A study on the big data log analysis for security

Abstract

Recently, cyber-attack has become the serious national treat such as shut down industry control system, and an act of war. Therefore, the issue is suggested about the necessity of Enterprise Security Management (ESM) that is for integrated management of network system such as firewall, IPS, VPN, and etc. However, current ESM has the limit of blocking only cyber-attack from outside due to using the networking attack detection method that monitoring the traffic inflows from outside to inside. Therefore, this study suggests the new security log system using big data that enhances intelligence of security by analyzing the relationship between security and data events created from network, system, application service of main IT infrastructure. We assume to apply the distribution-based saving/processing technology through the security log system using big data which is suggested in the study. Moreover a ripple effect of enhanced customer service satisfaction due to the possibility of inflow and infection (spread) of malignant code in-house and real time monitoring.