KR101929528B1 - Apparatus and Method for Automatic Compensating a Risk Index - Google Patents

Abstract

The present invention relates to an apparatus and method for automatically correcting a risk index and, more particularly, to a system and method for automatically correcting a risk index of a security event based on security events occurring in various security equipments in the Internet environment, To an apparatus and method for automatically correcting a risk index to improve the suitability and reliability of various high risk indexes derived based on the risk indexes for individual security events and the risk indexes for individual security events.

Description

Technical Field [0001] The present invention relates to an apparatus and method for automatically correcting a risk index,

The present invention relates to an apparatus and method for automatically correcting a risk index and, more particularly, to a system and method for automatically correcting a risk index of a security event based on security events occurring in various security equipments in the Internet environment, To an apparatus and method for automatically correcting a risk index to improve the suitability and reliability of various high risk indexes derived based on the risk indexes for individual security events and the risk indexes for individual security events.

Information systems, including information systems and data, are important assets in the conduct of businesses such as corporations and government departments. In order to protect such information assets from various kinds of cyber attacks such as hacking and malicious codes, it is necessary to precisely detect the threat of various security events through information system management. In recent years, various types of security threats to IoT devices have been increasing due to the widespread use of Internet of Things (IoT) devices. Since IoT devices are low-cost small devices, a centralized There is a growing need to detect threats to various security events through the control system.

In such information system management and security control areas, a risk index is used which indexes the degree of various threats of the managed systems. Most global security companies and national cyber safety centers calculate and publish risk indices based on their own standards. For example, the ThreatCon Index, where Symantec Security Response analyzes the global threats and issues threats 1 to 4, and the National Cyber Safety Center, a cyber threat (green) to systematically respond to cyber attacks, The governmental departments that operate their own cyber safety centers, such as the Crisis Alert System, which is divided into four stages, such as caution (blue), warning (yellow) and danger (red) And the cyber safety index (MOTIE-CSI, etc.) developed to evaluate the level of risk by combining the actual conditions.

FIG. 1 shows an example of the calculation of the risk index of the prior art. In FIG. 1, the organization may be a corporation or a government department, where the organization includes departments 1 and 2 as subsystems, department 1 includes systems, me and others, and department 2 includes systems la and la , And each of the security events A, B, C, D, and E occurs in each system.

The individual security events A, B, C, D and E have a risk index given as 8, 2, 4, 1 and 1, respectively, which are arbitrarily set by the security administrator. Based on the risk indices of these individual security events, the system-specific, organizational, and institutional risk indices are obtained by calculating the simple average of the risk indices. Specifically, the system risk index is calculated as 4.7, which is the average of the risk indices 8, 2, and 4 of the security events A, B, and C that occurred in the system, and the risk index of the system 1 is calculated as the risk 4.2, which is the average of the risk factors of departments 1 and 2, which is the average value of 4.2 and 3.4, which is 3.8.

In this way, the conventional risk index analyzes the threats for a certain period of time and then remains at a level that determines the risk level by using a simple calculation expression such as an arithmetic addition or an average value calculation of the risk index for each security event, (Advanced Persistent Threat), which is targeted against the target. Moreover, since the risk index of the individual security event is set to a certain value based on the arbitrary value judgment, and the risk index of the system, the organization, and the institution is calculated on the basis thereof, I do not get it.

In order to overcome the problems and limitations of the conventional risk index, it is important to increase the accuracy or appropriateness of the risk index assigned to each security event. To this end, the risk index for the individual security event is managed by the security manager or the system administrator It is necessary to develop a risk index automatic correction technique that can be adjusted according to the judgment history of the threat of the risk.

Patent No. 10-1013077 "IT Risk Management Method and System Based on Quantitative Safety Index Calculation", 2011. 02. 14

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems of the prior art,

It is an object of the present invention to provide a security risk management method and a security risk management method in which a risk index of an individual security event that has been set by an arbitrary judgment is adjusted up or down based on an actual determination result on whether or not a security event is threatened, And a method for automatically correcting the risk index.

Another object of the present invention is to categorize individual security events on the basis of the threat judgment of the security administrators and the system administrators for the security events and adjust the risk index of the security events up or down according to the categorization result And to provide an apparatus and method for automatically correcting a risk index that calculates a suitability, accuracy and a reliable risk index.

