log collection module 150 may receive and store logs generated while the device operates from the target device.

The second security module 120 may integrate and control security provided by the first security module 110 .

As an example, the second security module 120 is an RDBMS-based limited data storage / analysis system, which can provide enterprise security management (ESM) security solutions and risk management systems (RMS). there is.

The risk management system (RMS) collects and analyzes security events targeting IT (Information Technology) assets of the management target system, such as various security devices or network devices (eg, servers, routers, etc.) to detect vulnerabilities and threats. By identifying and responding in advance, security incidents can be prevented in advance and the security level can be stably managed at all times.

However, it is not limited thereto, and can be variously modified at a level obvious to those skilled in the art.

In the third security module 130, when a security problem occurs in the device, log records of the device may be converted into big data and stored. Here, log records and security issues may be stored in correspondence with each other.

In addition, a solution for solving a security problem may also be stored correspondingly.

Here, data stored in big data may include both structured data and unstructured data.

The third security module 130 determines that a security problem has occurred when a specific log record occurs in the target device based on the big data information, solves the security problem in a predetermined response method, or provides a solution to the security problem. can present

The third security module 130 may provide a SIEM security solution as a big data-based security information and event management system. For example, privacy monitoring security (PIMS), user behavior analysis security (UBA), CPS security (IoT threat analysis), breach threat prevention security (TMS), and malware/vulnerability detection security (VMS) can be implemented. there is.

The threat management system (TMS) collects and analyzes security events occurring in the managed system, detects and identifies cyber threats in network traffic, and comprehensively analyzes them to provide early warning.

In addition, the security method provided by the third security module 130 is not limited to the specific security method described above and can be modified in various ways at a level obvious to those skilled in the art.

The fourth security module 140 may provide an artificial intelligence-based security solution through logs collected by the log collection module 150 .

For example, the fourth security module 140 performs deep learning based on device specifications, security problem information generated in the device, log records generated in the device, solution information for solving security problems, and the like, to determine whether a security problem has occurred. It is possible to calculate and save a security automation model that determines itself, predicts that a security problem will occur, optimizes devices in preparation for a security problem, and calculates a solution when a security problem occurs.

A specific algorithm for deep learning uses a known algorithm, and a detailed description thereof may be omitted as it is obvious to those skilled in the art.

For example, the fourth security module 140 may provide a security orchestration-automation-response (SOAR) security solution.

However, it is not limited thereto, and can be variously modified at a level obvious to those skilled in the art.

The automatic security management system 100 may provide an integrated security solution by comprehensively managing the security of the target system by comprehensively managing the first security module 110 to the fourth security module 140 .

A secure asset management system according to an embodiment of the present invention includes an asset management module 210 that scans a target system, which is a system requiring security, and calculates asset information, which is information about assets in the target system, and A schedule management module 230 that intermediaries for application and approval and calculates an asset inspection schedule, and an action module that calculates action status information, which is information on the action status of assets determined to be vulnerable among assets requested for inspection. 240, a vulnerability management module 220 that calculates and stores processing details of assets requested for inspection, and a management interface module 260 that calculates an interface for displaying various types of information on a display.

In addition, the secure asset management system may further include an exception handling module 270 that stores and manages an exception handling list that does not exceptionally perform asset inspection.

4 is a flowchart of security management implemented by the security asset management system of the security total management system according to an embodiment of the present invention.

The total security management method may include an automatic security management method implemented by an automatic security management system and a security asset management method implemented by a secure asset management system.

Referring to FIG. 4 , a secure asset management method implemented by a secure asset management system includes: scanning a target system, which is a system requiring security, to calculate asset information, which is information about assets in the target system; Receiving a request for inspection of the asset; The method may include deriving a vulnerability of the asset, calculating an inspection schedule for the asset, receiving and displaying a result of the inspection of the asset and a measure for the vulnerability.

Here, the asset information may be information that can be classified for each person in charge.

In addition, the asset information may be information that can be classified based on the importance of the asset.

Hereinafter, each module of the secure asset management system and each step of the secure asset management method will be described in detail.

5 to 7 are examples of interfaces displayed by a management interface module included in a secure asset management system according to an embodiment of the present invention.

Referring to FIG. 5 , the asset management module may periodically scan the target system and monitor newly added or removed assets.

Through this, the asset management module can regularly update the assets of the target system.

The management interface module may calculate and provide an interface for displaying the asset information on a display to a user.

Also, the management interface module may provide a user terminal with an interface through which a manager or a user (hereinafter referred to as a user) may register new assets.

Also, the management interface module may provide a user terminal with an interface through which a user may delete an already registered asset or modify information on an asset.

The asset information may be distinguishable information for each person in charge.

Asset information may be a number, group, or asset classification for each asset.

