WO2009038248A1 - Apparatus and method for visualizing network state by using geographic information - Google Patents

Apparatus and method for visualizing network state by using geographic information Download PDF

Info

Publication number
WO2009038248A1
WO2009038248A1 PCT/KR2007/005903 KR2007005903W WO2009038248A1 WO 2009038248 A1 WO2009038248 A1 WO 2009038248A1 KR 2007005903 W KR2007005903 W KR 2007005903W WO 2009038248 A1 WO2009038248 A1 WO 2009038248A1
Authority
WO
WIPO (PCT)
Prior art keywords
destination
address
source
protocol
globe
Prior art date
Application number
PCT/KR2007/005903
Other languages
French (fr)
Inventor
Seongyoung Sohn
Beomhwan Chang
Chiyoon Jeong
Geonlyang Kim
Jonghyun Kim
Jongho Ryu
Jungchan Na
Jongsoo Jang
Sungwon Sohn
Original Assignee
Electronics And Telecommunications Research Institute
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Electronics And Telecommunications Research Institute filed Critical Electronics And Telecommunications Research Institute
Priority to US12/679,294 priority Critical patent/US8266278B2/en
Publication of WO2009038248A1 publication Critical patent/WO2009038248A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the present invention relates to a network security, and more particularly, to an apparatus and method for displaying the state of a network between a source and a destination.
  • the ratio of any one of traffic information items of a network is used to analyze a change in the corresponding item, in order to detect network errors (that is, abnormal situations caused by attacks).
  • data transmitted over a network is displayed on a coordinate plane or as a geometric figure according to a predetermined protocol, thereby displaying the abnormal situations of the entire network (Reference Document 1 ; Korean Patent Application No. 10-2003-0008826, and Reference Document 2; IEEE Network Vol. 18, No. 5, PP. 30-39, September/October 2004, Hyogon Kim, Inhye Kang, Saewoong Bahk, Real- Time Visualization of Network Attacks on High-Speed Links).
  • the invention has been finalized in an effort to solve the above-mentioned problems, and an object of the invention is to provide an apparatus and method for displaying the state of a network using geographic information that is capable of enabling a user to intuitively recognize the current network security situation by displaying, on globes, the actual geometric positions of a source and a destination and the flow of security events for each protocol, on the basis of geographic information and characteristic data included in security events.
  • an apparatus for displaying the state of a network using geographic information includes: a security event collecting unit that collects security events from the outside; an IP address converting unit that converts a source IP address and a destination IP address in characteristic data of the collected security events into geographic information on the basis of information stored in a geographic information database; and a network state display unit that displays the flow of security events for each protocol between a source and a destination as an image including a three-dimensional globe shape, on the basis of the characteristic data and the geographic information transmitted from the IP address converting unit.
  • the IP address converting unit may include: a characteristic data extracting module that extracts the characteristic data from the security events collected by the security event collecting unit; and a source and destination position extracting module that extracts, from information stored in the geographic information database, the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the extracted characteristic data.
  • the source and destination position extracting module may use information including a latitude and longitude for each IP stored in the geographic information database.
  • the network state display unit may display a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
  • Port numbers of protocols may be mapped along the circumference of each of the protocol circles.
  • the network state display unit may display the one or more protocol circles in different colors.
  • the network state display unit may display a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe.
  • the line linking the actual position of the source and the actual position of the destination may pass through the protocol circles corresponding to the same protocol in the first globe and the second globe.
  • the network state display unit may display the number of security events for each port as a figure having a predetermined size on the protocol circle.
  • the network state display unit may display only the flow of security events related to the selected port.
  • the network state display unit may include: a globe generating module that generates a first globe for displaying the actual position of the source corresponding to the source IP address and a second globe for displaying the actual position of the destination corresponding to the destination IP address; a protocol circle generating module that generates at least one protocol circle that is arranged around each of the first and second globes; and a security event flow display module that displays a line linking the actual position of the source and the actual position of the destination, the line passing through the protocol circle of the first globe and the protocol circle of the second globe.
  • a method of displaying the state of a network using geographic information includes: a security event collecting step of collecting security events from the outside; an IP address converting step of converting a source IP address and a destination IP address in characteristic data of the security events collected in the security event collecting step into geographic information; and a network state displaying step of displaying the flow of security events for each protocol between a source and a destination as an image including a three-dimensional globe shape, on the basis of the characteristic data and the geographic information converted in the IP address converting step.
  • the IP address converting step may include: a characteristic data extracting step of extracting the characteristic data from the security events collected in the security event collecting step; and a source and destination position extracting step of extracting, from information stored in a geographic information database, the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the characteristic data extracted in the characteristic data extracting step.
  • the network state displaying step may display a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
  • Port numbers of protocols may be mapped along the circumference of each of the protocol circles.
  • the network state displaying step may display a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe.
  • the network state displaying step may display the number of security events for each port as a figure having a predetermined size on the protocol circle.
  • the network state displaying step may display only the flow of security events related to the selected port.
  • the structure of the invention since the actual positions of a source and a destination are displayed on globes, a user can rapidly and accurately check places where security events are generated. That is, since the globe that everybody can easily understand is used, it is possible to easily check the actual positions of the destination and the source of security events.
  • the protocol circles are used to display a plurality of protocols and the number of security events for each port of the protocols on one screen together with the globes. Therefore, an administrator can easily check the current state of a network.
  • the invention can be automated by a program. In this case, it is possible to rapidly cope with errors in the network, without the intervention of an administrator.
  • FIG. 1 is a block diagram illustrating an apparatus for displaying the state of a network using geographic information according to an embodiment of the invention.
  • FIG. 2 is a block diagram illustrating the internal structure of an IP address converting unit shown in FIG. 1.
  • FIG. 3 is a block diagram illustrating the internal structure of a network state display unit shown in FIG. 1.
  • FIG. 4 is a diagram illustrating an example of an image displayed by a network state display unit shown in FIG. 1.
  • FIG. 5 is a diagram illustrating an example of a protocol circle shown in FIG. 4.
  • FIG. 1 is a block diagram illustrating an apparatus for displaying the state of a network using geographic information according to an embodiment of the invention.
  • the apparatus includes a security event collecting unit 110, an IP address converting unit 120, a geographic information database 130, and a network state display unit 140.
  • the security event collecting unit 110 collects security events transmitted from a network security apparatus (not shown), such as a fire wall, an intrusion detection system, or a router.
  • the IP address converting unit 120 extracts geographic information corresponding to a source IP address and a destination IP address in characteristic data of the collected security events from the geographic information database 130. That is, the IP address converting unit 120 converts the source IP address into longitude and latitude, which are geographic information corresponding to the source IP address, and converts the destination IP address into longitude and latitude, which are geographic information corresponding to the destination IP address.
  • the characteristic data means a small number of characteristics required to check a network error, among various characteristics of network packets transmitted from a source to a destination.
