WO2023158111A1 - Cyber security management system for maritime autonomous surface ship - Google Patents

Abstract

A cyber security management system for a maritime autonomous surface ship is disclosed. Provided in the present embodiment is a cyber security management system for a maritime autonomous surface ship, the system managing cyber security for a maritime autonomous surface ship by protecting both information technology (IT) and operational technology (OT) systems of a maritime autonomous surface ship, and by simplifying on-board work while complying with maritime security regulations so as to prevent cyberattacks from spreading.

Description

Cyber Security Management System for Autonomous Ships

One embodiment of the present invention relates to a cyber security management system for an autonomous vessel.

The contents described below merely provide background information related to the present embodiment and do not constitute prior art.

Most of the current ships are not provided with the latest basic security patches due to the limitations of the communication environment and the absence of cyber security management, and vaccines are also not managed.

The latest digital (smart) ships and autonomous ships, whose network environment is being improved, are always connected to the land through fast satellite communication (VSAT). However, compared to the faster communication environment, cyber security is still at the same insufficient level as before. Some cyber security systems only support vaccine and firewall functions in the IT area.

A general ship cyber security management system has a basic network structure of a digital ship (smart ship) and an autonomous navigation system. A general ship cyber security management system sets up a logical network configuration using a hub switch. It has a structure in which cyber attacks generated in IT networks can easily propagate to autonomous navigation systems and OT networks. In the general ship cyber security management system, it is difficult to check whether the OT system is abnormal until a direct failure occurs.

In the conventional system, security is controlled only in the IT network area and intrusion from the outside, but management and control of the OT network are required in an advanced system such as an autonomous navigation system.

This embodiment integrates and monitors the IT (Information Technology) network and the OT (Operational Technology) network of the autonomous ship in order to manage the cyber security of the autonomous ship, and when a cyber attack occurs, both the IT network and the OT network are monitored. It aims to provide a cyber security management system for autonomous vessels that protects and simplifies onboard operations while complying with maritime security regulations to prevent cyber attacks from spreading.

According to one aspect of this embodiment, the data collection unit for generating collected data by collecting transmission and reception data for a plurality of networks in the autonomous vessel; a cyber attack identification unit that analyzes the collected data and checks whether a cyber attack or abnormal traffic to one or more networks among the plurality of networks is detected; and a cyber attack blocking unit blocking the cyber attack or the network in which the abnormal traffic is detected among the plurality of networks.

As described above, according to the present embodiment, in order to manage the cyber security of the autonomous ship, when a cyber attack occurs while integrating and monitoring the IT (Information Technology) network and the OT (Operational Technology) network of the autonomous ship It protects both IT and OT networks and has the effect of simplifying onboard operations while complying with maritime security regulations to prevent the spread of cyber attacks.

According to this embodiment, there is an effect of blocking the spread of cyberattacks between IT (Information Technology) and OT (Operational Technology) by monitoring and analyzing the OT (Operational Technology) network.

1 is a block diagram schematically illustrating an autonomous ship cyber security management system according to an embodiment.

2 is a block diagram schematically showing an apparatus for managing cyber security for an autonomous vessel according to the present embodiment.

3 is a diagram showing the functions of the cyber security management system according to the present embodiment.

4 is a diagram showing the configuration of a cyber security management system according to this embodiment.

5 is a diagram showing a risk evaluation matrix according to the present embodiment.

6a, 6b, and 6c are diagrams illustrating impact (importance) indexes according to the present embodiment.

7a and 7b are diagrams showing probability indexes according to this embodiment.

8 is a diagram showing a threat list according to the present embodiment.

9 is a diagram showing vulnerability scores according to this embodiment.

10 is a diagram illustrating an account extortion scenario among risk scenarios according to the present embodiment.

11 is a diagram illustrating a privilege abuse scenario among risk scenarios according to the present embodiment.

12 is a diagram illustrating information tampering/altering scenarios among risk scenarios according to the present embodiment.

13 is a diagram illustrating an information leakage scenario among risk scenarios according to the present embodiment.

14 is a diagram illustrating an unauthorized person access scenario among risk scenarios according to the present embodiment.

15 is a diagram illustrating an unauthorized USB use scenario among risk scenarios according to the present embodiment.

16 is a diagram illustrating an illegal SW installation scenario among risk scenarios according to the present embodiment.

17 is a diagram showing a DDOS scenario among risk scenarios according to the present embodiment.

18 is a diagram illustrating an unauthorized terminal scenario among risk scenarios according to the present embodiment.

19 is a diagram showing a malicious code scenario among risk scenarios according to the present embodiment.

20 is a diagram illustrating a malicious action scenario among risk scenarios according to the present embodiment.

21 is a diagram illustrating a personal information abuse scenario among risk scenarios according to the present embodiment.

22 is a diagram illustrating a denial of infringement scenario among risk scenarios according to the present embodiment.

23 is a diagram illustrating an operation mistake scenario among risk scenarios according to the present embodiment.

24 is a diagram illustrating a hardware failure scenario among risk scenarios according to the present embodiment.

