KR102234514B1 - Artificial intelligence method and system for integrated it monitoring - Google Patents

Abstract

Various embodiments of the present invention relate to an integrated control method. An integrated control method according to an embodiment of the present invention includes the steps of acquiring data of a detection target; Determining a threshold value related to the data of the detection target; Comparing the data of the detection target with the threshold value; And when the data of the detection target is out of the normal range as a result of the comparison, determining whether or not the detection target has abnormal symptoms, wherein the determining of the threshold value is performed when acquiring the data of the detection target It is repeatedly performed every time, and the determining of the threshold may include: extracting past data of the detection target for a preset reference period from before the time when the data is acquired; Calculating a reference value from the past data; And determining a threshold value based on the reference value and a designated weight. Other embodiments may also be possible.

Description

Artificial intelligence integrated IT control method and system {ARTIFICIAL INTELLIGENCE METHOD AND SYSTEM FOR INTEGRATED IT MONITORING}

The present invention relates to an integrated control method and system, and more particularly, to a method and system for implementing intelligent precision detection using an automatic variable threshold.

Most of the companies operating the system use various types of software that can monitor the system or receive alerting. These software check whether the threshold is exceeded through the threshold value stored separately for a specific item in the system or database, and when the threshold value is exceeded, it alerts the user to that fact, but in reality, it has many operational problems, so a practical effect is expected. It is true that it is difficult to do. In particular, the one-dimensional uniform threshold setting cannot reflect the various operational characteristics of the system or database (peak-time, settlement, closing work, etc.), and the detection criterion threshold value is used only with simple numbers. Determining a failure or accident can cause inaccurate detection, and if a uniform threshold is set for all detection targets, the characteristics of each detection target cannot be reflected, so many of the many abnormal symptom events are noise. . In addition, even if a detection target in which a security incident has occurred due to the detection of abnormal signs, it is difficult to find the targets or conspirators who have caused a security incident similar to the detection target.

The present invention has been devised to solve the above problems, and an object of the present invention is to provide a method and system for accurately reflecting the state of a detection target using an automatic variable threshold.

In addition, an object of the present invention is to provide a method and system for accurately detecting abnormal symptoms of a detection target by setting a personalized threshold value for each detection target.

In addition, an object of the present invention is to provide a method and system for accurately detecting abnormal symptoms of a target to be detected using a plurality of clusters.

In addition, an object of the present invention is to provide a method and system for detecting all detection targets that have caused the same accident by using the similarity or relationship between detection targets.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems that are not mentioned will be clearly understood by those skilled in the art from the following description.

An integrated control method according to an embodiment of the present invention includes the steps of acquiring data of a detection target; Determining a threshold value related to the data of the detection target; Comparing the data of the detection target with the threshold value; And when the data of the detection target is out of the normal range as a result of the comparison, determining whether or not the detection target has abnormal symptoms, wherein the determining of the threshold value is performed when acquiring the data of the detection target It is repeatedly performed every time, and the determining of the threshold may include: extracting past data of the detection target for a preset reference period from before the time when the data is acquired; Calculating a reference value from the past data; And determining a threshold value based on the reference value and a designated weight.

An integrated control system according to an embodiment of the present invention includes a main server that detects and analyzes abnormal symptoms of a detection target, the main server acquires data of the detection target, and the main server obtains the detection target. When a threshold value related to data is determined, the main server compares the data of the detection target with the threshold value, and the main server compares the data of the detection target with the comparison result, the detection target Is determined whether or not there is an abnormal symptom, the main server repeatedly determines the threshold value each time the data of the detection target is acquired, and the main server is for a preset reference period from before the time when the data is acquired The threshold value may be determined by extracting past data of the detection target, calculating a reference value from the past data, and determining a threshold value based on the reference value and a designated weight.

According to the present invention as described above, it has various effects as follows.

The present invention can accurately reflect the state of the detection target by using an automatically variable threshold.

In addition, the present invention can accurately detect abnormal symptoms of a detection target by setting a personalized threshold value for each detection target.

In addition, the present invention can accurately detect abnormal symptoms of a detection target by using a plurality of clusters.

In addition, the present invention can detect all detection targets that have caused the same accident by using the similarity or relationship of the detection target.

