Patent ID: 11956264
Assignee: LINE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A non-transitory computer readable medium storing computer readable instructions which, when executed by at least one processor, cause the at least one processor to perform a method comprising:
receiving an event to be analyzed from a security information & event management (SIEM) server, the event to be analyzed corresponding to a potential attack, the event to be analyzed selected by the SIEM server from a plurality of events detected by different security devices based on a desired correlation rule used to filter the plurality of events received by the different security devices;
registering the event to be analyzed;
collecting raw data associated with the registered event from a security device corresponding to the registered event among the different security devices in response to the registration of the event;
acquiring location information of an intended network location associated with a network attack based on the collected raw data;
simulating a network attack using the acquired location information based on the network attack corresponding to the registered event;
determining a validity status of the registered event based on the simulated network attack;
generating an exceptional processing message of the registered event based on results of the determining the validity status of the registered event; and
transmitting the generated exceptional processing message to the SIEM server.