25 is a diagram illustrating a power outage scenario among risk scenarios according to the present embodiment.

Hereinafter, this embodiment will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically illustrating an autonomous ship cyber security management system according to an embodiment.

The autonomous ship cyber security management system 100 according to this embodiment is mounted in a ship.

The autonomous ship cyber security management system 100 refers to a system for evaluating or managing cyber security according to regulations corresponding to autonomous ships. The autonomous ship cyber security management system 100 manages cyber security for the IT network 120 and the OT network 150 as well as the crew network 130 .

The autonomous vessel cyber security management system 100 generates a cyber security evaluation result that evaluates the cyber security risk for the router 108, the IT network 120, the OT network 150, and the crew network 130 . The autonomous ship cyber security management system 100 manages the security of the router 108, the IT network 120, the OT network 150, and the crew network 130 based on the cyber security evaluation result.

The autonomous ship cyber security management system 100 is applied to a special environment of a ship to provide a solution capable of performing satellite communication, responding to situations in which additional technical support is not received, and various adverse conditions.

The autonomous ship cyber security management system 100 predicts cyber attacks (threats) on autonomous ships in advance using AI by combining AI or cloud big data. The autonomous ship cyber security management system 100 analyzes cyber attacks (threats) on autonomous ships using cloud big data.

The autonomous vessel cyber security management system 100 provides risk scenarios that can be selected according to constraints, since there are many cases when evaluating risks for cyber security. For example, the autonomous ship cyber security management system 100 provides a scenario in a manner of confirming whether the cause is infiltration by an outsider or email by an insider based on a result of a malicious code destroying specific information.

The autonomous ship cyber security management system 100 provides a risk scenario when a cyber attack occurs on an autonomous ship, so that a captain or crew member operating the ship can select a risk scenario corresponding to the ship.

The autonomous ship cyber security management system 100 controls the navigation system by itself, and controls and monitors the ship remotely from land. The autonomous ship cyber security management system 100 is exposed to cyber threats because the land and the ship are constantly connected.

The autonomous ship cyber security management system 100 monitors and controls an IT network 120 , a crewman network 130 , and an OT network 150 . The autonomous vessel cyber security management system (100) blocks the propagation of cyber attacks between networks when individual cyber attacks occur in the IT network (120), the crew network (130), and the OT network (150), thereby preventing navigation accidents caused by cyber attacks. prevent.

The autonomous vessel cyber security management system 100 integrates and manages the vessel's internal IT network 120 and the OT network 150. The autonomous vessel cyber security management system 100 installs an agent program in the IT network 120 and installs a traffic detection sensor in the OT network 150 to collect and monitor all network traffic generated in the vessel.

The autonomous vessel cyber security management system according to this embodiment includes a cyber security management device 110, an IT network 120, a crew member network 130, an autonomous navigation device 140, and an OT network 150.

The cyber security management device 110 communicates with a Very Small Aperture Terminal (VSAT) that communicates with a satellite via a router. The cyber security management device 110 checks whether a cyber attack occurs during communication with the VSAT. The cyber security management device 110 communicates with a base station via a router via Long-Term Evolution (LTE) and 5G. The cyber security management device 110 checks whether a cyber attack occurs during communication with the base station.

The cyber security management device 110 communicates with a router via a firewall/Intrusion Preventing System (IPS). The cyber security management device 110 communicates with the IT network 120 via the L3 switch. The cyber security management device 110 checks whether a cyber attack occurs during communication with the IT network 120 .

The cyber security management device 110 communicates with the crew member network 130 via the L3 switch. The cyber security management device 110 checks whether a cyber attack occurs during communication with the flight attendant network 130 . The cyber security management device 110 communicates with the autonomous navigation device 140 via the L3 switch. The cyber security management device 110 checks whether a cyber attack occurs during communication with the autonomous navigation device 140 .

The cyber security management device 110 provides an integrated system for ship cyber security management for each of the router 108, the IT network 120, the OT network 150, and the crew network 130. The cyber security management device 110 performs integrated network monitoring on the router 108, the IT network 120, the OT network 150, and the crew network 130 to prevent mutual damage from spreading.

The IT network 120 refers to a network capable of transmitting and receiving data by being connected to a business PC and a business server provided inside the ship. The IT network 120 installs an endpoint agent to control and manage individual PCs. The crew network 130 refers to a network capable of transmitting and receiving data by being connected to a wireless AP and a crew terminal provided inside the ship.

An Operational Technology (OT) network 150 refers to a network capable of transmitting and receiving data by connecting a monitoring device, a navigation device, and a control device provided inside a ship. Since it is impossible to install an agent on the OT network 150, the cyber security management device 110 identifies abnormal traffic on the OT network 150 through machine learning.

The autonomous navigation device 140 uses the OT network 150 to interwork with a monitoring device, a navigation device, and a control device for autonomous navigation.

2 is a block diagram schematically showing an apparatus for managing cyber security for an autonomous vessel according to the present embodiment.