It is a further object of the present invention to provide a method and system for enabling a risk index for an individual security event to be adjusted at an appropriate level without converging to infinity or O by performing a risk index upwards or downwards adjustment of individual security events within a set threshold adjustment frequency range And an apparatus and method for automatically correcting a risk index.

In order to achieve the above object, the present invention is implemented by the following embodiments.

According to an embodiment of the present invention, an apparatus for automatically correcting a risk index includes a storage unit storing a risk index for each security event, a receiver for receiving a security event and a determination result generated in the security apparatus, A categorization unit that classifies security events into categories based on the determination history of the security events; and a control unit that, when the security indexes of the security events stored in the storage unit are up or down at a predetermined ratio according to the categories classified by the categorizing unit And a correcting unit for adjusting the light intensity.

According to another embodiment of the present invention, the risk index automatic correction apparatus of the present invention is characterized in that, when the security manager's primary judgment and primary judgment as to whether the security event is threat or non-threatening is a threat, And a secondary determination as to whether the security event is threatened or non-threatened, which is additionally performed by the administrator, and the categorizing unit is configured to detect a security event in the first category , The primary category for the security event is classified into a second category when the threat is non-threatening, and the third category when the primary category for the security event is non-threatening.

According to another embodiment of the present invention, the risk index automatic correction apparatus of the present invention is characterized in that the correction section raises the risk index of the security event to a first rate when the security event is classified into the first category, If the security event is classified into the second category, the risk index of the security event is lowered to the second ratio. If the security event is classified into the third category, the risk index of the security event is classified into a category higher than the second ratio 3 ratio.

According to another embodiment of the present invention, the risk index automatic correction apparatus of the present invention further includes a threshold adjustment number determination unit for determining whether the number of times of upward or downward adjustment of the risk index of the security event exceeds a preset threshold adjustment number And when the number of upward or downward adjustment of the risk index for the security event exceeds a threshold adjustment number as a result of the determination by the threshold adjustment number determination unit, the correcting unit performs upward or downward adjustment of the risk index for the security event .

According to an embodiment of the present invention, a risk index automatic correction method of the present invention includes: a receiving step of receiving a security event and a determination result generated in a security device by a receiving unit; And a correcting step of adjusting the risk index of the security event stored in the correcting unit storage unit up or down at a preset ratio according to the category classified by the categorizing unit .

According to another embodiment of the present invention, in the risk index automatic correction method of the present invention, when the primary judgment and the primary judgment of the security manager regarding threat or non-threat of the concerned security event is a threat, Wherein the categorization step includes a categorization step of categorizing the security event in response to a security event, the categorization step being performed by the categorizer, The first category is classified into the second category when the primary judgment for the security event is a threat or the secondary judgment is non-threat and the third category when the primary judgment for the security event is non-threatening .

According to another embodiment of the present invention, there is provided a method of automatically correcting a risk index according to the present invention, wherein the correcting step includes a step of, when the security event is classified into the first category, And if the security event is classified into the second category, the risk index of the security event is lowered to the second ratio, and if the security event is classified into the third category, Ratio to a third rate higher than the first rate.

According to another embodiment of the present invention, the risk index automatic correction method of the present invention is characterized in that, before the correction step, the threshold adjustment number determination unit determines whether the number of times the upward or downward adjustment of the risk index of the security event is exceeded Wherein when the number of times of upward or downward adjustment of the risk index for the security event is within the threshold adjustment number as a result of the determination by the threshold adjustment number determination unit, the correction step is performed, And the correction step is not performed when the number of times of adjustment is exceeded.

The present invention provides the following effects through the above-described configuration.

The present invention adjusts the risk index of an individual security event that has been set by a conventional arbitrary judgment to an upward or downward adjustment based on an actual judgment result as to whether or not the security event is threatened to thereby accurately represent the actual threat level The risk index is automatically corrected.

The present invention categorizes individual security events on the basis of the threat judgment of security administrators and system administrators for the security events and adjusts the risk index of the security events to a predetermined ratio according to the categorization result, There is provided an apparatus and method for automatically correcting a risk index that calculates a reliable risk index.

The present invention relates to a risk index automatic correction device (hereinafter, referred to as " risk index automatic correction device ") that enables a risk index for individual security events to be adjusted at an appropriate level without converging to infinity or 0, And an effect of providing a method.