  • the network packets include various attributes in addition to the source IP address, the destination IP address, a protocol, a destination port, and a source port.
  • the above-mentioned attributes (that is, the source IP address, the destination IP address, the protocol, the destination port, and the source port) are defined as characteristic data.
  • the IP address is a general Internet address in the form of, for example, "xxx.xxx.xxx.xxx". However, any type of address may be used as the IP address as long as it can identify geographic information.
  • the geographic information database 130 stores information on the latitude, longitude, country, and city of each IP.
  • the network state display unit 140 displays on a screen the flow of the security event of each protocol between a source and a destination as a three-dimensional image including a globe shape, on the basis of the characteristic data and geographic information transmitted from the IP address converting unit 120.
  • the flow of security events displayed on the screen by the network state display unit 140 may depend on the amount of data displayed on the screen. For example, the flow of security events may be displayed on the basis of information that is continuously provided from the IP address converting unit 120. Alternatively, the flow of security events may be displayed on the basis of information that is provided from the IP address converting unit 120 at a predetermined time interval, for example, at a time interval of about 10 minutes.
  • the flow of security events may be displayed by the two methods.
  • the flow of security events means network packets transmitted from a source to a destination. That is, in FIG. 4, which will be described below, the flow of security events may mean a line linking the source address, the source port, the protocol, the destination port, and the destination address.
  • the geographic information database 130 is separately configured from the IP address converting unit 120. However, if necessary, the geographic information database 130 may be provided in the IP address converting unit 120.
  • FIG. 2 is a block diagram illustrating the internal structure of the IP address converting unit 120 shown in FIG. 1.
  • the IP address converting unit 120 includes a characteristic data extracting module 122 and a source and destination position extracting module 124.
  • the characteristic data extracting module 122 extracts characteristic data (the source
  • IP address, the destination IP address, the protocol, the destination port, and the source port from the security events collected by the security event collecting unit 110.
  • the source and destination position extracting module 124 extracts, from information stored in the geographic information database 130, the actual position of a source corresponding to the source IP address in the characteristic data that is extracted by the characteristic data extracting module 122, and the actual position of a destination corresponding to the destination IP address in the characteristic data.
  • FIG. 3 is a block diagram illustrating the internal structure of the network state display unit 140 shown in FIG. 1.
  • the network state display unit 140 includes a globe generating module 142, a protocol circle generating module 144, a user interface module 146, and a security event flow display module 148.
  • the globe generating module 142 generates a first globe for displaying the actual position of the source corresponding to the source IP address and a second globe for displaying the actual position of the destination corresponding to the destination IP address.
  • the protocol circle generating module 144 generates at least one protocol circle that is arranged around each of the first and second globes, on the basis of an input protocol.
  • the protocol circle indicates a protocol used for the flow of security events from the source to the destination (for example, TCP, UDP, or other protocols).
  • the protocol circle indicates the number of security events for each port of the protocol.
  • the user interface module 146 enables a user to use a mouse or a keyboard to select a specific port.
  • the security event flow display module 148 three-dimensionally displays the flow of security events on the basis of input characteristic data and the actual positions of the destination and the source.
  • the security event flow display module 148 displays the actual position of the source on the first globe and the actual position of the destination on the second globe.
  • the security event flow display module 148 links the actual position of the source and the actual position of the destination. Specifically, a line linking the actual position of the source and the actual position of the destination passes through one point on the protocol circle of the first globe and one point on the protocol circle of the second globe.
  • the security event flow display module 148 displays only the flow of security events related to the selected port.
  • FIG. 4 is a diagram illustrating an example of an image displayed by the network state display unit 140 shown in FIG. 1.
  • a first globe 150 indicating the actual position of the source corresponding to a source IP address
  • a second globe 160 indicating the actual position of the destination corresponding to a destination IP address
  • protocol circles 172, 174, and 176 that are arranged around each of the first and second globes 150 and 160 and indicate the number of security events for each port of a corresponding protocol are displayed on one screen.
  • maps are not displayed on the first and second globes 150 and 160. However, actually, the maps are displayed on the first and second globes 150 and 160.
  • the protocol circles 172, 174, and 176 are displayed in different colors, which makes it possible to a user or an administrator to intuitively recognize a network error, such as the concentration of security events on a port of a specific protocol, with ease.
  • a line 178 linking the actual position of the source and the actual position of the destination passes through one point on any one of the protocol circles 172, 174, and 176 of the first globe 150 and one point on any one of the protocol circles 172, 174, and 176 of the second globe 150.
  • the line 178 linking the actual position of the source and the actual position of the destination passes through protocol circles (the protocol circle 176 in FIG. 4) corresponding to the same protocol of the first globe 150 and the second globe 160.
  • FIG. 4 shows only the line 178. However, actually, a plurality of lines 178 are displayed.
  • the line 178 indicates the flow of one security event.
  • the network state display unit 140 rotates the first and second globes 150 and 160 at a predetermined speed or by a predetermined angle at a predetermined time interval.
  • the network state display unit 140 may rotate the screen shown in FIG. 4 in the right, left, upward, or downward directions.
  • the network state display unit 140 may display a list of ports having high priority (that is, a list on which ports having a larger number of security events have higher priority) in the form of text. In this case, when the user or the administrator selects one port, the network state display unit 140 displays only the flow of security events related to the selected port, which makes it possible to improve user or administrator convenience.
  • FIG. 5 is a diagram illustrating the protocol circles 172, 174, and 176 shown in FIG.
  • Port numbers of the protocols are mapped around the protocol circles 172, 174, and 176.
  • the port numbers increase from port No. "0" in the counterclockwise direction in a log scale.
  • the number of security events generated from each port is indicated by the size of a predetermined shape (for example, a rectangle) 182 having the port number at the center thereof. For example, the larger the number of security events becomes, the larger the size of the rectangle 182 becomes.
  • the number of security events may be displayed in the rectangle 182.
  • the rectangle 182 having a predetermined size may be displayed at the center of the port number, and the number of security events may be displayed in the rectangle 182.
  • other figures, such as a circle may be displayed.
  • the number of security events may be displayed for every port. For example, the number of security events may be displayed for the top several ports, for example, the top three ports.
  • the protocol circles 172, 174, and 176 may be added or removed at the request of the user or the administrator.
  • the invention can also be embodied as computer-readable codes on a computer- readable recording medium.
  • the computer-readable recording medium is any data storage device that can store data which can be read by a computer system. Examples of the computer-readable recording media include read only memories (ROMs), random access memories (RAMs), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet).
  • ROMs read only memories
  • RAMs random access memories
  • CD-ROMs compact discs
  • magnetic tapes magnetic tapes
  • floppy disks optical data storage devices
  • carrier waves such as data transmission through the Internet
  • carrier waves such as data transmission through the Internet
  • the computer-readable recording medium can also be distributed over network-coupled computer systems so that the computer-readable code is stored and executed in a distributed fashion.
  • functional programs, codes, and code segments to accomplish the invention can be easily construed by programmers skilled in the art to which the present general inventive concept pertains.