In addition, the asset information may include operating system information of the asset, HOST name, IP address, whether or not inspection is possible, whether or not the asset has been completed, and importance.

The asset management module may calculate the asset information based on the importance (CIP) of the asset.

For example, the asset management module may calculate the importance of the asset after evaluating the asset in terms of confidentiality, integrity, and availability.

The vulnerability scan module can scan and analyze vulnerabilities of assets.

For example, the vulnerability scan module may utilize a commercially available vulnerability scanner. For example, nexpose, AppScan, FORTIFY, SSEC, etc. The present invention is not limited thereto, and the type of vulnerability scanning module can be variously modified at a level obvious to those skilled in the art.

The schedule management module may mediate an application for inspection of assets of the target system, application status, and payment, and may provide information generated by mediation to the management interface module.

The schedule module may calculate an asset inspection schedule so that inspection times of assets do not overlap each other.

The schedule management module may provide a notification to a person in charge prior to a predetermined period from the inspection date of the asset.

In one example, the predetermined period may be 3 days.

That is, if July 15 is the inspection day, the schedule management module may provide a notification to a person designated as the person in charge of the inspection asset on July 11, which is three days before.

However, the predetermined period is not limited thereto and can be variously modified at a level obvious to those skilled in the art.

For example, the notification may be SNS, e-mail, etc., but the present invention is not limited thereto.

The management interface module can provide the user or approver with an interface that allows the schedule module to intervene by receiving the inspection request from the user, allowing the approver to pay for the inspection application, and checking the progress and result of the approval. .

The management interface module may provide an interface for displaying an asset inspection schedule.

The management interface module may provide an interface displayed for the status of asset inspection.

Referring to FIG. 6 , the action module may calculate action status information, and the management display module may calculate an interface capable of displaying the action status information to the user.

Action status information may include various types of information for each asset.

For example, action status information is by asset, asset name, inspection identification (type of vulnerability scan module), IP/File, PORT, vulnerability name, inspection cycle, risk level, person in charge, inspection date, registration date, person in charge's opinion, security officer Comments may be included.

Through this, it is possible to easily grasp the inspection status and action status of assets at a glance.

Referring to FIG. 7 , the vulnerability management module may calculate and store processing details of assets requested for inspection.

The management interface module may generate an interface through which asset processing details may be displayed on the user terminal.

For example, asset processing details include asset name, vulnerability name, vulnerability status (non-action, false detection, risk acceptance, planned action, action completed, exception handling), IP/File, document status, remaining period, person in charge, opinion of person in charge In this case, the opinion of the security officer may be classified and included for each asset. However, it is not limited to this, and specific information on the processing details of assets can be variously modified at a level obvious to those skilled in the art.

The exception handling module may provide the exception handling list to the asset management module, the schedule management module, the action module, and/or the vulnerability management module.

The asset management module, the schedule management module, the action module, and/or the vulnerability management module may update managed data based on the exception processing list, exclude them from the schedule, or exclude inspection. These processes can be done automatically.

In this way, the user or the person in charge can conveniently manage exception management assets without constantly following up exception handling assets.

The security asset management system may transfer vulnerability of the asset to the automatic security management system and receive a solution to the vulnerability or problem.

Specifically, the third security module or the fourth security module may provide a solution.

The management interface module may generate an interface capable of providing solutions to identified vulnerabilities or problems to a person in charge or a user.

8 is a diagram for explaining the functions of a digital twin module included in an automatic security management system according to an embodiment of the present invention.

Referring to FIG. 8, the digital twin module simulates the target system in a virtual world and creates a virtual system, which is a virtual system corresponding to the target system. and a simulation module that simulates the virtual system and optimizes the security of the target system based on the simulation result.

In addition, the digital twin module may further include an association module that links the individually configured virtual systems with each other and an autonomous module that recognizes problems of the autonomously associated virtual systems and calculates solutions.

The simulation module can build a virtual system by virtually moving an independent target system.

To this end, information about devices, information about a network method and apparatus for connecting devices, and log information generated by devices may be collected.

The control module may operate the virtual system and monitor the virtual system based on information including logs generated as the target system is operated.

The simulation module simulates the virtual system, and when a security problem occurs in the virtual system, it may suggest a previously stored countermeasure or newly calculate a countermeasure.

In addition, the simulation module can predict a security problem that may occur in the virtual system in the future based on logs and security problems generated in the past virtual system.

The user can control and manage each corresponding system based on the information provided by the simulation module.

The federation module can reconstruct the virtual world complexly by interconnecting optimized individual response systems.

Here, the federation module may construct a virtual system optimally so that the interoperability of the corresponding systems is maximized and efficiently, suggest layout, specifications, and control methods of the target system optimized for the user, and control and manage the target system.