1 is a block diagram showing an integrated control system of the present invention.
2 is a flowchart illustrating an integrated control method according to an embodiment of the present invention.
3 is a flowchart illustrating a method for determining a threshold value according to an embodiment of the present invention.
4 is a flowchart illustrating a method of determining a state of a detection target according to an embodiment of the present invention.
5 is an exemplary diagram illustrating a method of determining a state of a detection target according to an embodiment of the present invention.
6 is a flowchart illustrating a method of determining a threshold value from log data including text according to an embodiment of the present invention.
7 is a flowchart illustrating a method of determining an abnormal symptom using a cluster according to an embodiment of the present invention.
8 is an exemplary diagram illustrating a method of determining an abnormal symptom using a cluster according to an embodiment of the present invention.
9 is a flowchart illustrating a method of determining an abnormal symptom of a detection target using similarity according to an embodiment of the present invention.
10 is a flowchart illustrating a method of determining an abnormal symptom of a detection target using a relationship diagram according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments to be posted below, but may be implemented in various different forms, and only these embodiments make the posting of the present invention complete, and common knowledge in the technical field to which the present invention pertains. It is provided to completely inform the scope of the invention to those who have, and the invention is only defined by the scope of the claims. The same reference numerals refer to the same elements throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used with meanings that can be commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not interpreted ideally or excessively unless explicitly defined specifically.

The terms used in the present specification are for describing exemplary embodiments and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase. As used herein, “comprises” and/or “comprising” do not exclude the presence or addition of one or more other elements other than the mentioned elements.

1 is a block diagram showing an integrated control system of the present invention.

Referring to FIG. 1, the integrated control system 10 according to an embodiment of the present invention may monitor the in-house system 20 through an L4 switch 50 or a load balancing forwarder 300. In addition, the integrated control system 10 may monitor the work content and work changes of executives and employees through data acquired from the in-house system 20.

In one embodiment, the in-house system 20 may include a security system 30, an infrastructure system 40, and a business system 50. The security system 30 may include an internal security system and an external security system, and the internal security system includes Data Loss Prevention (DLP), Digital Right Management (DRM), PC security, Identity and Access Management (IAM), or personal information. It may include security solutions to prevent the leakage of internal information such as a detection system, and the external security system is a firewall, a web application firewall (WAF), a virtual private network (VPN), an intrusion prevention system (IPS), or a data system (nDLP). It may include security solutions for preventing internal and external hacking attacks such as Loss Prevention). The infrastructure system may include enterprise infrastructure systems such as server OS, database, network, WAS, and cloud. The business system may include systems that support corporate business such as a personal information processing system, identity authentication, system access record, and an in-house intranet system.

In one embodiment, the integrated control system 10 includes a main server 100, a detection server 200, a load balancing forwarder 300, a collection server 400, a search server 500, and an analysis server 600 can do. Each of the servers included in the integrated control system 10 may communicate with each other through a network. Here, the network may include a wireless network and a wired network. For example, the network may be a short-range communication network (e.g., Bluetooth, WiFi direct, or IrDA (infrared data association)) or a telecommunication network (e.g., a cellular network, the Internet, or a computer network (e.g., LAN or WAN)). have.

In one embodiment, the main server 100, the detection server 200, the load balancing forwarder 300, the collection server 400, the search server 500 and the analysis server 600 may be interlocked with each other, and each server The information obtained from may be updated in the collection server 400.

In one embodiment, the load balancing forwarder 300, the collection server 400, and the search server 500 may be separately divided into a big data system.

In an embodiment, the load balancing forwarder 300 may collect raw data from the in-house system 10. For example, the load balancing forwarder 300 may collect unlimited data, and may collect heterogeneous data (IT infra, application, Net streem, etc.). The data collection method of the load balancing forwarder 300 may include agent collection, FTP transmission, Syslog transmission, SNMP, network packet collection, or DB query transmission.

In one embodiment, the collection server 400 can receive all data from the load balancing forwarder 300, can guarantee data integrity, have a long-term archiving function, and save storage space using compression technology. You can save. The collection server 400 may expand a plurality of servers indefinitely, and each of the plurality of servers may synchronize data and store data distributedly.

In one embodiment, the search server 500 may query all data received from the collection server 400. For example, the search server 500 may perform a data integrated inquiry function through a big data query. The search server 500 may search for the same data and distribute the search load.

In an embodiment, the main server 100 may control overall operations for detecting, analyzing, and responding to abnormal symptoms of a detection target. The main server 100 may also serve as the detection server 200 when the detection server 200 is omitted. The main server 100 may request the detection server 200 to detect a detection target, and may receive a detection result event from the detection server 200.