Abstract

Disclosed is an apparatus for displaying the state of a network to enable a user to intuitively recognize a network security situation. The disclosed apparatus for displaying the state of a network includes: a security event collecting unit that collects security events from the outside; an IP address converting unit that converts a source IP address and a destination IP address in characteristic data of the collected security events into geographic information on the basis of information stored in a geographic information database; and a network state display unit that displays the flow of security events for each protocol between a source and a destination as an image including a globe shape, on the basis of the characteristic data and the geographic information transmitted from the IP address converting unit.

Description

Description
APPARATUS AND METHOD FOR VISUALIZING NETWORK STATE BY USING GEOGRAPHIC INFORMATION
Technical Field
[1] The present invention relates to a network security, and more particularly, to an apparatus and method for displaying the state of a network between a source and a destination.
[2] This work was supported by the IT R&D program of MIC/IITA. [ 2007-S-022-01 ,
The Development of Smart Monitoring and Tracing System against Cyber-attack in ALL-IP Network] Background Art
[3] In recent years, with an increase in the use of a network, illegal access to the network has increased. Therefore, the importance of a security technique for detecting illegal attacks and network errors and interrupting the access has increased.
[4] In the related art, the ratio of any one of traffic information items of a network (or a system), such as an address, a protocol, a port number, and the number of packet, is used to analyze a change in the corresponding item, in order to detect network errors (that is, abnormal situations caused by attacks). As another known technique, data transmitted over a network is displayed on a coordinate plane or as a geometric figure according to a predetermined protocol, thereby displaying the abnormal situations of the entire network (Reference Document 1 ; Korean Patent Application No. 10-2003-0008826, and Reference Document 2; IEEE Network Vol. 18, No. 5, PP. 30-39, September/October 2004, Hyogon Kim, Inhye Kang, Saewoong Bahk, Real- Time Visualization of Network Attacks on High-Speed Links).
[5] The known methods cannot display details of the current state of the network on one screen. Therefore, it is difficult for a user to intuitively recognize a source of network security threat and places damaged by illegal attacks.
[6] As described above, when the user or the administrator cannot intuitively recognize the current security situation of the network, it is difficult to rapidly cope with the abnormal situations of the network, which results in an increase in damage. Disclosure of Invention
Technical Problem
[7] The invention has been finalized in an effort to solve the above-mentioned problems, and an object of the invention is to provide an apparatus and method for displaying the state of a network using geographic information that is capable of enabling a user to intuitively recognize the current network security situation by displaying, on globes, the actual geometric positions of a source and a destination and the flow of security events for each protocol, on the basis of geographic information and characteristic data included in security events. Technical Solution
[8] According to an aspect of the invention, there is provided an apparatus for displaying the state of a network using geographic information. The apparatus includes: a security event collecting unit that collects security events from the outside; an IP address converting unit that converts a source IP address and a destination IP address in characteristic data of the collected security events into geographic information on the basis of information stored in a geographic information database; and a network state display unit that displays the flow of security events for each protocol between a source and a destination as an image including a three-dimensional globe shape, on the basis of the characteristic data and the geographic information transmitted from the IP address converting unit.
[9] The IP address converting unit may include: a characteristic data extracting module that extracts the characteristic data from the security events collected by the security event collecting unit; and a source and destination position extracting module that extracts, from information stored in the geographic information database, the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the extracted characteristic data.
[10] The source and destination position extracting module may use information including a latitude and longitude for each IP stored in the geographic information database.
[11] The network state display unit may display a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
[12] Port numbers of protocols may be mapped along the circumference of each of the protocol circles.
[13] The network state display unit may display the one or more protocol circles in different colors.
[14] The network state display unit may display a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe.
[15] The line linking the actual position of the source and the actual position of the destination may pass through the protocol circles corresponding to the same protocol in the first globe and the second globe. [16] The network state display unit may display the number of security events for each port as a figure having a predetermined size on the protocol circle.
[17] When a signal indicating the selection of a specific port is input, the network state display unit may display only the flow of security events related to the selected port.
[18] The network state display unit may include: a globe generating module that generates a first globe for displaying the actual position of the source corresponding to the source IP address and a second globe for displaying the actual position of the destination corresponding to the destination IP address; a protocol circle generating module that generates at least one protocol circle that is arranged around each of the first and second globes; and a security event flow display module that displays a line linking the actual position of the source and the actual position of the destination, the line passing through the protocol circle of the first globe and the protocol circle of the second globe.
[19] According to another aspect of the invention, there is provided a method of displaying the state of a network using geographic information. The method includes: a security event collecting step of collecting security events from the outside; an IP address converting step of converting a source IP address and a destination IP address in characteristic data of the security events collected in the security event collecting step into geographic information; and a network state displaying step of displaying the flow of security events for each protocol between a source and a destination as an image including a three-dimensional globe shape, on the basis of the characteristic data and the geographic information converted in the IP address converting step.
