SIEM 환경에서 무탐지 기반 유효성 관리 = Validity Management Based on No-Hit Detection in a SIEM Environment

다국어 초록 (Multilingual Abstract)

As security threats become increasingly complex and diverse, the number of detection scenarios and rules in Security Information and Event Management (SIEM) environments continues to grow. SIEM systems have become a core platform for threat detection and response by collecting and correlating logs from various security devices and systems. However, in real-world operations, many detection rules remain active in the system while generating no alerts over a given period. These so-called No-Hit Rules indicate a loss of operational validity in the detection policy and increase the workload of security analysts, as they must be manually reviewed or left unmanaged.
This study proposes a script-based operational framework that automatically identifies and manages such No-Hit Rules by correlating predefined SIEM detection rules with actual event logs at the database level. The framework periodically inspects all active rules, extracts those with no detection history within a specified time window, and outputs standardized log files that can be used for policy review and reporting. In an experimental evaluation conducted on a real SOC test environment, the proposed method identified 117 No-Hit Rules out of 300 active rules (approximately 39%), and reduced the end-to-end inspection time from about 300 minutes of manual work to 0.2 seconds through automation.
The results demonstrate that the proposed framework provides a practical approach to managing the operational validity of SIEM detection policies, enhancing both efficiency and consistency in rule-based monitoring. Future work may extend this framework by integrating automated root-cause analysis for No-Hit Rules and coupling it with semi-automatic policy refinement mechanisms to further improve security operations.

목차 (Table of Contents)

• 제 1 장 서 론 1
• 1.1 연구 배경 및 필요성 1
• 1.2 연구 방법 및 목적 3
• 제 2 장 관련 연구 7
• 2.1 보안 관제 개념·구조 7
• 2.2 SIEM 개념·발전 12
• 2.3 기존연구의 한계점 19
• 2.4 본 연구의 접근 방법 21
• 제 3 장 무탐지 발생 특성 및 운영상 과제 분석 23
• 3.1 보안위협과 탐지실패의 개요 23
• 3.2 무탐지 정의 24
• 3.3 무탐지 발생 사례 및 원인 25
• 3.4 무탐지 관리의 한계와 운영상 과제 26
• 3.5 정량적 관리 필요성과 향후 개선 방향 28
• 제 4 장 무탐지 자동 식별 및 정량 관리 방안
• 4.1 무탐지 자동 식별 절차 29
• 4.2 RM Score 기반 관리 체계 31
• 4.3 무탐지 원인 진단 절차 35
• 제 5 장 실험 환경 및 결과 41
• 5.1 실험 환경 42
• 5.2 실험 및 결과 43
• 제 6 장 결론 및 향후 연구 46
• 참 고 문 헌 49