Method and apparatus for visualizing network security state

A method of visualizing a network security state, the method comprising:

• collecting original security event information from network security apparatuses;
• extracting characteristics data corresponding to a certain security event by analyzing the collected original security event information;
• mapping IP address information of the extracted characteristics data on an IP address map that is a matrix formed of 28×28;
• and
• mapping a source port, a destination port, and protocol information of the extracted characteristics data on a protocol cube that is a three-dimensional space formed of a plurality of protocol planes having a first axis designating information corresponding to a port number of a certain protocol and a second axis designating a number of events occurring at a port of the protocol, and wherein the protocol cube is spatially located between the source IP address map and the destination IP address map.

A method of visualizing a network security state, the method comprising:

• collecting original security event information from network security apparatuses;
• extracting characteristics data corresponding to a certain security event by analyzing the collected original security event information;
• mapping IP address information of the extracted characteristics data on a source IP address map that is a matrix formed of 28×28 and a destination IP address map that is a matrix formed of 28×28;
• mapping a source port, a destination port, and protocol information of the extracted characteristics data on a protocol cube that is a three-dimensional space formed of a plurality of two-dimensional protocol planes having a first axis designating information corresponding to a port number of a certain protocol and a second axis designating a number of events occurring at a port of the protocol;
• wherein the protocol cube is spatially located between the source IP address map and the destination IP address map.