1 is a diagram showing an example of calculating the risk index of a conventional organization;
2 is a block diagram of an apparatus for automatically correcting a risk index according to an embodiment of the present invention
3 is a diagram illustrating an embodiment of a security event and risk index table
4 is a diagram showing a process of judging whether an actual security threat is actually threatened or not
5 is a flowchart of a method of automatically correcting a risk index according to an embodiment of the present invention
6 is a flow chart of a risk index automatic correction method according to another embodiment of the present invention

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and method for automatically correcting a risk index according to the present invention will be described in detail with reference to the accompanying drawings. Unless defined otherwise, all terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs and, if conflict with the meaning of the terms used herein, It follows the definition used in the specification. Further, the detailed description of known functions and configurations that may unnecessarily obscure the subject matter of the present invention will be omitted.

FIG. 2 is a block diagram of a risk index automatic correction apparatus according to an embodiment of the present invention.

2, the risk index automatic correction apparatus 1 according to the present invention includes a storage unit 11, a receiving unit 12, a categorizing unit 13, a correcting unit 14, and a threshold adjusting frequency determining unit 15 .

The storage unit 11 stores a risk index for each security event. The storage unit 11 is a database (DB) storing one or more security events and a risk index assigned to the security events, and may be implemented as various storage media such as a ROM, a hard disk, and a flash memory.

A security event is an event occurring in a security device. The security device may be a firewall, an Intrusion Detection System (IDS), an Intrusion Prevention System (IPS), a web firewall, an L7 firewall, There are different types of security devices, that is, types, numbers, data formats, etc. of the included fields.

3, an embodiment of the security event and risk index table is shown, which shows security events and risk index setting examples that are frequently reported in the applicant's integrated security management product IS-SIGMA. Specifically, individual security events include malicious site attacks, TCP flooding attacks, and port scans. An attack by a malicious site means that the system or terminal is infected with malicious code to transmit data of the system or terminal to the malicious site. In addition, the TCP flooding attack exploits the weakness of the TCP (Transmission Control Protocol) to make the communication of the system or the terminal impossible by transmitting the excessive data packet by using the protocol and transmitting the data packet in a form contrary to the protocol it means. Port scan, on the other hand, scans the port of a server through a computer network to find out what services the server is providing. It can also be used as an attack by hackers to find vulnerabilities in a computer.

In the table of FIG. 3, the risk index of each security event is arbitrarily determined in advance, and is given as a natural number within a certain range. In detail, it can be seen that the malicious site is determined as 3 points, TCP flooding attack is 12 points, and port scan is 4 points.

The receiving unit 12 receives a security event and a determination result generated in the security device. The receiving unit 12 receives the security event details from the security device, and receives the security manager's determination history and the system administrator's determination information about the security event from the security manager terminal and the system administrator terminal, respectively. Also, when the receiving unit 12 receives the security event and the determination details from the external system, the external system may collect the security event generated in the internal security equipment and the determination details about the security event and transmit the security event and the determination information together.

FIG. 4 shows an actual threat determination process for an individual security event. Referring to FIG. 4, security events E1, E2, and E3 have occurred in the security device, and it can be confirmed that the security manager terminal and the system administrator terminal determine the threat. It is determined by the security administrator and the system administrator whether or not the security event generated in the security device is a real threat. The security manager's judgment is inputted or generated through the security manager terminal, The security administrator terminal and the system administrator terminal may be input or generated through the administrator terminal.

At this time, only when the primary decision of the security manager is a threat, the secondary decision is made by the system administrator. Also, the system administrator judges it as a threat and feeds back to the security manager, . On the other hand, if the security administrator's judgment is non-threat, no further judgment by the system administrator is made.

Assuming that the security events E1, E2, and E3 are respectively attacked by a malicious site, a TCP flooding attack, and a port scan, the attack by a malicious site is considered to be a threat to security by both the security administrator and the system administrator TCP flooding is considered to be a threat by the security administrator but it is not threatened by the system administrator and port scan is considered non - threat by the security administrator.

In practice, malicious sites are attacked in a relatively large number of security devices, and the risk is highly evaluated and the rate of action is also high. TCP flooding attacks are intermittent events, Although the rate is low, it is not ignored. In the case of port scans, it is a type of security event that is considered to be mostly non-threat despite frequent events occurring in many devices.