The cyber security management device 110 according to this embodiment includes a collection unit 210, a cyber attack confirmation unit 220, a risk evaluation unit 230, a cyber attack blocking unit 240, and a scenario providing unit 250. do. Components included in the cyber security management device 110 are not necessarily limited thereto.

Each component included in the cyber security management device 110 is connected to a communication path that connects software modules or hardware modules inside the device and can operate organically with each other. These components communicate using one or more communication buses or signal lines.

Each component of the cyber security management device 110 shown in FIG. 2 means a unit that processes at least one function or operation, and may be implemented as a software module, a hardware module, or a combination of software and hardware.

The data collection unit 210 collects transmission and reception data for a plurality of networks (router 108, IT network 120, OT network 150, and crew network 130) in the autonomous ship to generate collected data. .

The data collection unit 210 collects transmission/reception data collected from the router, the IT network 120 , the crew network 130 , and the OT network 150 to generate aggregated data. The data collecting unit 210 generates collected data by compressing the collected data and then applying an open stack for a maximum protocol range.

A plurality of networks are a VSAT (Very Small Aperture Terminal) that interworks with satellites, a router (108) that communicates with mobile communication base stations, and an IT network (120) that communicates with business PCs and business servers installed inside autonomous ships. , Wireless AP (Access Point) installed inside the autonomous ship, crew network 130 communicating with the crew terminal, monitoring device installed inside the autonomous ship, navigation device, interlocking with control device It includes an OT network 150 that

The cyber attack check unit 220 analyzes the collected data to detect a cyber attack or abnormality on one or more networks among a plurality of networks (router 108, IT network 120, OT network 150, crew network 130). Check whether traffic is detected or not.

The cyber attack checking unit 220 checks whether a cyber attack or abnormal traffic of the collected data on the IT network 120 is detected using an agent program installed on a work PC and a work server.

The cyber attack check unit 220 detects a cyber attack or abnormal traffic of collected data for the OT network 150 from a traffic detection sensor that detects traffic for a monitoring device, a navigation device, and a control device installed inside the autonomous ship. check whether the

The risk evaluation unit 230 evaluates the risk against cyber threats for each of a plurality of networks (router 108, IT network 120, OT network 150, crew network 130) Calculate risk evaluation results do.

The risk evaluation unit 230 evaluates each of the plurality of networks based on the transmission and reception data received from the plurality of networks (router 108, IT network 120, OT network 150, and crew network 130) to determine the risk level Create a Risk Assessment Matrix.

The risk evaluation unit 230 is included in the risk evaluation matrix based on the results of checking items set in a plurality of networks (router 108, IT network 120, OT network 150, crew network 130) Determine the Impact Index from 1 to 25.

The risk evaluation unit 230 determines that the impact index is low when the impact index is 1 to 7, determines it to be significant when the impact index is 8 to 14, and determines it to be significant when the impact index is 15 to 25. ) judged by

The risk evaluation unit 230 determines a probability index for a cyber attack as '1' when all five impact indices are determined to be low. The risk evaluation unit 230 determines a probability index for a cyber attack as '2' when three out of five impact indices are determined to be low and two are determined to be significant. . The risk evaluation unit 230 determines that 2 out of 5 impact indices are low, 2 are significant, and 1 is significant, the probability index for a cyber attack ( Probability Index) is set to '3'. The risk evaluation unit 230 determines that one of the five impact indices is low, two are significant, and two are determined to be significant, the probability index for a cyber attack ( Probability Index) is set to '4'. The risk evaluation unit 230 determines that one of the five impact indices is low, one is significant, and three are determined to be major, the probability index for a cyber attack ( Probability Index) is set to '5'.

The risk evaluation unit 230 classifies the impact index into a confidentiality index, an integrity index, and an availability index. The risk evaluation unit 230 is one of 5 Critical, 4 Significant, 3 Moderate, 2 Minor, and 1 Negligible for each of the confidentiality index, integrity index, and availability index. determined by the value of The risk evaluation unit 230 calculates a value obtained by adding the confidentiality index, the integrity index, and the availability index as an asset criticality value, and the asset criticality value (Confidentiality Index + Integrity Index + Availability Index) as an impact index Recognize.

The risk evaluation unit 230 sets the asset importance value to a preset standard (3 ≤ Index 1 ≤ 4, 5 ≤ Index 2 ≤ 6, 7 ≤ Index 3 ≤ 9, 10 ≤ Index 4 ≤ 12, 13 ≤ Index 5 ≤ 15) decide according to The risk evaluation unit 230 determines the impact index value as index 1 (Index 1) when 3 ≤ asset importance value ≤ 4. When 5 ≤ asset importance value ≤ 6, the risk evaluation unit 230 determines the impact index value as index 2 (Index 2). The risk evaluation unit 230 determines the impact index value as index 3 when 7 ≤ asset importance value ≤ 9. The risk evaluation unit 230 determines the impact index value as Index 4 when 10 ≤ asset importance value ≤ 12. The risk evaluation unit 230 determines the impact index value as Index 5 when 13 ≤ asset importance value ≤ 15.

