Apparatus and method of displaying network security situation

An apparatus for displaying a network security situation, comprising:

• an extraction unit configured to classify a characteristic factor including a plurality of transmission node addresses, a plurality of reception node addresses, a plurality of protocols and a plurality of port numbers according to each of a plurality of domains;
• a network visualization unit configured to generate a plurality of transmission source domain circles and a plurality of reception source domain circles representative of traffic events in the network by mapping corresponding node addresses on a circumference of one circle representing each of the plurality of domains, and generate a transmission source network sphere and a reception source network sphere visualized as a sphere shape by arranging the plurality of transmission source domain circles and the plurality of reception source domain circles which are generated on one axis;
• a session construction unit configured to construct a session between a transmission node address on the transmission source network sphere and a reception node address on the reception source network sphere visually;
• and
• a display unit configured to display a real time visualization of the session which is constructed visually,
• wherein the network visualization unit generates a plurality of transmission source protocol circles surrounding the transmission source network sphere and a plurality of reception source protocol circles surrounding the reception source network sphere by mapping the plurality of port numbers on the circumference of one circle representing each of the plurality of protocols and arranges the transmission source network sphere and the transmission source protocol circles surrounding the transmission source network sphere in the reception source network sphere.