The categorizing unit 13 classifies the security events received by the receiving unit 12 into categories based on the details of the security events. As described above, the determination history indicates whether the security administrator's primary judgment about the threat or non-threat of the security event is threat or non-threat of the security event additionally performed by the system administrator in case the threat is a threat And the like. In this case, the categorizing unit 13 may be classified into a first category when the primary event and the secondary event are both threats to the security event, the primary event is a threat or the secondary event is a non- In case of threat, it can be classified into the second category, and if the primary judgment about the security event is non-threat, it can be classified into the third category.

The categorizing unit 13 classifies the attack into a first category because it is determined that the attack is a threat to security by both the security administrator and the system administrator, and the TCP flooding attack is performed by the security administrator Since it was judged to be a threat by the system administrator but it was judged to be non-threat, it is classified into the second category. Since the port scan is judged as non-threat by the security administrator, it can be classified into the third category.

The correcting unit 14 adjusts the risk index of the security event stored in the storage unit 11 to a predetermined ratio according to the category classified by the categorization unit 13. [ More specifically, when the security event is classified into the first category, the security manager 14 raises the risk index of the security event to a first rate, and when the security event is classified into the second category, If the security event is classified into the third category, the risk index of the security event is adjusted to a third ratio higher than the second ratio.

As a specific example, the first ratio may be selected from 15% to 25%, the second ratio from 5% to 15%, and the third ratio from 25% to 35% The ratio is 10%, and the third ratio is 30%.

3, the risk index is 3, the TCP flooding attack classified into the second category is 12, and the third category is the attack by the malicious site classified into the first category by the categorizing unit 13 The port scan is determined to be 4 points. The risk index is undervalued compared to the actual threat judgment, and the TCP flooding attack and the port scan have a risk index It can be said that it is set high.

In such a situation, the security administrator 14 adjusts the risk index of the attack to 3.6, which is 20% up from 3, to the malicious site classified as the first category, and the risk index of the TCP flooding attack classified into the second category From 10 points to 10.8 points, and the risk index of port scans classified in the third category can be adjusted down from 4 points to 30 points down to 2.8 points. If the correcting unit 14 repeats the upward or downward adjustment of the risk index of each individual security event in this manner, the risk index of each individual security event corresponds to a judgment as to whether the security manager or the system administrator actually threatened It is possible to improve the reliability and accuracy of the risk index of each individual security event and further improve the reliability of the system risk index, .

The threshold adjustment number determination unit 15 determines whether the number of times of upward or downward adjustment of the risk index of the security event exceeds a preset threshold adjustment number. As a result of the determination by the threshold adjustment number determination unit 15, if the upward or downward adjustment number of the risk index for the security event exceeds the threshold adjustment number, the correction unit 14 updates the risk index for the security event And the adjustment is not performed.

If the verification unit 14 continuously performs upward or downward adjustment of the risk index of each individual security event indefinitely, the risk index of the individual security event may rise to infinity or converge to zero. In order to prevent such a problem, the threshold adjustment number determination unit 15 allows an increase or decrease in the risk index of individual security events to be performed within a proper number of times. For example, the threshold adjustment time determination unit 15 may perform the determination based on the threshold adjustment times set five times. If the upward or downward risk index for a specific individual security event exceeds five times, that is, The adjustment by the correcting unit 14 can be prevented from being performed any more.

As described above, the threshold adjustment time determination unit 15 performs the adjustment of the risk index for the individual security events within a predetermined number of times, so that the adequacy or accuracy of the risk index can be maintained in an optimum state. In the above example, if the threshold adjustment frequency is 5, the malicious site classified as the first category, the initial risk index of the attack is 3 → 3.6 → 4.3 → 5.2 → 6.2 → 7.4 The initial risk index 12 of the TCP flooding attack classified into the second category can be downgraded from 12? 10.8? 9.7? 8.7? 7.8? 7, and initial setting of the port scan classified into the third category The risk index 4 points can be adjusted down from 4 → 2.8 → 2.0 → 1.4 → 1.0 → 0.7.

Of course, the number of threshold adjustment times may be set to a different value in an appropriate range according to need, and the risk index adjustment of individual security events by the correcting unit 14 is performed within a proper range through the threshold adjustment number determining unit 15 It is possible to optimally maintain the reliability and accuracy of the risk index of individual security events, the risk index of each system, the risk index of each organization, and the risk index of the entire organization.

FIG. 5 is a flowchart illustrating a method of automatically correcting a risk index according to an embodiment of the present invention.

Referring to FIG. 5, the risk index automatic correction method S1 of the present invention may include a receiving step S11, a categorization step S13, and a correction step S15.

