Apparatus and method for visualizing network state by using geographic information

A method of displaying the state of a network using geographic information, comprising:

• a security event collecting step of collecting security events from the outside;
• an IP address converting step of converting a source IP address and a destination IP address in characteristic data of the security events collected in the security event collecting step into geographic information;
• a network state displaying step of displaying the flow of security events for each protocol between a source and a destination as an image including first and second globe shapes, on the basis of the characteristic data and the geographic information converted in the IP address converting step;
• displaying a plurality of protocol circles arranged around the first and second globes, each of the plurality of protocol circles corresponding to a network protocol;
• indicating an actual geographic position of a source corresponding to the source IP address on the first globe;
• indicating an actual geographic position of a destination corresponding to the destination IP address on the second globe;
• and
• displaying a plurality of protocol circles arranged around the first and second globes, each of the plurality of protocol circles corresponding to a network protocol.

A non-transitory computer readable medium including a computer executable program thereon, the non-transitory computer readable medium comprising:

• code for collecting security events from the outside;
• code for converting a source IP address and a destination IP address in characteristic data of the collected security events into corresponding geographic information on the basis of information stored in a geographic information database;
• and
• code for displaying the flow of security events for each protocol between a source and a destination as an image including three-dimensional elements comprising a first globe shape and a second globe shape, on the basis of the characteristic data and the geographic information transmitted from the IP address converting unit, the first globe shape indicating an actual geographic position of the source corresponding to the source IP address and the second globe shape indicating an actual geographic position of the destination corresponding to the destination IP address, and further configured to display a plurality of protocol circles arranged around each of the first and second globes, each of the plurality of protocol circles corresponding to one of a plurality of network protocols.