In an embodiment, the detection server 200 may transmit a detection result to the main server 100 based on the data of the detection target. The detection server 200 may be omitted. The detection server 200 may detect single scenarios, complex scenarios, time series analysis, correlation analysis, AI anomaly detection, statistical analysis, and the like. The detection server 200 may perform a detection function using a general threshold and an automatically variable threshold.

In one embodiment, the analysis server 600 may include a system dedicated to artificial intelligence analysis, and may optimize an artificial neural network used for artificial intelligence analysis. For example, the analysis server 600 may receive an artificial intelligence analysis request from the main server 100, and the artificial intelligence analysis result may be displayed on the screen of the main server 100 so that a security person or an operation person can see it. have. The dashboard of the analysis server 600 can be divided into automatic response to AI events and optimization of AI artificial neural networks. The data-based analysis of the main server 100 may include a data search wizard, data visualizer, infrastructure operation search, employee security search, real-time failure prediction, time series failure prediction, and the like. Event analysis response of the main server 100 may include event analysis monitor, scenario monitor, organization profiling, high-risk group profiling, and employee profiling, and the analysis server 600 may include similarity analysis, relationship analysis, etc. I can. Meanwhile, although not shown in the drawings, an artificial intelligent CCTV may be further provided in the system 10 of the present invention, and the analysis server 600 may utilize the captured image of the CCTV.

In one embodiment, the main server 100, the detection server 200, and the analysis server 600 may be classified as an abnormal symptom control system.

Meanwhile, although not shown in the drawings, the system 10 of the present invention may further include an AI analysis server and an AI generation system. The AI generation system can generate artificial neural networks or machine learning models using machine learning and deep learning technologies. Machine learning can include Supervised Leaning, Un-supervised Learning, Semi-supervides Learning, and Statistical Algorithm, and deep learning can include a number of It may contain artificial intelligence algorithms. The AI analysis server can perform automatic variable threshold calculation, AI abnormality detection, similarity analysis, relationship analysis, Face ID analysis, and automatic event response.

2 is a flowchart illustrating an integrated control method according to an embodiment of the present invention. The operations of FIG. 2 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 2 may be performed by an artificial intelligence algorithm.

Referring to FIG. 2, in an embodiment, in operation 21, the main server 100 may acquire data of a detection target. For example, detection targets are employees (e.g., company number, name, etc.), IP address (e.g., IP address of internal and external systems), infrastructure system (e.g., IP address or host of in-house server OS, network equipment, cloud node, etc.) Name) or a business system (eg, an IP address or host name of a company business system such as an intranet system, an enterprise resource management system, and a project management system). The data to be detected is security log data for each employee (e.g. DRM, DLP, USB usage history, personal information detection solution log), log data of security system by internal and external IP address (e.g. firewall log, IPS/IDS log, vaccine detection) Log, DDOS log), infrastructure system log data (e.g. log data such as syslog, access_log, and network traffic log), and infrastructure system performance data (e.g. server CPU usage, memory usage, resource status of each infrastructure system) or business It may include at least one of system log data.

In an embodiment, in operation 22, the main server 100 may determine a threshold value related to data of the detection target. The threshold value may be determined in consideration of the characteristics of each detection target. For example, the threshold may be determined in consideration of job characteristics for each employee or usage characteristics for each system. A specific operation of determining the threshold value will be described later in FIG. 3. Meanwhile, the operation of determining the threshold value may be repeatedly performed each time data of a detection target is acquired. Accordingly, the threshold value of the present invention may be automatically adjusted to a threshold value reflecting a change in the state of a detection target in consideration of a change in job duties for each employee or a change in usage for each system.

In an embodiment, in operation 23, the main server 100 may compare the detection target data with a threshold value. For example, if the detection target is any one of the employees and the data is the number of times the DRM security is canceled, the threshold value of the number of times the employee's DRM security is canceled can be compared with the data.

In an embodiment, in operation 24, the main server 100 may check whether data of a detection target is out of a normal range as a result of the comparison. For example, if the detection target is one of the employees and the data is the number of DRM security releases, if the threshold value of the number of times the DRM security release of the corresponding employee is 6 and the data is 7, it can be confirmed that it is out of the normal range.

In an embodiment, when the data of the detection target does not exceed the normal range as a result of the comparison, the main server 100 may continuously repeat the operations 21 to 23.