The receiving step S11 is a step in which the receiving unit 12 receives the security event and the judgment details generated in the security equipment. In the receiving step S11, the receiving unit 12 receives the security event details from the security device and receives the security manager's determination history and the system manager's determination history for the security event from the security manager terminal and the system administrator terminal, respectively have. Also, when the receiving unit 12 receives the security event and the determination details from the external system, the external system may collect the security event generated in the internal security equipment and the determination details about the security event and transmit the security event and the determination information together.

The security device may be a firewall, an Intrusion Detection System (IDS), an Intrusion Prevention System (IPS), a Web firewall, an L7 firewall, and the like. And secondary judgment as to whether threats or non-threats to the security event are additionally made by the system administrator if the threat or primary judgment is a threat.

3 and 4, the security event is a malicious site attack, a TCP flooding attack, and a port scan. The determination result is a malicious site attack, which is a security threat to both security administrators and system administrators And the TCP flooding was determined to be a threat by the security administrator, but it was judged to be non-threat by the system administrator, and the port scan may be judged as non-threat by the security administrator.

The categorizing step S13 classifies the security events received by the receiving unit 12 into categories based on the details of the security events. The categorization step S13 is a first category when the categorization unit 13 is a threat to both the primary event and the secondary event for the security event in question, The secondary determination may be performed in a second category in the case of non-threat and a third category in the case that the primary judgment of the security event is non-threatening.

3 and 4, since the categorizing unit 13 in the categorization step S13 judges that the attack by the malicious site is a threat to security by both the security administrator and the system administrator, it is classified into the first category , The TCP flooding attack was classified as the second category because it was judged to be a threat by the security administrator but was considered non-threatening by the system administrator and the port scan was judged as non-threat by the security administrator. have.

The correcting step S15 is a step in which the correcting unit 14 adjusts the risk index of the security event stored in the storing unit 11 to a predetermined ratio according to the category classified by the categorizing unit 13 . The correction step S15 adjusts the security index of the security event to a first rate when the security event is classified into the first category and when the security event is classified into the second category, The risk index of the security event is lowered to a second rate and the risk index of the security event is lowered to a third rate higher than the second rate when the security event is classified into the third category .

As a specific example, the first ratio may be selected from 15% to 25%, the second ratio from 5% to 15%, and the third ratio from 25% to 35% The ratio is 10%, and the third ratio is 30%.

3 and 4, the risk index is 3, the TCP flooding attack classified into the second category is 12, and the third category is the attack by malicious sites classified into the first category by the categorizing unit 13, In the case where the port scans classified into the categories are determined to be four points and stored in the storage unit 11, the risk index is undervalued in comparison with the judgment result as to whether or not an actual attack to the malicious site is an actual threat, Scans can be considered to have a higher risk index than the actual threats.

Through the correction step S15, the correcting unit 14 adjusts the risk index of the attack from 3 points to 3.6 points, which is raised to 20 points, to the malicious sites classified into the first category, The risk index of TCP flooding attacks can be adjusted from 10.8 to 10.8, and the risk index of port scans classified into the third category can be adjusted from 4.8 to 2.8.

If the risk index of each individual security event is repeatedly adjusted up or down through the correction step S15, the risk index of the individual security event is adjusted to a value corresponding to the actual threat judgment of the security manager or the system administrator The appropriateness or accuracy of the risk index of each individual security event can be improved, and reliability of the system-specific risk index, the organization-specific risk index, and the entire organization risk index calculated on the basis of the risk index can be improved.

FIG. 6 is a flowchart illustrating a method of automatically correcting a risk index according to another embodiment of the present invention.

Referring to FIG. 6, the method of automatically correcting a risk index according to another embodiment of the present invention further includes a step of determining a threshold adjustment number (S14) in comparison with the embodiment of FIG. Since the receiving step S11, the categorizing step S13 and the correcting step S15 are the same as those described above, only the threshold adjusting frequency determining step S14 will be described below.

The threshold adjustment number determination step S14 may be configured to determine whether the threshold adjustment time determination unit 15 has exceeded the threshold adjustment number of times of the upward or downward adjustment of the risk index of the security event before the correction step S15 . If it is determined in the threshold adjustment number determination step S14 that the upward or downward adjustment number of the risk index for the security event is within the threshold adjustment number as a result of the determination by the threshold adjustment number determination unit 15, If the number of threshold adjustment times is exceeded, the correction step (S15) is prevented from proceeding.