The risk evaluation unit 230 divides the probability index into a threat index and a vulnerability index. The risk evaluation unit 230 determines the threat index as one of 5 Definite, 4 Probable, 3 Occasional, 2 Remote, and 1 Improbable. The risk assessment unit 230 determines the vulnerability index as one of 5 very high, 4 high, 3 medium, 2 low, and 1 very low. . The risk evaluation unit 230 calculates the product of the threat index and the vulnerability index as a cyber attack probability value, and recognizes the cyber attack probability value (Threat Index × Vulnerability Index) as the probability index.

The risk evaluation unit 230 sets the cyber attack probability value to a predetermined standard (1 ≤ Index 1 ≤ 5, 6 ≤ Index 2 ≤ 10, 11 ≤ Index 3 ≤ 15, 16 ≤ Index 4 ≤ 20, 21 ≤ Index 5 ≤ 25) decide according to When 1 ≤ cyber attack probability value ≤ 5, the risk evaluation unit 230 determines the probability index value as index 1 (Index 1). When 6 ≤ cyber attack probability value ≤ 10, the risk evaluation unit 230 determines the probability index value as index 2 (Index 2). When 11 ≤ cyber attack probability value ≤ 15, the risk evaluation unit 230 determines the probability index value as index 3 (Index 3). When 16 ≤ cyber attack probability value ≤ 20, the risk evaluation unit 230 determines the probability index value as index 4 (Index 4). When 21 ≤ cyber attack probability value ≤ 25, the risk evaluation unit 230 determines the probability index value as Index 5.

When the risk evaluation unit 230 determines that the threat factor is 'account hijacking', the code is assigned T101 and the threat index (TI) is determined to be '5'. When the risk evaluation unit 230 determines that the threat factor is 'abuse of authority', the code is assigned T102 and the threat index (TI) is determined to be '4'. When the risk assessment unit 230 determines that the threat factor is 'unauthorized access', the code is assigned T103 and the threat index (TI) is determined to be '4'. When the risk assessment unit 230 determines that the threat factor is 'unauthorized USB use', the code is assigned T201 and the threat index (TI) is determined to be '4'. When the risk evaluation unit 230 determines that the threat factor is 'unauthorized terminal', the code is assigned T202 and the threat index (TI) is determined to be '4'. When the risk assessment unit 230 determines that the threat factor is 'illegal SW installation', the code is assigned T203 and the threat index (TI) is determined to be '4'. When the risk evaluation unit 230 determines that the threat factor is 'operation mistake', the code is assigned T204 and the threat index (TI) is determined to be '2'. When the risk evaluation unit 230 determines that the threat factor is 'DDOS', the code is assigned T301 and the threat index (TI) is determined to be '5'. When the risk evaluation unit 230 determines that the threat factor is 'malicious code', the code is assigned T302 and the threat index (TI) is determined to be '5'. When the risk evaluation unit 230 determines that the threat factor is 'abuse of personal information', the code is assigned T401 and the threat index (TI) is determined to be '4'. When the risk evaluation unit 230 determines that the threat factor is 'falsification/change of information', the code is assigned T402 and the threat index (TI) is determined to be '5'. When the risk evaluation unit 230 determines that the threat factor is 'information leakage', the code is assigned T403 and the threat index (TI) is determined to be '4'. When the risk evaluation unit 230 determines that the threat factor is 'denial of infringement', the code is assigned T404 and the threat index (TI) is determined to be '4'. When the risk evaluation unit 230 determines that the threat factor is 'hardware defect', the code is assigned T501 and the threat index (TI) is determined to be '3'. When the risk evaluation unit 230 determines that the threat factor is 'power outage', the code is assigned T51 and the threat index (TI) is determined to be '3'.

The risk assessment unit 230 detects a threat when important information (network/cargo/financial information) is leaked by a hacker among the router 108, the IT network 120, the OT network 150, and the crew network 130. 'Account hijacking', 'abuse of authority', 'information leak', 'illegal software installation', 'DDOS', 'malicious code', 'abuse of personal information', 'denial of infringement', 'operation mistake', 'hardware' It is recognized as one or more of 'defect' and 'power outage'. The scenario provision unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'information leakage', 'illegal SW installation', 'DDOS', 'malicious code', 'abuse of personal information', 'denial of infringement'). , 'operation mistake', 'hardware defect', 'power outage').

The risk assessment unit 230 classifies the threat factor as 'authority abuse' when exposure to an intrusion occurs through a port of a vulnerable service among the router 108, the IT network 120, the OT network 150, and the crew network 130. ', 'information leakage', 'illegal SW installation', 'unauthorized terminal', 'malicious code', 'infringement denial', 'operation mistake', 'hardware defect', 'power outage'. The scenario providing unit 250 is responsible for threat factors ('authority abuse', 'information leakage', 'illegal SW installation', 'unauthorized terminal', 'malicious code', 'infringement denial', 'operation mistake', 'hardware defect'). , one or more of 'power outages') to provide response scenarios.

