Method and apparatus for visualizing medical device network and security attack
View Patent ↗Disclosed herein is a method for visualizing a medical device network and a security threat. The method includes representing nodes in zones that are divided into a server zone including nodes corresponding to server devices, a medical device zone including nodes corresponding to medical devices, a white zone including registered nodes excluding the server devices and the medical devices, and a gray zone including nodes included in none of the above-mentioned zones, representing links between the nodes, and representing a node and a link in which a security attack is detected using a different color when the security attack is detected in the node.
1 . A method for visualizing a medical device network and a security threat, comprising:
representing nodes in zones that are divided into a server zone including nodes corresponding to server devices, a medical device zone including nodes corresponding to medical devices, a white zone including registered nodes excluding the server devices and the medical devices, and a gray zone including nodes included in none of the server zone, the medical device zone, and the white zone;
representing links between the nodes; and
representing a node and a link in which a security attack is detected using a different color when the security attack is detected in the node.
2 . The method of claim 1 , wherein types of the nodes include an IP node corresponding to a terminal having an IP address, a subnet node corresponding to each subnet address, a gray node for connecting nodes corresponding to the gray zone, and a white node for connecting nodes corresponding to the white zone.
3 . The method of claim 2 , wherein types of the links include an IP-node-to-subnet-node type, a subnet-node-to-subnet-node type, a gray-node-to-IP-node type, a white-node-to-IP-node type, a gray-node-to-subnet-node type, a white-node-to-subnet-node type, and an IP-node-to-IP-node type.
4 . The method of claim 3 , wherein a link of the IP-node-to-IP-node type is generated when a security attack is detected.
5 . The method of claim 3 , wherein:
a link of the IP-node-to-subnet-node type represents an IP node belonging to a subnet address corresponding to the subnet node, and
a link of the subnet-node-to-subnet-node type represents that communication information between IP nodes belonging to respective subnet addresses is present.
6 . The method of claim 3 , wherein, in the gray zone, a preset number of IP nodes is represented, and an IP node in which a security attack is detected is preferentially represented.
7 . The method of claim 3 , wherein representing the node and the link using the different color includes displaying detailed information, including a type of the security attack, a subtype thereof, and port information, for the link in which the security attack is detected.
8 . The method of claim 3 , wherein representing the node and the link using the different color includes displaying detailed information about the security attack for neighboring nodes around the node in which the security attack is detected.
9 . The method of claim 5 , wherein information about the security attack is stored in a database structure including a time window, a type of the security attack, and an IP address.
10 . An apparatus for visualizing a medical device network and a security threat, comprising:
memory in which at least one program is recorded; and
a processor for executing the program,
wherein the program includes instructions for performing
representing nodes in zones that are divided into a server zone including nodes corresponding to server devices, a medical device zone including nodes corresponding to medical devices, a white zone including registered nodes excluding the server devices and the medical devices, and a gray zone including nodes included in none of the server zone, the medical device zone, and the white zone,
representing links between the nodes, and
representing a node and a link in which a security attack is detected using a different color when the security attack is detected in the node.
11 . The apparatus of claim 10 , wherein types of the nodes include an IP node corresponding to a terminal having an IP address, a subnet node corresponding to each subnet address, a gray node for connecting nodes corresponding to the gray zone, and a white node for connecting nodes corresponding to the white zone.
12 . The apparatus of claim 11 , wherein types of the links include an IP-node-to-subnet-node type, a subnet-node-to-subnet-node type, a gray-node-to-IP-node type, a white-node-to-IP-node type, a gray-node-to-subnet-node type, a white-node-to-subnet-node type, and an IP-node-to-IP-node type.
13 . The apparatus of claim 12 , wherein a link of the IP-node-to-IP-node type is generated when a security attack is detected.
14 . The apparatus of claim 12 , wherein:
a link of the IP-node-to-subnet-node type represents an IP node belonging to a subnet address corresponding to the subnet node, and
a link of the subnet-node-to-subnet-node type represents that communication information between IP nodes belonging to respective subnet addresses is present.
15 . The apparatus of claim 12 , wherein, in the gray zone, a preset number of IP nodes is represented, and an IP node in which a security attack is detected is preferentially represented.
16 . The apparatus of claim 12 , wherein representing the node and the link using the different color includes displaying detailed information, including a type of the security attack, a subtype thereof, and port information, for the link in which the security attack is detected.
17 . The apparatus of claim 12 , wherein representing the node and the link using the different color includes displaying detailed information about the security attack for neighboring nodes around the node in which the security attack is detected.
18 . The apparatus of claim 14 , wherein information about the security attack is stored in a database structure including a time window, a type of the security attack, and an IP address.