# US 2013/0160074 A1 · Apparatus and method for analyzing rule-based security event association > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160074 A1 - Document ID: US20130160074A1 - Status: Published application - Kind: A1 - Application number: 13/714,362 - Filed: 2012-12-13 - Published: 2013-06-20 - Earliest claimed: 2011-12-16 - Assignees: Electronics and Telecommunications Research Institute - Inventors: Dong Ho KANG - Web page: https://patentgrep.com/patent/US20130160074A1 ## CPC - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/554: {involving event detection and direct action} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus for analyzing rule-based security event association includes a rule management unit to check whether an security event is a candidate security event requiring association analysis, and an event management unit to analyze the candidate security event and check whether the analyzed security event is the candidate security event requiring association analysis. An association processing unit analyzes whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with a user event list to generate an association analysis result. ## Claims ### Claim 1 An apparatus for analyzing rule-based security event association, the apparatus comprising: a rule management unit configured to check whether an security event is a candidate security event requiring association analysis; an event management unit configured to analyze the candidate security event and check whether the analyzed security event is the candidate security event requiring association analysis; and an association processing unit configured to analyze whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with a user event list to generate an association analysis result. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the event management unit checks whether the candidate security event is matched with a plurality of analysis events included in a rule analysis event list, and determines the candidate security event as a security event requiring association analysis when there is an analysis event matched with the security event. ### Claim 3 (depends on 2) The apparatus of claim 2, further including a rule DB for storing the rule analysis event list. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the rule management unit comprises: a rule DB version check unit configured to check whether a version of the rule DB is changed; a rule DB analysis event collection unit configured to read the rule analysis event list from the rule DB; and an event filter unit configured to check whether the security event is an event corresponding to a rule analysis event, with a rule ID of the security event. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the event management unit comprises: an event memory generation unit configured to generate a user event memory for the security event; an event memory deletion unit configured to delete, when the security event is an event that requests deletion of an event memory for a corresponding user, the user event memory for the user; and an event memory management unit configured to manage, when the security event is received, an event memory for a corresponding user. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the event memory management unit requests generation of an event memory for the new user from the event memory generation unit when the security event is an event of an unregistered new user. ### Claim 7 (depends on 3) The apparatus of claim 3, wherein the association processing unit comprises: a rule DB analysis event check unit configured to receive a rule ID and a user ID that correspond to the security event, and check a rule analysis event corresponding to the rule ID; a rule DB association event check unit configured to check whether the security event is matched with the rule analysis event; an event memory request unit configured to check, when the security event is matched with the rule analysis event, an association event corresponding to the user ID; an association check unit configured to analyze whether a user event list corresponding to the user ID is matched with the association event to perform association analysis; and a detection transfer unit configured to receive an association analysis result from the association check unit to supply the association analysis result to the user. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the rule DB analysis event check unit transmits a corresponding user ID of the security event to the user event memory request unit when the security event is matched with the rule analysis event, and transmits a matched rule ID to the rule DB association event check unit. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the rule DB association event check unit requests a corresponding user event list of the security event from the event management unit, and receives the user event list to supply the user event list to the association check unit. ### Claim 10 A method for analyzing rule-based security event association, the method comprising: checking whether a security event is a candidate security event requiring association analysis; checking whether the candidate security event is matched with a rule analysis event; checking, when the candidate security event is matched with the rule analysis event, an association event corresponding to a corresponding user ID of the security event; checking, when the candidate security event is matched with the rule analysis event, a user event list of a corresponding user of the security event; and analyzing whether the association event is matched with the user event list to output an association analysis result. ### Claim 11 (depends on 10) The method of claim 10, wherein said checking whether the security event is a candidate security event requiring association analysis comprises: checking whether the security event is matched with a plurality of analysis events included in a rule analysis event list; and determining, when there is an analysis event matched with the security event, the security event as a candidate security event requiring association analysis. ### Claim 12 (depends on 10) The method of claim 10, wherein said checking the association event comprises transmitting the user ID to a user event memory request unit to check an association event linked to the user ID. ### Claim 13 (depends on 10) The method of claim 10, wherein said checking the user event list comprises transmitting a rule ID of the security event to a rule DB association event check unit to check a corresponding user event list of the matched security event.