The risk assessment unit 230 identifies threat factors in the event of unauthorized tampering (manipulation) of the router 108, the IT network 120, the OT network 150, and the crew network 130. 'Account hijacking', 'abuse of authority', 'falsification/altering of information', 'access by unauthorized person', 'installation of illegal software', 'DDOS', 'malicious act', 'denial of infringement', 'operation mistake', It is recognized as one or more of 'hardware defect' and 'power outage'. The scenario providing unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'falsification/change of information', 'access by unauthorized persons', 'illegal SW installation', 'DDOS', 'malicious behavior', It provides response scenarios according to 'denial of infringement', 'operating mistake', 'hardware defect', 'outage').

The risk evaluation unit 230 classifies the threat factors as 'authority abuse' and 'information' when exposure to a zero-day attack occurs among the router 108, the IT network 120, the OT network 150, and the crew network 130. Leakage', 'illegal software installation', 'operation mistake', 'hardware defect', 'power outage'. The scenario providing unit 250 provides response scenarios according to threat factors (one or more of 'authority abuse', 'information leakage', 'illegal SW installation', 'operation mistake', 'hardware defect', and 'power outage') .

The risk evaluation unit 230 determines the threat factor as 'authority abuse' when a system failure occurs due to the execution of a patch whose stability has not been verified among the router 108, the IT network 120, the OT network 150, and the crew network 130. ', 'illegal SW installation', 'operation mistake', 'hardware defect', 'power failure'. The scenario providing unit 250 provides response scenarios according to threat factors (at least one of 'authority abuse', 'illegal SW installation', 'operation mistake', 'hardware defect', and 'power outage').

The risk evaluation unit 230 determines the threat factor as 'unauthorized access' when infection and propagation of malicious code/ransomware occurs among the router 108, the IT network 120, the OT network 150, and the crew network 130. ', 'use of unauthorized USB', 'installation of illegal SW', 'DDOS', 'malicious code', 'denial of infringement', 'operating mistake', 'hardware defect', 'power outage'. The scenario provision unit 250 provides threat factors ('access by unauthorized person', 'use of unauthorized USB', 'installation of illegal SW', 'DDOS', 'malicious code', 'denial of infringement', 'operation mistake', 'hardware defect'). ', 'outage') to provide response scenarios.

The risk evaluation unit 230 determines the threat factor as 'account hijacking' when infection and propagation of malicious code/ransomware occurs among the router 108, the IT network 120, the OT network 150, and the crew network 130. , 'abuse of authority', 'information leakage', 'access by unauthorized person', 'use of unauthorized USB', 'unauthorized terminal', 'malicious code', 'malicious behavior', 'abuse of personal information', 'operation mistake', It is recognized as one or more of 'hardware defect' and 'power outage'. The scenario providing unit 250 provides threat factors ('account hijacking', 'authority abuse', 'information leakage', 'unauthorized person access', 'unauthorized USB use', 'unauthorized terminal', 'malicious code', 'malicious Action', 'misuse of personal information', 'operation mistake', 'hardware defect', 'power outage').

The risk evaluation unit 230 accesses a system among the router 108, the IT network 120, the OT network 150, and the crew network 130 and changes important information to determine the threat factor when work (flight) delay occurs. 'account hijacking', 'abuse of authority', 'tampering/altering of information', 'access by unauthorized person', 'DDOS', 'unauthorized terminal', 'malicious code', 'malicious act', 'abuse of personal information' , 'denial of infringement', 'operation mistake', 'hardware defect', 'outage'. The scenario provision unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'falsification/altering of information', 'access by an unauthorized person', 'DDOS', 'unauthorized terminal', 'malicious code', 'malicious code'). Provides response scenarios according to one or more of 'personal information misuse', 'infringement denial', 'operation mistake', 'hardware defect', and 'power outage').

The risk assessment unit 230 determines the threat factor as 'illegal SW installation', when a work delay occurs due to system overload among the router 108, the IT network 120, the OT network 150, and the crew network 130. Recognizes one or more of 'DDOS', 'unauthorized terminal', 'malicious code', 'operation error', 'hardware defect', and 'power outage'. The scenario providing unit 250 responds according to threat factors (one or more of 'illegal SW installation', 'DDOS', 'unauthorized terminal', 'malicious code', 'operation mistake', 'hardware defect', and 'power outage') provide a scenario.

The risk evaluation unit classifies the threat factors as 'account takeover' and 'abuse of authority' in the case of system interruption due to unauthorized person's random manipulation among the router (108), IT network (120), OT network (150), and crew network (130). ', 'tampering/altering of information', 'access by unauthorized person', 'DDOS', 'unauthorized terminal', 'malicious code', 'malicious act', 'denial of infringement', 'operation mistake', 'hardware defect' , recognized as one or more of 'blackouts'. The scenario provision unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'falsification/altering of information', 'access by an unauthorized person', 'DDOS', 'unauthorized terminal', 'malicious code', 'malicious code'). response scenarios) are provided.

