An Auto-Verification Method of Security Events Based on Empirical Analysis for Advanced Security Monitoring and Response

摘要: ABSTRACT Domestic CERTs are carrying out monitoring and response against cyber attacks using security devices(e.g., IDS, TMS, etc) based on signatures. Particularly, in case of public resear ch institutes, about 30 center s being operated under National Cyber Security Center(NCSC) Na tional Intelligence Service(NIS). They mainly Threat Management System(TMS) for providing re sponse service. Since TMS raises a large amount events most them not related to real attacks, analyst who carries the suffers from analyzing all finding them. Also, since tasks depend analyst's know -how, there is fatal problem that they tend focus specific events, so it unable ana lyze respond unknown attacks. Therefore, we propose automated verification method their empirical analysis improve performance response. Keywords: Monitoring Response, Automated Verification, Secu rity Events, Empirical Analysis접수일(2014년 3월 11일), 수정일(2014년 5월 20일), 게재확정일(2014년 21일)* 본 연구는 2014년도 미래창조과학부의 수탁사업 ｢과학기술사이버안전센터 구축 및 운영사업｣의 지원을 받아 수행된 연구임(G-14-GM-IR02)† 주저자, kisados@kisti.re.kr‡ 교신저자, song@kisti.re.kr(Corresponding author)