US 11,876,820 B2
Security information visualization device, security information visualization method, and storage medium for storing program for visualizing security information
Younsu Lee, Daejeon (KR); Jungsuk Song, Sejong-si (KR); Sangsoo Choi, Sejong-si (KR); Kyuil Kim, Daejeon (KR); Hyeakro Lee, Daejeon (KR); Taewoong Kwon, Daejeon (KR); Harksoo Park, Daejeon (KR); and Jinhyung Park, Daejeon (KR)
Assigned to KOREA INSTITUTE OF SCIENCE & TECHNOLOGY INFORMATION, Daejeon (KR)
Filed by KOREA INSTITUTE OF SCIENCE & TECHNOLOGY INFORMATION, Daejeon (KR)
Filed on Jun. 10, 2022, as Appl. No. 17/837,335.
Application 17/837,335 is a continuation of application No. PCT/KR2020/013245, filed on Sep. 28, 2020.
Claims priority of application No. 10-2019-0166138 (KR), filed on Dec. 12, 2019.
Prior Publication US 2022/0303298 A1, Sep. 22, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 21/55 (2013.01)
CPC H04L 63/1425 (2013.01) [H04L 63/20 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method for visualizing security information, comprising:
preprocessing log data extracted from a security device;
calculating period data of element information related to IP address information about a security action based on the preprocessed log data; and
providing visualization information obtained by visualizing the IP address information and the calculated period data of the element information,
wherein the visualization information lists IP address information objects in a row or line in a tower shape based on a degree of security danger which is determined by an evaluation of danger in the IP address information,
wherein the method further comprises receiving a user input for selecting one of the IP address information objects,
wherein, in response to the user input, the visualization information further displays a log ring object in a cylindrical shape around the selected IP address information object, a circumferential direction of the log ring object representing a set time information and a vertical direction of the log ring object representing a corresponding amount of the log data, and
wherein the visualization information indicates a suspected attack on an IP address based on a degree of change in amount of the log data.