[20] The IP address converting step may include: a characteristic data extracting step of extracting the characteristic data from the security events collected in the security event collecting step; and a source and destination position extracting step of extracting, from information stored in a geographic information database, the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the characteristic data extracted in the characteristic data extracting step.
[21] The network state displaying step may display a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
[22] Port numbers of protocols may be mapped along the circumference of each of the protocol circles.
[23] The network state displaying step may display a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe. [24] The network state displaying step may display the number of security events for each port as a figure having a predetermined size on the protocol circle. [25] When a signal indicating the selection of a specific port is input, the network state displaying step may display only the flow of security events related to the selected port.
Advantageous Effects
[26] According to the structure of the invention, since the actual positions of a source and a destination are displayed on globes, a user can rapidly and accurately check places where security events are generated. That is, since the globe that everybody can easily understand is used, it is possible to easily check the actual positions of the destination and the source of security events. [27] Further, the protocol circles are used to display a plurality of protocols and the number of security events for each port of the protocols on one screen together with the globes. Therefore, an administrator can easily check the current state of a network. [28] Furthermore, the invention can be automated by a program. In this case, it is possible to rapidly cope with errors in the network, without the intervention of an administrator.
Brief Description of the Drawings [29] FIG. 1 is a block diagram illustrating an apparatus for displaying the state of a network using geographic information according to an embodiment of the invention. [30] FIG. 2 is a block diagram illustrating the internal structure of an IP address converting unit shown in FIG. 1. [31] FIG. 3 is a block diagram illustrating the internal structure of a network state display unit shown in FIG. 1. [32] FIG. 4 is a diagram illustrating an example of an image displayed by a network state display unit shown in FIG. 1. [33] FIG. 5 is a diagram illustrating an example of a protocol circle shown in FIG. 4.
Best Mode for Carrying Out the Invention [34] Hereinafter, an apparatus and method of displaying the state of a network using geographic information according to an exemplary embodiment of the invention will be described with reference to the accompanying drawings. [35] FIG. 1 is a block diagram illustrating an apparatus for displaying the state of a network using geographic information according to an embodiment of the invention.
The apparatus includes a security event collecting unit 110, an IP address converting unit 120, a geographic information database 130, and a network state display unit 140. [36] The security event collecting unit 110 collects security events transmitted from a network security apparatus (not shown), such as a fire wall, an intrusion detection system, or a router.
[37] The IP address converting unit 120 extracts geographic information corresponding to a source IP address and a destination IP address in characteristic data of the collected security events from the geographic information database 130. That is, the IP address converting unit 120 converts the source IP address into longitude and latitude, which are geographic information corresponding to the source IP address, and converts the destination IP address into longitude and latitude, which are geographic information corresponding to the destination IP address. In the specification of the invention, the characteristic data means a small number of characteristics required to check a network error, among various characteristics of network packets transmitted from a source to a destination. In general, the network packets include various attributes in addition to the source IP address, the destination IP address, a protocol, a destination port, and a source port. For example, in the following description, the above-mentioned attributes (that is, the source IP address, the destination IP address, the protocol, the destination port, and the source port) are defined as characteristic data. The IP address is a general Internet address in the form of, for example, "xxx.xxx.xxx.xxx". However, any type of address may be used as the IP address as long as it can identify geographic information.
[38] The geographic information database 130 stores information on the latitude, longitude, country, and city of each IP.
[39] The network state display unit 140 displays on a screen the flow of the security event of each protocol between a source and a destination as a three-dimensional image including a globe shape, on the basis of the characteristic data and geographic information transmitted from the IP address converting unit 120. The flow of security events displayed on the screen by the network state display unit 140 may depend on the amount of data displayed on the screen. For example, the flow of security events may be displayed on the basis of information that is continuously provided from the IP address converting unit 120. Alternatively, the flow of security events may be displayed on the basis of information that is provided from the IP address converting unit 120 at a predetermined time interval, for example, at a time interval of about 10 minutes. The flow of security events may be displayed by the two methods. The flow of security events means network packets transmitted from a source to a destination. That is, in FIG. 4, which will be described below, the flow of security events may mean a line linking the source address, the source port, the protocol, the destination port, and the destination address.
[40] In this embodiment, the geographic information database 130 is separately configured from the IP address converting unit 120. However, if necessary, the geographic information database 130 may be provided in the IP address converting unit 120.
[41] FIG. 2 is a block diagram illustrating the internal structure of the IP address converting unit 120 shown in FIG. 1. The IP address converting unit 120 includes a characteristic data extracting module 122 and a source and destination position extracting module 124.
[42] The characteristic data extracting module 122 extracts characteristic data (the source
IP address, the destination IP address, the protocol, the destination port, and the source port) from the security events collected by the security event collecting unit 110.
[43] The source and destination position extracting module 124 extracts, from information stored in the geographic information database 130, the actual position of a source corresponding to the source IP address in the characteristic data that is extracted by the characteristic data extracting module 122, and the actual position of a destination corresponding to the destination IP address in the characteristic data.
[44] FIG. 3 is a block diagram illustrating the internal structure of the network state display unit 140 shown in FIG. 1. The network state display unit 140 includes a globe generating module 142, a protocol circle generating module 144, a user interface module 146, and a security event flow display module 148.