The risk assessment unit 230 is a threat when an unauthorized person among the router 108, the IT network 120, the OT network 150, and the crew network 130 randomly tries to log in and steals an account to falsify or destroy important information. 'Account hijacking', 'falsification/altering of information', 'access by unauthorized person', 'unauthorized terminal', 'malicious code', 'malicious behavior', 'abuse of personal information', 'denial of infringement', 'operation It is recognized as one or more of 'mistake', 'hardware defect', and 'power outage'. The scenario provision unit 250 provides threat factors ('account hijacking', 'falsification/change of information', 'access by unauthorized persons', 'unauthorized terminal', 'malicious code', 'malicious behavior', 'abuse of personal information'). , 'denial of infringement', 'operation mistake', 'hardware defect', 'outage').

The risk evaluation unit identifies the threat factor as an 'account' in the case of intentional business (flight) delay by accessing and changing unauthorized information among the router (108), IT network (120), OT network (150), and crew network (130). Stealing', 'abuse of authority', 'falsification/altering of information', 'access by unauthorized person', 'use of unauthorized USB', 'installation of illegal SW', 'unauthorized terminal', 'malicious code', 'malicious behavior', Recognize it as one or more of 'abuse of personal information', 'denial of infringement', 'operation mistake', 'hardware defect', and 'power outage'. The scenario providing unit 250 provides threat factors ('account hijacking', 'abuse of authority', 'falsification/change of information', 'access by unauthorized persons', 'use of unauthorized USB', 'installation of illegal SW', 'unauthorized terminal'). , 'malicious code', 'malicious behavior', 'abuse of personal information', 'denial of infringement', 'operation mistake', 'hardware defect', 'power outage').

The risk assessment unit 230 accesses important information and arbitrarily manipulates the OT network 150 by connecting to the internal network with an unauthorized terminal among the router 108, the IT network 120, the OT network 150, and the crew network 130 If this occurs, the threat factors are 'abuse of authority', 'access by unauthorized person', 'use of unauthorized USB', 'installation of illegal SW', 'unauthorized terminal', 'malicious code', 'malicious act', 'denial of infringement' ', 'Operation mistake', 'Hardware defect', or 'Power outage'. The scenario provision unit 250 provides threat factors ('abuse of authority', 'access by unauthorized persons', 'use of unauthorized USB', 'installation of illegal SW', 'unauthorized terminal', 'malicious code', 'malicious behavior', ' denial of infringement', 'operating mistake', 'hardware defect', 'outage').

The risk evaluation unit 230 determines the threat factor as an 'account' when malicious code propagation occurs by connecting to an internal network with an unauthorized terminal among the router 108, the IT network 120, the OT network 150, and the crew network 130. Stealing', 'Abuse of authority', 'Access by unauthorized person', 'Use of unauthorized USB', 'Installation of illegal SW', 'Unauthorized terminal', 'Malicious act', 'Denial of infringement', 'Operation mistake', 'Hardware defect' ', 'power outage'. The scenario providing unit 250 provides threat factors ('account hijacking', 'authority abuse', 'unauthorized access', 'unauthorized USB use', 'illegal SW installation', 'unauthorized terminal', 'malicious behavior', ' denial of infringement', 'operating mistake', 'hardware defect', 'outage').

The risk assessment unit 230 determines the threat factor as 'information' when a vulnerability to a cyberattack occurs due to a missing security patch among the router 108, the IT network 120, the OT network 150, and the crew network 130. 'modification/change', 'illegal SW installation', 'operation mistake', 'hardware defect', and 'power outage'. The scenario providing unit 250 provides response scenarios according to threat factors (one or more of 'falsification/change of information', 'illegal SW installation', 'operation mistake', 'hardware defect', and 'power outage').

The risk evaluation unit 230 is a threat factor in the case of stealing important information and malicious behavior by accessing administrator/user privileges among the router 108, the IT network 120, the OT network 150, and the crew network 130. 'account hijacking', 'abuse of authority', 'tampering/altering of information', 'information leakage', 'access by unauthorized person', 'illegal SW installation', 'DDOS', 'unauthorized terminal', 'malicious code', Recognize one or more of 'malicious acts', 'abuse of personal information', 'denial of infringement', 'operation mistakes', 'hardware defects', and 'power outages'. The scenario providing unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'falsification/change of information', 'information leakage', 'access by unauthorized persons', 'illegal SW installation', 'DDOS', ' Provides response scenarios according to one or more of 'unauthorized terminal', 'malicious code', 'malicious behavior', 'abuse of personal information', 'denial of infringement', 'operation mistake', 'hardware defect', and 'power outage' .

The risk evaluation unit 230 determines the threat factor as 'illegal SW installation', in the case of a business delay caused by excessive traffic generation among the router 108, the IT network 120, the OT network 150, and the crew network 130. Recognizes one or more of 'DDOS', 'malicious code', 'operation error', 'hardware defect', and 'power outage'. The scenario providing unit 250 provides response scenarios according to threat factors (one or more of 'illegal SW installation', 'DDOS', 'malicious code', 'operation mistake', 'hardware defect', and 'power outage').