As described above, when the correcting unit 14 continuously performs upward or downward adjustment of the risk index of each individual security event through the correction step S15, the risk index is increased to infinity or converged to zero Problems can arise. In order to prevent such a problem, the step S14 of determining the number of threshold adjustment times allows the upward or downward risk index of each individual security event to be performed within a proper number of times.

For example, in the threshold adjustment number determination step S14, the threshold adjustment number determination unit 15 may perform the determination based on the threshold adjustment times set five times, and may update the risk index upward or downward for a specific individual security event If the number of times is more than five, that is, the sixth time, the correction step S15 may not be performed any more. The number of threshold adjustment times can be set to a different value in an appropriate range as needed. The risk index adjustment of the individual security events by the correction step S15 is performed within an appropriate range through the threshold adjustment number determination step S14, Reliability of individual security events such as adequacy or accuracy of risk index, risk index by system, risk index by organization, and risk index of whole organization can be maintained optimally.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, Should be interpreted as falling within the scope of.

1: Risk index automatic correction device
11: storage unit 12: receiving unit
13: Categorization part 14:
15: threshold adjustment number determination unit
S1: How to automatically correct the risk index
S11: Receiving step S13: Categorizing step
S14: Determination of the number of threshold adjustment times S15:

Claims (8)

A storage unit for storing a risk index for each security event,
A receiving unit for receiving a security event and a determination result generated in the security device;
A categorizing unit for classifying the security events received by the receiving unit into categories based on a determination result of the security event;
And a correction unit that adjusts the risk index of the security event stored in the storage unit to a predetermined ratio according to a category classified by the categorization unit,
The above judgment may be made based on a secondary judgment of whether the security manager's primary judgment about the threat or non-threat of the security event is threat or non-threat of the security event additionally performed by the system administrator Including,
The categorizing unit may be classified into a first category when the primary event and the secondary event are both threats to the security event. If the primary event is a threat or the secondary event is non-threat, Category, and if the primary judgment of the security event is non-threat, classification into the third category.
delete The method according to claim 1,
Wherein the correcting unit raises the risk index of the security event to a first rate when the security event is classified into the first category and when the security event is classified into the second category, , And when the security event is classified into the third category, the risk index of the security event is adjusted to a third ratio higher than the second ratio.
4. The method according to any one of claims 1 to 3,
Further comprising a threshold adjustment number determination unit for determining whether the number of upward or downward adjustment of the risk index of the security event exceeds a preset threshold adjustment number,
When the number of times of upward or downward adjustment of the risk index for the security event exceeds a threshold adjustment number as a result of the determination by the threshold adjustment number determination unit, the correcting unit does not perform upward or downward adjustment of the risk index for the security event A device for automatically correcting the risk index.
A receiving step of receiving a security event and a determination result generated in the security device by the receiving unit;
A categorizing step of categorizing the security events received by the receiving unit into categories based on a determination result of the security events;
And a correction step of adjusting the risk index of the security event stored in the storage unit by the correction unit in accordance with a category classified by the categorization unit,
The above judgment may be made based on a secondary judgment of whether the security manager's primary judgment about the threat or non-threat of the security event is threat or non-threat of the security event additionally performed by the system administrator Including,
Wherein the categorization step comprises the steps of: if the categorization unit is in a first category when both the primary judgment and the secondary judgment of the security event are a threat to the security event concerned, the primary judgment of the security event is a threat or the secondary judgment is non- Is classified into a second category in the case of a non-threatening security event and a third category in the case where a primary judgment on the security event is non-threatening.
delete 6. The method of claim 5,
Wherein the correcting step raises the risk index of the security event to a first rate when the security event is classified into the first category and if the security event is classified into the second category, The risk index of the security event is lowered to a third rate higher than the second rate when the security event is classified into the third category, Correction method.
8. The method according to any one of claims 5 and 7,
Before the correction step,
Further comprising a threshold adjustment number determination step of determining whether a threshold adjustment number determination unit has exceeded a preset threshold adjustment number of times of upward or downward adjustment of a risk index of the security event,
When the number of times of upward or downward adjustment of the risk index for the security event is within the threshold adjustment number as a result of the determination by the threshold adjustment number determination unit, the correction step is performed, and when the threshold adjustment time is exceeded, A method for automatically correcting a risk index.

Images