[45] The globe generating module 142 generates a first globe for displaying the actual position of the source corresponding to the source IP address and a second globe for displaying the actual position of the destination corresponding to the destination IP address.
[46] The protocol circle generating module 144 generates at least one protocol circle that is arranged around each of the first and second globes, on the basis of an input protocol. The protocol circle indicates a protocol used for the flow of security events from the source to the destination (for example, TCP, UDP, or other protocols). The protocol circle indicates the number of security events for each port of the protocol.
[47] The user interface module 146 enables a user to use a mouse or a keyboard to select a specific port.
[48] The security event flow display module 148 three-dimensionally displays the flow of security events on the basis of input characteristic data and the actual positions of the destination and the source. The security event flow display module 148 displays the actual position of the source on the first globe and the actual position of the destination on the second globe. The security event flow display module 148 links the actual position of the source and the actual position of the destination. Specifically, a line linking the actual position of the source and the actual position of the destination passes through one point on the protocol circle of the first globe and one point on the protocol circle of the second globe.
[49] When receiving a signal indicating the selection of a specific port from the user interface module 146, the security event flow display module 148 displays only the flow of security events related to the selected port.
[50] FIG. 4 is a diagram illustrating an example of an image displayed by the network state display unit 140 shown in FIG. 1. A first globe 150 indicating the actual position of the source corresponding to a source IP address, a second globe 160 indicating the actual position of the destination corresponding to a destination IP address, and protocol circles 172, 174, and 176 that are arranged around each of the first and second globes 150 and 160 and indicate the number of security events for each port of a corresponding protocol are displayed on one screen. For clarity of explanation, maps are not displayed on the first and second globes 150 and 160. However, actually, the maps are displayed on the first and second globes 150 and 160.
[51] The protocol circles 172, 174, and 176 are displayed in different colors, which makes it possible to a user or an administrator to intuitively recognize a network error, such as the concentration of security events on a port of a specific protocol, with ease.
[52] A line 178 linking the actual position of the source and the actual position of the destination passes through one point on any one of the protocol circles 172, 174, and 176 of the first globe 150 and one point on any one of the protocol circles 172, 174, and 176 of the second globe 150. The line 178 linking the actual position of the source and the actual position of the destination passes through protocol circles (the protocol circle 176 in FIG. 4) corresponding to the same protocol of the first globe 150 and the second globe 160.
[53] For clarity of explanation, FIG. 4 shows only the line 178. However, actually, a plurality of lines 178 are displayed. The line 178 indicates the flow of one security event.
[54] In FIG. 4, the first and second globes 150 and 160 seem to be fixed. However, actually, the first and second globes 150 and 160 rotate. In FIG. 4, the flow of security events may occur in the rear sides of the first and second globes 150 and 160. Therefore, the network state display unit 140 rotates the first and second globes 150 and 160 at a predetermined speed or by a predetermined angle at a predetermined time interval. Of course, even when a manual operation instruction is input through the user interface module 146, the network state display unit 140 rotates the first and second globes 150 and 160. Alternatively, the network state display unit 140 may rotate the screen shown in FIG. 4 in the right, left, upward, or downward directions.
[55] Meanwhile, although not shown in the drawings, the network state display unit 140 may display a list of ports having high priority (that is, a list on which ports having a larger number of security events have higher priority) in the form of text. In this case, when the user or the administrator selects one port, the network state display unit 140 displays only the flow of security events related to the selected port, which makes it possible to improve user or administrator convenience.
[56] In FIG. 4, three protocol circles are arranged around each of the first globe 150 and the second globe 160. However, the number of protocol circles may increase or decrease.
[57] FIG. 5 is a diagram illustrating the protocol circles 172, 174, and 176 shown in FIG.
4. Port numbers of the protocols (for example, TCP, UDP, and other protocols) are mapped around the protocol circles 172, 174, and 176. The port numbers increase from port No. "0" in the counterclockwise direction in a log scale.
[58] The number of security events generated from each port is indicated by the size of a predetermined shape (for example, a rectangle) 182 having the port number at the center thereof. For example, the larger the number of security events becomes, the larger the size of the rectangle 182 becomes. The number of security events may be displayed in the rectangle 182. Alternatively, the rectangle 182 having a predetermined size may be displayed at the center of the port number, and the number of security events may be displayed in the rectangle 182. Instead of the rectangle, other figures, such as a circle, may be displayed.
[59] The number of security events may be displayed for every port. For example, the number of security events may be displayed for the top several ports, for example, the top three ports.
[60] The protocol circles 172, 174, and 176 may be added or removed at the request of the user or the administrator.
[61] Actually, a plurality of lines 178 corresponding to a plurality of flows of security events exist. Therefore, the rectangle 182 shown in FIG. 5 is not shown in FIG. 4. For example, when the user or the administrator selects any one of the protocol circles shown in FIG. 4, actually, the protocol circle shown in FIG. 5 is displayed on the screen.
[62] The invention can also be embodied as computer-readable codes on a computer- readable recording medium. The computer-readable recording medium is any data storage device that can store data which can be read by a computer system. Examples of the computer-readable recording media include read only memories (ROMs), random access memories (RAMs), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet). The computer-readable recording medium can also be distributed over network-coupled computer systems so that the computer-readable code is stored and executed in a distributed fashion. Also, functional programs, codes, and code segments to accomplish the invention can be easily construed by programmers skilled in the art to which the present general inventive concept pertains.
[63] Although the embodiment of the invention has been described above, it will be ap- predated by those skilled in the art that changes and modifications of the invention may be made without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.