The risk assessment unit 230 determines whether an account theft occurs when a hacker infiltrates because the password (PW) is not encrypted and stored among the router 108, the IT network 120, the OT network 150, and the crew network 130. Threat factors include 'tampering/altering of information', 'information leakage', 'access by unauthorized person', 'installation of illegal software', 'DDOS', 'unauthorized terminal', 'malicious code', 'denial of infringement', and 'operation mistake'. ', 'hardware defect', 'power outage'. The scenario provision unit 250 is responsible for threat factors ('information alteration/modification', 'information leakage', 'unauthorized access', 'illegal SW installation', 'DDOS', 'unauthorized terminal', 'malicious code', ' denial of infringement', 'operating mistake', 'hardware defect', 'outage').

The risk evaluation unit 230 is a router 108, IT network 120, OT network 150, crew network 130 of the OT network arbitrarily manipulated / important information falsification, when a flight accident occurs, the threat factor 'Account hijacking', 'abuse of authority', 'tampering/altering of information', 'access by unauthorized person', 'installation of illegal SW', 'DDOS', 'unauthorized terminal', 'malicious code', 'malicious behavior', It is recognized as one or more of 'denial of infringement', 'operation mistake', 'hardware defect', and 'power outage'. The scenario providing unit 250 is responsible for threat factors ('account takeover', 'abuse of authority', 'falsification/change of information', 'access by unauthorized person', 'illegal SW installation', 'DDOS', 'unauthorized terminal', ' Malicious code', 'malicious behavior', 'denial of infringement', 'operation mistake', 'hardware defect', 'power outage').

The risk assessment unit 230 determines the threat factor as 'unauthorized access' when a system is interrupted by removing/changing a LAN port among the router 108, the IT network 120, the OT network 150, and the crew network 130. ', 'unauthorized terminal', 'malicious behavior', 'operation error', 'hardware defect', and 'power outage'. The scenario provider 250 provides response scenarios according to threat factors (one or more of 'access by an unauthorized person', 'unauthorized terminal', 'malicious behavior', 'operation mistake', 'hardware defect', and 'power outage'). do.

The cyber attack blocking unit 240 blocks a network in which a cyber attack or abnormal traffic is detected among a plurality of networks (router 108, IT network 120, OT network 150, and crew network 130). The cyber attack blocker 240 detects cyber attacks or abnormalities among a plurality of networks (router 108, IT network 120, OT network 150, crew network 130) based on the index included in the risk evaluation matrix. Block networks where traffic has been detected.

The scenario providing unit 250 extracts and provides a (risk level) scenario corresponding to the risk evaluation result.

3 is a diagram showing the functions of the cyber security management system according to the present embodiment.

The autonomous vessel cyber security management system 100 provides a visibility function, a security function, and a security compliance function.

The autonomous vessel cyber security management system 100 searches and maintains an asset inventory with a visibility function. The autonomous vessel cyber security management system 100 calculates cyber risks for the IT network 120 , the OT network 150 , and the crew network 130 as a visibility function. The autonomous vessel cyber security management system 100 determines when a crew member behaves unsafely based on a degree of cyber risk.

The autonomous ship cyber security management system 100 provides a countermeasure method and an emergency situation when a cyber attack occurs as a security function. The autonomous vessel cybersecurity management system 100 allows access to security operations expertise when needed as a security function. The autonomous vessel cyber security management system 100 can be applied by extending a corporate cyber monitoring function to a vehicle as a security function.

The autonomous ship cyber security management system 100 identifies the cyber policy violation time with a security compliance function. The autonomous ship cyber security management system 100 can prove the ship cyber security management status to an inspector.

4 is a diagram showing the configuration of a cyber security management system according to this embodiment.

The autonomous ship cyber security management system 100 includes a visualization unit, a user input unit, an analysis and control unit, a data collection unit, an agent, an app server, a database, and an OT sensing unit.

The data collection unit collects local data. The data collection unit collects IT network data from agents installed in the IT network 120 . The data collection unit collects crew member network data from the crew member network 130 .

The data collection unit collects OT network data from OT network monitoring sensors installed in the OT network 150 . The data collection unit generates aggregated data by collecting IT network data, OT network data, and crew network data. The data collection unit compresses the aggregated data to optimize bandwidth usage. The data collection unit applies an open stack for maximum protocol coverage to the collection data.

When a cyberattack or abnormal traffic is detected, the analysis and control unit transmits the corresponding hacking information to the visualization unit and outputs it.

The analytics and control unit performs centralized analytics to detect machine learning for cyber and compliance risks. The analysis and control unit may analyze the collected data using the cloud. The analysis and control unit detects a cyber attack or abnormal traffic to any one of the router 108, the IT network 120, the OT network 150, and the crew network 130 based on the collected data, preventing the spread to block the network.

The visualization unit performs security information and event management. The visualization unit includes a fleet management dashboard. The visualization unit generates risk-based scores and report information. The visualization unit creates and outputs an asset list and configuration diagram.