In an embodiment, in operation 25, when the data of the detection target is out of the normal range as a result of the comparison, the main server 100 may determine whether the detection target has abnormal symptoms. For example, as in the above situation, if the number of times the employee's DRM security release is higher than the threshold value is 7, it can be determined as an abnormal symptom even if the number of times the number of times out of the threshold value is one. If the number of times exceeds the standard, it can be judged as an abnormal symptom, and regardless of the number of times, whether or not the DRM security-deactivated document of the employee has been exported to the outside by comprehensively analyzing the mail system, USB connection, printing, etc. If it is confirmed that it has been carried out to the outside where there is no obligation to maintain confidentiality, it can be judged as an abnormal symptom. That is, the criterion for determining as an abnormal symptom may consider the business characteristics or performance characteristics of the target to be detected, and determine the abnormal symptom based on a preset standard.

Meanwhile, the abnormal symptom may be determined according to a preset scenario. For example, various anomalous symptom determination scenarios may be set in advance, such as when the number of times that the employee's PC is exporting files through USB, and the number of times the DRM security cancellation payer is released by designating himself/herself is more than the reference number.

On the other hand, for example, abnormal symptoms include user's access to harmful IP, E-DLP intentional interruption, personal information detection in PC, business system account sharing, multiple accounts, attempts to increase/acquire unauthorized server privileges, excessive use of USB, and the same department. It may include the average number of personal information held, users' access to harmful IPs, printout security bypass, etc. In addition, it may include performance degradation of infrastructure systems or business systems. Of course, the abnormal symptom is not limited to the above example, and may include all abnormal events related to the in-house system 10 to be monitored.

3 is a flowchart illustrating a method for determining a threshold value according to an embodiment of the present invention. The operations of FIG. 3 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. The operations of FIG. 3 are operations in which operation 22 of FIG. 2 is embodied. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 3 may be performed by an artificial intelligence algorithm.

Referring to FIG. 3, in an embodiment, in operation 31, the main server 100 may extract past data of a detection target for a preset reference period from before a time when data is acquired. For example, the preset reference period may be determined in consideration of job characteristics for each employee or usage characteristics for each system. For example, if the data is the number of e-mails sent by an employee, the number of e-mails sent by the corresponding employee in the past month can be extracted based on the day before the current measurement point.

In an embodiment, in operation 32, the main server 100 may calculate a reference value from past data. For example, the reference values are the mean, variance, standard deviation, skewness, kurtosis, peak-to-peak, crest factor, and k factor of historical data. It can be calculated using any one of (K-Factor), Mahalanobis Distance, and Coefficient of Variance, or a combination thereof. For example, here, the average may mean an average of the data to be monitored in a certain section, and the standard deviation may be a scatter diagram indicating how far away the data to be monitored is from the average.

In an embodiment, in operation 33, the main server 100 may determine a threshold value based on a reference value and a specified weight. For example, the designated weight may be a sensitivity value determined according to the characteristics of data. For example, the number of DRM-unsecure and unsecured e-mails by employee A, who has a lot of work with an external company, may be much higher than that of employee B, who has no work with an external company. Therefore, the weight of employee A can be given high and the weight of employee B can be given low. For convenience of explanation, in terms of numbers, when the reference value is 3 and the designated weight is 2 times, the threshold value may be 6, which is the upper limit value.

Of course, differently from the above, the threshold value may be set in various ways in consideration of the characteristics of the target to be detected, and the threshold value of the present invention may be calculated every time the data of the target to be detected is acquired.

4 is a flowchart illustrating a method of determining a state of a detection target according to an embodiment of the present invention. 5 is an exemplary diagram illustrating a method of determining a state of a detection target according to an embodiment of the present invention. The operations of FIG. 4 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 4 may be performed by an artificial intelligence algorithm.

Referring to FIG. 4, in an embodiment, in operation 41, the main server 100 may check a time series pattern of data to be detected at each preset period. For example, the preset cycle may be determined in consideration of the characteristics of the work of the employees or the characteristics of each system's use. For example, as shown in FIG. 5, the main server 100 may check the time series pattern 50 of the data to be detected and the threshold time series pattern 53 of the data.

In an embodiment, in operation 42, the main server 100 may check a point in time when the detection target data is out of a normal range. For example, the point in time 54 when the data is out of the threshold value may be identified as a point in time out of the normal range.