Claims

Claims
[1] An apparatus for displaying the state of a network using geographic information, comprising: a security event collecting unit that collects security events from the outside; an IP address converting unit that converts a source IP address and a destination IP address in characteristic data of the collected security events into corresponding geographic information on the basis of information stored in a geographic information database; and a network state display unit that displays the flow of security events for each protocol between a source and a destination as an image including a globe shape, on the basis of the characteristic data and the geographic information transmitted from the IP address converting unit.
[2] The apparatus of claim 1, wherein the IP address converting unit includes: a characteristic data extracting module that extracts the characteristic data from the security events collected by the security event collecting unit; and a source and destination position extracting module that extracts, from information stored in the geographic information database, the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the extracted characteristic data.
[3] The apparatus of claim 2, wherein the source and destination position extracting module uses information including a latitude and longitude for each IP address stored in the geographic information database.
[4] The apparatus of claim 1, wherein the network state display unit displays a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
[5] The apparatus of claim 4, wherein port numbers of protocols are mapped along the circumference of each of the protocol circles.
[6] The apparatus of claim 4, wherein the network state display unit displays the one or more protocol circles in different colors.
[7] The apparatus of claim 4, wherein the network state display unit displays a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe.
[8] The apparatus of claim 7, wherein the line linking the actual position of the source and the actual position of the destination passes through the protocol circles corresponding to the same protocol in the first globe and the second globe.
[9] The apparatus of claim 4, wherein the network state display unit displays the number of security events for each port as a figure having a predetermined size on the protocol circle.
[10] The apparatus of claim 4, wherein, when a signal indicating the selection of a specific port is input, the network state display unit displays only the flow of security events related to the selected port.
[11] The apparatus of claim 1 , wherein the network state display unit includes: a globe generating module that generates a first globe for displaying the actual position of the source corresponding to the source IP address and a second globe for displaying the actual position of the destination corresponding to the destination IP address; a protocol circle generating module that generates at least one protocol circle that is arranged around each of the first and second globes; and a security event flow display module that displays a line linking the actual position of the source and the actual position of the destination, the line passing through the protocol circle of the first globe and the protocol circle of the second globe.
[12] A method of displaying the state of a network using geographic information, comprising: a security event collecting step of collecting security events from the outside; an IP address converting step of converting a source IP address and a destination IP address in characteristic data of the security events collected in the security event collecting step into geographic information; and a network state displaying step of displaying the flow of security events for each protocol between a source and a destination as an image including a globe shape, on the basis of the characteristic data and the geographic information converted in the IP address converting step.
[13] The method of claim 12, wherein the IP address converting step includes: a characteristic data extracting step of extracting the characteristic data from the security events collected in the security event collecting step; and a source and destination position extracting step of extracting the actual position of the source corresponding to the source IP address and the actual position of the destination corresponding to the destination IP address in the characteristic data extracted in the characteristic data extracting step.
[14] The method of claim 12, wherein the network state displaying step displays a first globe indicating the actual position of the source corresponding to the source IP address, a second globe indicating the actual position of the destination corresponding to the destination IP address, and one or more protocol circles that are arranged around each of the first and second globes.
[15] The method of claim 14, wherein port numbers of protocols are mapped along the circumference of each of the protocol circles.
[16] The method of claim 14, wherein the network state displaying step displays a line linking the actual position of the source and the actual position of the destination such that the line passes through the protocol circle of the first globe and the protocol circle of the second globe.
[17] The method of claim 14, wherein the network state displaying step displays the number of security events for each port as a figure having a predetermined size on the protocol circle.
[ 18] The method of claim 14, wherein, when a signal indicating the selection of a specific port is input, the network state displaying step displays only the flow of security events related to the selected port.
PCT/KR2007/005903 2007-09-21 2007-11-22 Apparatus and method for visualizing network state by using geographic information WO2009038248A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/679,294 US8266278B2 (en) 2007-09-21 2007-11-22 Apparatus and method for visualizing network state by using geographic information