The autonomic module can autonomously recognize and solve problems by monitoring and inspecting each virtual system and composite virtual system, thereby optimizing the response system.

The autonomous module includes information about an arbitrary system, information about devices and network configurations that make up an arbitrary system, log information generated in the system, information about security risk situations, information about solutions, information about various external ransomware or viruses. An autonomous model may be stored that predicts a security problem and calculates a system optimization solution to solve the problem by deep learning based on information and information on countermeasures.

That is, the autonomous module analyzes the virtual system, predicts security problems that may occur in the future, calculates ways to optimize the target system to prevent the predicted security problems, and autonomously controls the target system. can

The interface module can visualize information about the virtual system produced by the digital twin module and provide it to the user terminal.

9 to 11 are diagrams illustrating examples of interface screens provided by an interface module included in an automatic security management system according to an embodiment of the present invention.

The interface module may provide an interface displaying at least one of performance of the virtual system, security level of the virtual system, and traffic of the virtual system.

The interface module may provide an interface displaying a network connecting the individually configured corresponding systems to each other.

Referring to FIGS. 9 to 11 , service performance (Service KPI) may be displayed on the user terminal. For example, it may be displayed whether each performance for Wired Service, Wireless Service, NB-IoT, and International Roaming implements Availability, Performance, and Security well. Here, availability, performance, security, and total performance may be converted into scores between 0 and 100 and displayed.

Also, operation performance (Operational KPI) may be displayed on the user terminal.

Also, information on hacking may be displayed on the user terminal.

For example, information on Cyber Kill Chain may be displayed on the user terminal, and specifically, the number of occurrences of infection, privilege escalation, scanning, lateral movement, C&C, and data theft may be displayed as a graph.

In addition, information on TIP (Treat Intelligence Prediction) may also be displayed on the user terminal.

Here, it may be divided and displayed on a daily basis, a weekly basis, and a yearly basis.

In addition, the user terminal may display system traffic generated so far and network traffic predicted in the future in the form of a graph.

In addition, a network connecting individually configured corresponding systems may be displayed on the user terminal.

Here, when there is no problem in security, a network may be displayed in yellow, and a network in which a problem in security occurs or is expected to have a problem in security may be displayed in red.

Through this, users can intuitively see which parts are dangerous in terms of security.

The feedback module compares the log predicted by the digital twin with the actual log of the target system, and when the actual log differs from the predicted log, it can respond appropriately in a predetermined method.

Here, the log to be compared may compare the predicted log and the actual log based only on logs generated when a typical function of the device is implemented.

When the difference between the log predicted by the digital twin module and the actual log generated in the target system is equal to or greater than the first number of times, the feedback module predicts the model of the digital twin module based on the actual log generated in the target system. In order for this to be corrected, information may be provided to the digital twin module.

Here, the predictive model may include the above-described autonomous model and a predictive model for predicting the simulation module.

The feedback module may deliver information about the actual log to the digital twin module.

The digital twin module may modify the prediction model based on the actual log provided from the feedback module.

That is, the digital twin module (specifically, the simulated module and / or autonomous module) analyzes the cause of the difference between the predicted log and the actual log, changes and supplements the judgment algorithm in the prediction model according to the difference, and predicts The model can be recalculated.

The digital twin module can re-predict information such as security threats and traffic that may occur in the virtual system based on the re-calculated prediction module, and re-control the target system.

As this process is repeated, the prediction accuracy of the predictive model may gradually increase.

For example, the first number of times may be 30 times. However, the first number of times is not limited thereto and can be variously modified at a level obvious to those skilled in the art.

When the difference between the log predicted by the digital twin module and the actual log generated in the target system is greater than the second number and is less than or equal to the third number, the feedback module calculates a device whose prediction is out of sync and a device related to the discrepancy in prediction. and provide the calculated error device list to the interface module.

The interface module may calculate and provide an interface UI so that a list of faulty devices is displayed on the user terminal.

The user can identify and manage problematic devices at once based on the list of error devices provided.

For example, the second number of times may be 60 times. However, the second number of times is not limited thereto and can be variously modified at a level obvious to those skilled in the art.

If the difference between the log predicted by the digital twin module and the actual log generated in the target system exceeds the third number, the feedback module may provide a warning notification to the user to check the error device through the interface module. there is.

The warning alarm sent by the feedback module to the user (terminal) may be continuously transmitted until all input signals are received from the inspection module attached to the outer surface of the faulty device.

A plurality of inspection modules exist and are attached to each device, and may be connected to the attached device through wired/wireless information communication.

The inspection module includes a housing part attached and fixed to the outside of the device, a communication part located inside the housing part and capable of wired/wireless information communication with the device, a button part formed in the housing part and capable of position movement by external force, and the button part. When an external force is applied to the button unit to be pressed, an input signal is generated and a signal generator for transmitting the input signal to the communication unit may be provided.