In an embodiment, in operation 43, the main server 100 may compare the first time series pattern 51 of data before the time point out of the normal range and the second time series pattern 52 of data after the time point. For example, when a trend of data out of the normal range continues for a certain period after the time point 54 out of the normal range, the existence of the second time series pattern 52 may be confirmed.

In an embodiment, in operation 44, when the first time series pattern 51 and the second time series pattern 52 are different from each other as a result of the comparison, the main server 100 may determine that the state of the detection target has changed. For example, the main server 100 may determine the time point 54 out of the normal range as the time point for job change for each employee or the time point for use change for each system, and after the time point 54 out of the normal range, a new work section or It can be determined as a new usage section.

6 is a flowchart illustrating a method of determining a threshold value from log data including text according to an embodiment of the present invention. The operations of FIG. 6 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 6 may be performed by an artificial intelligence algorithm.

Referring to FIG. 6, in an embodiment, in operation 61, the main server 100 may acquire log data of a detection target. For example, log data may be the contents of e-mails sent by employees.

In an embodiment, in operation 62, the main server 100 may extract text included in log data. For example, the text may be text included in the outgoing mail.

In an embodiment, in operation 63, the main server 100 may obtain values corresponding to each of the plurality of words by vectorizing each of the plurality of words included in the text. For example, the main server 100 may match words such as name, name, and name having a similar meaning to similar values of 100, 101, and 102.

In an embodiment, in operation 64, the main server 100 may extract a reference value from each corresponding value. For example, the reference value is not only based on descriptive statistics such as the mean, standard deviation, or median of the past data, but also the vector numerical array values of log data using a dimension reduction method such as Auto Encoder or PCA. Can be calculated.

In an embodiment, in operation 65, the main server 100 may determine a threshold value based on the extracted reference value and a specified weight. This can be determined in the same way as operation 33.

7 is a flowchart illustrating a method of determining an abnormal symptom using a cluster according to an embodiment of the present invention. 8 is an exemplary diagram illustrating a method of determining an abnormal symptom using a cluster according to an embodiment of the present invention. The operations of FIG. 7 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 7 may be performed by an artificial intelligence algorithm.

Referring to FIG. 7, in an embodiment, in operation 71, the main server 100 may acquire data of a detection target. For example, the data to be detected may be the number of DRM security cancellations and the number of transmissions of documents that have been canceled security, the number of packets blocked by an external security system, and the CPU usage or memory performance of the infrastructure system. Meanwhile, data for each employee may be obtained on a daily basis, IP address on an hourly basis, and performance data of an infrastructure system may be obtained on an hourly basis.

In an embodiment, in operation 72, the main server 100 may cluster (a type of machine learning) data of a detection target based on at least one parameter. The parameter may be any one or several data of various log data of employees, security systems, infrastructure systems, or work systems.For example, the parameter may be the number of DRM security releases and the number of times the security releases were sent, or both. I can.

In an embodiment, in operation 73, the main server 100 may compare the clustered cluster and data. For example, the main server 100 may check clusters 81, 82, 83, and 84, and each cluster may be clusters to which team members performing the same task belong. In addition, the data 86, 87, 88, and 89 may be out of the cluster even though they are team members performing the same task, and for example, more secured documents may be sent to the outside than usual.

In an embodiment, in operation 74, when at least one of the comparison result data is out of a reference range, the main server 100 may determine that an abnormal symptom has occurred in the detection target corresponding to the at least one. For example, if the data (86, 87, 88, 89) is out of the cluster even though the team member performs the same task, the employee who has the data (86, 87, 88, 89) can be checked for security incidents, etc. It is possible to determine whether abnormal symptoms have occurred by checking the performance of.

9 is a flowchart illustrating a method of determining an abnormal symptom of a detection target using similarity according to an embodiment of the present invention. The operations of FIG. 9 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 9 may be performed by an artificial intelligence algorithm.

Referring to FIG. 9, in an embodiment, in operation 91, the main server 100 may check a time series pattern of data or a cluster based on data.

In an embodiment, in operation 92, the main server 100 may determine the similarity of the detection target based on a time series pattern, a cluster, or a preset similarity technique. For example, employees or systems that have similar time series patterns or belong to the same cluster may have a high degree of similarity. In addition, the similarity of the detection target may be determined using similarity techniques such as cosine similarity, Euclidean distance, and Jaccard similarity.