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR1020070096537A KR100925176B1 (en) 2007-09-21 2007-09-21 Apparatus and method for visualizing network state by using geographic information
KR10-2007-0096537 2007-09-21

Publications (1)

Publication Number Publication Date
WO2009038248A1 true WO2009038248A1 (en) 2009-03-26

Family

ID=40468043

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2007/005903 WO2009038248A1 (en) 2007-09-21 2007-11-22 Apparatus and method for visualizing network state by using geographic information

Country Status (3)

Country Link
US (1) US8266278B2 (en)
KR (1) KR100925176B1 (en)
WO (1) WO2009038248A1 (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013040076A1 (en) * 2011-09-12 2013-03-21 Fred Hutchinson Cancer Research Center Dynamics and control of state-dependent networks for probing genomic organization
CN103036905A (en) * 2012-12-27 2013-04-10 北京神州绿盟信息安全科技股份有限公司 Method and device of enterprise network safety analysis
WO2013101372A1 (en) * 2011-12-29 2013-07-04 Mcafee, Inc. Geo-mapping system security events
CN103595732A (en) * 2013-11-29 2014-02-19 北京奇虎科技有限公司 Method and device for obtaining evidence of network attack
WO2015026849A1 (en) 2013-08-19 2015-02-26 The Regents Of The University Of California Compounds and methods for treating an epileptic disorder
US10874643B2 (en) 2015-02-25 2020-12-29 The Regents Of The University Of California 5HT agonists for treating disorders

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7496662B1 (en) 2003-05-12 2009-02-24 Sourcefire, Inc. Systems and methods for determining characteristics of a network and assessing confidence
US8272055B2 (en) 2008-10-08 2012-09-18 Sourcefire, Inc. Target-based SMB and DCE/RPC processing for an intrusion detection system or intrusion prevention system
KR101219538B1 (en) * 2009-07-29 2013-01-08 한국전자통신연구원 Apparatus for detecting network attack based on visual data analysis and its method thereof
US8677486B2 (en) 2010-04-16 2014-03-18 Sourcefire, Inc. System and method for near-real time network attack detection, and system and method for unified detection via detection routing
US8433790B2 (en) 2010-06-11 2013-04-30 Sourcefire, Inc. System and method for assigning network blocks to sensors
US8671182B2 (en) 2010-06-22 2014-03-11 Sourcefire, Inc. System and method for resolving operating system or service identity conflicts
US8601034B2 (en) * 2011-03-11 2013-12-03 Sourcefire, Inc. System and method for real time data awareness
US20150304343A1 (en) 2014-04-18 2015-10-22 Intuit Inc. Method and system for providing self-monitoring, self-reporting, and self-repairing virtual assets in a cloud computing environment
US10757133B2 (en) 2014-02-21 2020-08-25 Intuit Inc. Method and system for creating and deploying virtual assets
US9866581B2 (en) 2014-06-30 2018-01-09 Intuit Inc. Method and system for secure delivery of information to computing environments
US11294700B2 (en) 2014-04-18 2022-04-05 Intuit Inc. Method and system for enabling self-monitoring virtual assets to correlate external events with characteristic patterns associated with the virtual assets
KR101737914B1 (en) 2014-06-03 2017-05-19 한국전자통신연구원 Apparatus for displaying network security and method thereof
US10102082B2 (en) 2014-07-31 2018-10-16 Intuit Inc. Method and system for providing automated self-healing virtual assets
WO2016122447A1 (en) * 2015-01-26 2016-08-04 Hewlett-Packard Development Company, L.P. Visually interactive and iteractive analysis of data patterns by a user
US9825986B1 (en) * 2015-06-29 2017-11-21 Symantec Corporation Systems and methods for generating contextually meaningful animated visualizations of computer security events
CN105577669B (en) * 2015-12-25 2018-09-21 北京神州绿盟信息安全科技股份有限公司 A kind of method and device of the false source attack of identification
US10542060B2 (en) * 2016-09-19 2020-01-21 Ebay Inc. Interactive real-time visualization system for large-scale streaming data
CN108683663B (en) * 2018-05-14 2021-04-20 中国科学院信息工程研究所 Network security situation assessment method and device
KR101987031B1 (en) * 2018-11-22 2019-06-10 (주)시큐레이어 Method for providing visualization of information for network management and apparatus using the same
US10992696B2 (en) * 2019-09-04 2021-04-27 Morgan Stanley Services Group Inc. Enterprise-level security method and system