When the user presses the button, the signal generated by the signal generating unit may be transmitted to the feedback module through the communication unit.

Here, not only the input signal but also identification information capable of identifying the inspection module sending the input signal may be delivered to the feedback module.

In the feedback module, the identification number of the inspection module can be stored in correspondence with information about the device, so which inspection module is the input signal transmitted from? can be easily figured out.

The feedback module continuously transmits input signals to the user until all input signals are received from the faulty device, so that the user can force the user to check all faulty devices.

For example, the third number of times may be 100 times. However, it is not limited thereto, and the third number of times can be variously modified at a level obvious to those skilled in the art.

Here, the error device may mean a device whose prediction is out of sync and a device related to the one where the prediction is out of sync.

Here, the feedback module may count the number of differences between the log predicted by the digital twin module and the actual log generated in the target system at a predetermined periodicity.

As an example, the predetermined period may be 30 days, but is not limited thereto, and the predetermined period may be variously modified at a level apparent to those skilled in the art.

In an automatic security management method according to an embodiment of the present invention, in the automatic security management method implemented by an automatic security management system, logs transmitted from the target device are collected by using a log collection module of the automatic security management system. log collection step, which is a step, and the first step, which is a step in which security of a target device, which is a device constituting a target system, or a software installed on the target device, is provided by using the first security module of the automatic security management system. Security step, a step of providing a security solution that integrates and manages the security provided by the first security module through the collected logs using the second security module of the automatic security management system, the automatic security management system Using the third security module of the management system, the third security step, which is a step in which a big data-based security solution is provided through the collected logs, and the fourth security module of the automatic security management system, the collected logs A fourth security step, which is a step of providing an artificial intelligence-based security solution, may be included.

Here, the second security step may provide an ESM security solution.

In addition, the third security step may provide a SIEM security solution.

In addition, the fourth security step may provide a SOAR security solution.

In the accompanying drawings, in order to more clearly express the technical idea of the present invention, components that are not related to or detached from the technical idea of the present invention are briefly expressed or omitted.

In the above, the configuration and characteristics of the present invention have been described based on the embodiments according to the present invention, but the present invention is not limited thereto, and various changes or modifications can be made within the spirit and scope of the present invention. It is apparent to those skilled in the art, and therefore such changes or modifications are intended to fall within the scope of the appended claims.

100: security automatic management system 200: security asset management system
210: asset management module 220: vulnerability management module

Claims (10)

an asset management module that scans a target system, which is a system requiring security, and calculates asset information, which is information about assets in the target system;
a management interface module that calculates an interface in which the asset information is displayed on a display;
a simulation module that simulates the target system in a virtual world and creates a virtual system corresponding to the target system;
a control module that operates the virtual system in response to the operation of the target system;
a digital twin module having a simulation module that simulates the virtual system and optimizes the security of the target system based on the simulation result;
an interface module providing an interface displaying at least one of performance of the virtual system, security of the virtual system, and traffic of the virtual system; and
The log predicted by the digital twin module and the actual log of the target system are compared with each other, and if there is a difference between the predicted log and the actual log, a device that is out of prediction and an error device that is a device related to the mismatch of prediction A feedback module that calculates and provides the calculated list of faulty devices to an interface module or provides a warning notification to a user terminal to check faulty devices through the interface module, and responds thereto;
The interface module provides an interface in which a network connecting individually configured corresponding systems to each other is displayed. When there is no problem with security, the network is displayed in yellow, and a problem with security occurs or a problem with security occurs. If it is predicted that it will be, the network is displayed in red,
The asset information is information that can be classified by person in charge,
Security total management system.
According to claim 1,
The asset management module,
Calculating the asset information based on the importance of the asset,
Security total management system.
According to claim 1,
A schedule management module for performing mediation for application and approval for inspection of the asset and calculating an asset inspection schedule; further comprising,
The management interface module,
Calculating an interface on which the asset inspection schedule can be displayed,
Security total management system.
According to claim 3,
The schedule management module,
Providing a notification to the person in charge of inspection before a predetermined period from the inspection date of the asset,
Security total management system.
According to claim 3,
An action module for calculating action status information, which is information on the action status of the assets determined to be vulnerable among the assets requested for inspection;
The management interface module,
Calculating an interface on which the action status information can be displayed,
Security total management system.
According to claim 5,
A vulnerability management module that calculates and stores processing details of assets requested for inspection; further includes;
The management interface module,
Calculating an interface that allows the processing details to be displayed,
Security total management system.
delete According to claim 1,
The digital twin module,
Further comprising an association module for linking the individually configured virtual systems with each other and an autonomous module for recognizing problems of the autonomously associated virtual systems and calculating solutions,
Security total management system. delete delete

Images