In an embodiment, in operation 93, the main server 100 may detect an abnormal symptom of any one of the detection targets. For example, you can detect an employee with an excessively large number of unsecured documents sent.

In an embodiment, in operation 94, the main server 100 may extract at least one detection target having a high similarity to any one in which the abnormal symptom is detected. For example, one employee and other employees having the same time series pattern in terms of the number of out-of-security documents sent or other employees having a high degree of similarity may be extracted based on the similarity technique.

In an embodiment, in operation 95, the main server 100 may determine an abnormal symptom of at least one detection target having a high similarity. For example, you can check whether other employees you extract have the same anomaly.

10 is a flowchart illustrating a method of determining an abnormal symptom of a detection target using a relationship diagram according to an embodiment of the present invention. The operations of FIG. 10 may be performed by the main server 100 or the detection server 200 disclosed in FIG. 1. Hereinafter, for convenience of description, an example in which the main server 100 performs each operation will be described. The operations of FIG. 10 may be performed by an artificial intelligence algorithm.

Referring to FIG. 10, in an embodiment, in operation 1001, the main server 100 may determine a relationship diagram of a detection target based on at least one of a photographed image of a camera, an access record, or the number of the same files shared with each other. have. For example, in the case of a shooter relationship within the same team member, two employees can have a high degree of relationship, and in the case of an executive and a secretary, a lot of the same files can be shared, so they can have a high degree of relationship.

In an embodiment, in operation 1002, the main server 100 may detect an abnormal symptom of any one of the detection targets. For example, it is possible to detect abnormal signs of the shooter employee or executive.

In an embodiment, in operation 1003, the main server 100 may extract at least one detection target having a high relationship with any one in which the abnormal symptom is detected. For example, the assistant shooter employee or secretary of the shooter employee may be extracted.

In an embodiment, in operation 1004, the main server 100 may determine an abnormal symptom of at least one detection target having a high relationship. For example, the assistant shooter employee or secretary of the shooter employee may also check whether there is the same abnormality and determine whether an accident such as a security incident occurs.

An integrated control method according to an embodiment of the present invention includes the steps of acquiring data of a detection target; Determining a threshold value related to the data of the detection target; Comparing the data of the detection target with the threshold value; And when the data of the detection target is out of the normal range as a result of the comparison, determining whether or not the detection target has abnormal symptoms, wherein the determining of the threshold value is performed when acquiring the data of the detection target It is repeatedly performed every time, and the determining of the threshold may include: extracting past data of the detection target for a preset reference period from before the time when the data is acquired; Calculating a reference value from the past data; And determining a threshold value based on the reference value and a designated weight.

According to various embodiments of the present disclosure, it may further include checking a time series pattern of the data of the detection target at every preset period.

According to various embodiments of the present disclosure, the determining of an abnormal symptom of the detection target may include: checking a time point when the data of the detection target is out of the normal range; Comparing a first time series pattern of the data before the time point out of the normal range and a second time series pattern of the data after the time point; And determining that the state of the detection target has changed when the first time series pattern and the second time series pattern are different from each other as a result of the comparison.

According to various embodiments of the present disclosure, the method includes: acquiring log data of the detection target; Extracting text included in the log data; Obtaining a numerical value corresponding to each of the plurality of words by vectorizing each of the plurality of words included in the text; Extracting the reference value from each of the corresponding values; And determining the threshold value based on the extracted reference value and the designated weight.

According to various embodiments of the present disclosure, the step of clustering the data of the detection target based on at least one parameter; Comparing the clustered cluster and the data; And determining that an abnormal symptom has occurred in the detection target corresponding to the at least one when at least one of the data is out of the reference range as a result of the comparison.

According to various embodiments of the present disclosure, the step of checking a time series pattern of the data or a cluster based on the data; Determining a similarity of the detection target based on the time series pattern, the cluster, or a preset similarity technique; Detecting an abnormal symptom of any one of the detection targets; Extracting at least one detection target having a high similarity to any one in which the abnormal symptom is detected; And determining an abnormal symptom of the at least one detection target having high similarity.

According to various embodiments of the present disclosure, the method may include determining a relationship degree of the detection target based on at least one of an image captured by a camera, an access record, or the number of identical files shared with each other; Detecting an abnormal symptom of any one of the detection targets; Extracting at least one detection target having a high relationship with any one of the abnormal symptoms detected; And determining an abnormal symptom of the at least one detection target having a high relationship.