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7100204B1 (en) * 2002-04-05 2006-08-29 International Business Machines Corporation System and method for determining network users' physical locations
US20070220595A1 (en) * 2006-02-10 2007-09-20 M Raihi David System and method for network-based fraud and authentication services

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8621032B2 (en) * 1996-07-18 2013-12-31 Ca, Inc. Method and apparatus for intuitively administering networked computer systems
US7873985B2 (en) * 2002-01-08 2011-01-18 Verizon Services Corp. IP based security applications using location, port and/or device identifier information
US7609257B2 (en) * 2004-03-29 2009-10-27 Oculus Info Inc. System and method for applying link analysis tools for visualizing connected temporal and spatial information on a user interface
US7546637B1 (en) * 2004-11-22 2009-06-09 Symantec Corproation Structures and methods for using geo-location in security detectors
US7593013B2 (en) * 2005-03-11 2009-09-22 University Of Utah Research Foundation Systems and methods for displaying and querying heterogeneous sets of data
US20070047438A1 (en) * 2005-08-20 2007-03-01 Malloy Patrick J Identifying a transaction of interest within a network
US7930256B2 (en) * 2006-05-23 2011-04-19 Charles River Analytics, Inc. Security system for and method of detecting and responding to cyber attacks on large network systems

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7100204B1 (en) * 2002-04-05 2006-08-29 International Business Machines Corporation System and method for determining network users' physical locations
US20070220595A1 (en) * 2006-02-10 2007-09-20 M Raihi David System and method for network-based fraud and authentication services

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
GREGORY JOHN CONTI: "COUNTERING NETWORK LEVEL DENIAL OF INFORMATION ATTACKS USING INFORMATION VISUALIZATION", GEORGIA INSTITUTE OF TECHNOLOGY, May 2006 (2006-05-01), pages 19 *
JAMES A. MUIR ET AL.: "Internet Geolocation and Evasion", SCHOOL OF COMPUTER SCIENCE, 19 September 2006 (2006-09-19), pages 1 - 22 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013040076A1 (en) * 2011-09-12 2013-03-21 Fred Hutchinson Cancer Research Center Dynamics and control of state-dependent networks for probing genomic organization
WO2013101372A1 (en) * 2011-12-29 2013-07-04 Mcafee, Inc. Geo-mapping system security events
US8973147B2 (en) 2011-12-29 2015-03-03 Mcafee, Inc. Geo-mapping system security events
US9356970B2 (en) 2011-12-29 2016-05-31 Mcafee, Inc. Geo-mapping system security events
US10038708B2 (en) 2011-12-29 2018-07-31 Mcafee, Llc Geo-mapping system security events
CN103036905A (en) * 2012-12-27 2013-04-10 北京神州绿盟信息安全科技股份有限公司 Method and device of enterprise network safety analysis
WO2015026849A1 (en) 2013-08-19 2015-02-26 The Regents Of The University Of California Compounds and methods for treating an epileptic disorder
CN103595732A (en) * 2013-11-29 2014-02-19 北京奇虎科技有限公司 Method and device for obtaining evidence of network attack
US10874643B2 (en) 2015-02-25 2020-12-29 The Regents Of The University Of California 5HT agonists for treating disorders
US11648237B2 (en) 2015-02-25 2023-05-16 The Regents Of The University Of California 5HT agonists for treating disorders

Also Published As

Publication number Publication date
US20100257267A1 (en) 2010-10-07
US8266278B2 (en) 2012-09-11
KR100925176B1 (en) 2009-11-05
KR20090030880A (en) 2009-03-25

Similar Documents

Publication Publication Date Title
US8266278B2 (en) Apparatus and method for visualizing network state by using geographic information
US8019865B2 (en) Method and apparatus for visualizing network security state
US7945658B1 (en) Method for real-time visualization of BGP analysis and trouble-shooting
US20070074288A1 (en) Network status display device and method using traffic pattern map
KR100949803B1 (en) Apparatus and Method for divided visualizing IP address
Koike et al. Visualizing cyber attacks using IP matrix
Keim et al. Monitoring network traffic with radial traffic analyzer
US20100162392A1 (en) Apparatus and method for monitoring security status of wireless network
US8803884B2 (en) Event data visualization tool
US20090198707A1 (en) System and method for managing firewall log records
CN105721188A (en) Firewall strategy check method and system
WO2019003373A1 (en) Attack situation visualization device, attack situation visualization method and recording medium
JP2020515934A5 (en)
US20100150008A1 (en) Apparatus and method for displaying state of network
US20190213612A1 (en) Map based visualization of user interaction data
CN114070760A (en) Network space asset mapping method and device, network space asset database and computer readable storage medium
TW201517556A (en) Network status visualization systems and methods
Li et al. A framework for searching Internet-wide devices
Kolomeets et al. Visual analysis of CAN bus traffic injection using radial bar charts
Li et al. The research on network security visualization key technology
JP6801673B2 (en) Display control device, display control method, and display control program
CN109446286A (en) A kind of method for visualizing and device of freeway network figure
Onut et al. A novel visualization technique for network anomaly detection.
WO2006077666A1 (en) Observation data display device, observation data display method, observation data display program, and computer-readable recording medium containing the program
JP4825979B2 (en) Communication log visualization device, communication log visualization method, and communication log visualization program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07834208

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 12679294

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 07834208

Country of ref document: EP

Kind code of ref document: A1