Apparatus and method for analyzing rule-based security event association
AssigneeElectronics and Telecommunications Research Institute
InventorDong Ho KANG
Life of this patent
Estimating the term…
Abstract
An apparatus for analyzing rule-based security event association includes a rule management unit to check whether an security event is a candidate security event requiring association analysis, and an event management unit to analyze the candidate security event and check whether the analyzed security event is the candidate security event requiring association analysis. An association processing unit analyzes whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with a user event list to generate an association analysis result.
Claims13
An apparatus for analyzing rule-based security event association, the apparatus comprising:
- a rule management unit configured to check whether an security event is a candidate security event requiring association analysis;
- an event management unit configured to analyze the candidate security event and check whether the analyzed security event is the candidate security event requiring association analysis;
- and
- an association processing unit configured to analyze whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with a user event list to generate an association analysis result.
A method for analyzing rule-based security event association, the method comprising:
- checking whether a security event is a candidate security event requiring association analysis;
- checking whether the candidate security event is matched with a rule analysis event;
- checking, when the candidate security event is matched with the rule analysis event, an association event corresponding to a corresponding user ID of the security event;
- checking, when the candidate security event is matched with the rule analysis event, a user event list of a corresponding user of the security event;
- and
- analyzing whether the association event is matched with the user event list to output an association analysis result.
Dependencies are inferred from the claim text.