According to various embodiments, the detection target may include at least one of an employee, a security system, an infrastructure system, or a work system.

According to various embodiments, the data to be detected may include at least one of log data for each employee, log data of a security system, log data of an infrastructure system, performance data of an infrastructure system, or log data of a work system.

An integrated control system according to an embodiment of the present invention includes a main server that detects and analyzes abnormal symptoms of a detection target, the main server acquires data of the detection target, and the main server obtains the detection target. When a threshold value related to data is determined, the main server compares the data of the detection target with the threshold value, and the main server compares the data of the detection target with the comparison result, the detection target Is determined whether or not there is an abnormal symptom, the main server repeatedly determines the threshold value each time the data of the detection target is acquired, and the main server is for a preset reference period from before the time when the data is acquired The threshold value may be determined by extracting past data of the detection target, calculating a reference value from the past data, and determining a threshold value based on the reference value and a designated weight.

In the above, embodiments of the present invention have been described with reference to the accompanying drawings, but those skilled in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features. You will be able to understand. Therefore, the embodiments described above are illustrative in all respects, and should be understood as non-limiting.

100: main server 200: detection server
300: load balancing forwarder 400: collection server
500: search server 600: analysis server
10: Integrated control system

Claims (10)

In the artificial intelligence integrated IT control method,
A data acquisition step of acquiring data of a plurality of detection targets;
A first threshold value determining step of determining a first threshold value related to data of a first detection target;
Comparing the data of the first detection target with the first threshold value, and determining that an abnormal symptom has occurred with respect to the first detection target when the data of the first detection target exceeds the first threshold as a result of the comparison , Determining a first abnormal symptom to be detected;
Determining a degree of similarity between the plurality of detection targets based on the acquired data of the plurality of detection targets;
Extracting a second detection target having a high similarity to the first detection target when it is determined that an abnormal symptom has occurred in the first detection target; And
A second detection target abnormal symptom determining step of determining whether or not the second detection target abnormal symptom occurs,
The step of determining the first threshold value,
And determining a first threshold value based on a reference value of the first detection target data and a first weight designated according to a characteristic of the first detection target.
The method of claim 1,
Further comprising the step of clustering the data of the plurality of detection targets based on at least one parameter,
The step of determining the first abnormal symptom to be detected,
Compare the data of the first detection target with the cluster to which the first detection target belongs, and when the data of the first detection target exceeds the first threshold value from the cluster, an abnormal symptom occurs with respect to the first detection target. It is determined that the integrated control method. delete The method of claim 1,
Determining a relationship degree between a plurality of detection targets based on at least one of a photographed image of a camera, an access record, or the number of the same files shared with each other;
Extracting a second detection target having a high relationship with the first detection target when it is determined that an abnormal symptom has occurred in the first detection target; And
The integrated control method further comprising the step of determining whether the second detection target abnormal symptom occurs or not. The method of claim 4,
The second detection target abnormal symptom determination step,
Determining a second threshold value related to the data of the second detection target; And
Comparing the data of the second detection target with the second threshold value, and determining that an abnormal symptom has occurred in the second detection target when the data of the second detection target exceeds the second threshold as a result of the comparison Including a step, integrated control method. The method of claim 5,
The data of the second detection target is characterized in that the data of the same type as the data type of the first detection target deviating from the first threshold value, integrated control method. An integrated control program that is combined with a computer that is hardware and stored in a recording medium to execute the method of any one of claims 1 to 2 and 4. In the artificial intelligence integrated IT control system,
It includes a main server that detects and analyzes abnormal symptoms of the target to be detected,
The main server acquires data of a plurality of detection targets,
The main server determines a first threshold value related to data of a first detection target,
The main server compares the data of the first detection target with the first threshold, and if the data of the first detection target exceeds the first threshold as a result of the comparison, an abnormal symptom is generated for the first detection target. Judged to have occurred,
The main server determines a relationship between a plurality of detection targets based on at least one of a camera's captured image, an access record, the number of identical files shared with each other, network traffic, mail receiving and sending contents, and messenger receiving and sending contents,
When the main server determines that an abnormal symptom has occurred in the first detection target, extracts a second detection target having a high relationship with the first detection target, and
The main server determines whether or not an abnormal symptom of the second detection target occurs,
The first threshold is,
And a first threshold value is determined based on a reference value of the first detection target data and a first weight designated according to a characteristic of the first detection target.
delete delete

Images