5 is a diagram showing a risk evaluation matrix according to the present embodiment.

The autonomous vessel cyber security management system 100 evaluates each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to generate a risk assessment matrix.

The autonomous ship cyber security management system 100 determines an impact of 1 to 25.

The autonomous vessel cyber security management system 100 determines that the impact is low when the impact is 1 to 7, determines it to be significant when the impact is 8 to 14, and determines it to be significant when the impact is 15 to 25 ( Major).

The autonomous vessel cyber security management system 100 determines a probability index for cyber attack as '1' when all five impacts are determined to be low.

The autonomous ship cyber security management system 100 sets the probability index for cyber attacks to '2' when three of the five impacts are determined to be low and two are determined to be significant. to decide

In the autonomous ship cyber security management system 100, when two of the five impacts are determined to be low, two are determined to be significant, and one is determined to be major, Determine the probability index as '3'.

In the autonomous ship cyber security management system 100, when one of the five impacts is determined to be low, two are determined to be significant, and two are determined to be significant, the cyber attack Determine the probability index as '4'.

In the autonomous ship cyber security management system 100, when one of the five impacts is determined to be low, one is determined to be significant, and three are determined to be major, the cyber attack Determine the probability index as '5'.

6a, 6b, and 6c are diagrams illustrating impact (importance) indexes according to the present embodiment.

The autonomous ship cyber security management system 100 divides the impact (criticality) index into a confidentiality index, an integrity index, and an availability index.

The autonomous ship cyber security management system 100 has 5 Critical, 4 Significant, 3 Moderate, 2 Minor, and 1 negligible for each of the confidentiality index, integrity index, and availability index ( Negligible) is determined by one of the values.

The autonomous vessel cyber security management system 100 calculates a value obtained by adding the confidentiality index, the integrity index, and the availability index as an asset criticality value, and the asset criticality value (Confidentiality Index + Integrity Index + Availability Index) It is recognized as an impact index.

The autonomous ship cyber security management system 100 sets the asset importance value to a preset standard (3 ≤ Index 1 ≤ 4, 5 ≤ Index 2 ≤ 6, 7 ≤ Index 3 ≤ 9, 10 ≤ Index 4 ≤ 12, 13 ≤ Index 5 ≤ 15).

When 3 ≤ asset importance value ≤ 4, the autonomous vessel cyber security management system 100 determines the corresponding asset importance value as index 1 (Index 1). When 5 ≤ asset importance value ≤ 6, the autonomous vessel cyber security management system 100 determines the corresponding asset importance value as index 2 (Index 2). When 7 ≤ asset importance value ≤ 9, the autonomous vessel cyber security management system 100 determines the corresponding asset importance value as Index 3.

When 10 ≤ asset importance value ≤ 12, the autonomous ship cyber security management system 100 determines the corresponding asset importance value as Index 4. When 13 ≤ asset importance value ≤ 15, the autonomous ship cyber security management system 100 determines the corresponding asset importance value as Index 5.

7a and 7b are diagrams showing probability indexes according to this embodiment.

The autonomous ship cyber security management system 100 divides a probability index into a threat index and a vulnerability index.

The autonomous ship cyber security management system 100 determines the threat index as one of 5 Definite, 4 Probable, 3 Occasional, 2 Remote, and 1 Improbable. .

The autonomous ship cyber security management system 100 sets the vulnerability index to one of 5 Very high, 4 High, 3 Medium, 2 Low, and 1 Very Low. determined by the value

The autonomous ship cyber security management system 100 calculates the product of the threat index and the vulnerability index as a cyber attack probability value, and recognizes the cyber attack probability value (Threat Index × Vulnerability Index) as the probability index.

The autonomous vessel cyber security management system 100 determines the cyber attack probability value based on a preset standard (1 ≤ Index 1 ≤ 5, 6 ≤ Index 2 ≤ 10, 11 ≤ Index 3 ≤ 15, 16 ≤ Index 4 ≤ 20, 21 ≤ Index 5 ≤ 25).

When 1 ≤ cyber attack probability value ≤ 5, the autonomous ship cyber security management system 100 determines the asset importance value as index 1 (Index 1). When 6 ≤ cyber attack probability value ≤ 10, the autonomous ship cyber security management system 100 determines the asset importance value as Index 2 (Index 2).

When 11 ≤ cyber attack probability value ≤ 15, the autonomous vessel cyber security management system 100 determines the asset importance value as Index 3. When 16 ≤ cyber attack probability value ≤ 20, the autonomous vessel cyber security management system 100 determines the asset importance value as Index 4. When 21 ≤ cyber attack probability value ≤ 25, the autonomous vessel cyber security management system 100 determines the corresponding asset importance value as Index 5.

8 is a diagram showing a threat list according to the present embodiment.

The autonomous ship cyber security management system 100 identifies an attacker in a threat list as an outsider (remote), an outsider (radio), an insider (remote), and an insider (crew). The autonomous ship cyber security management system 100 verifies the intent intentionally or unintentionally.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'account hijacking', the code is assigned T101 and the threat index (TI: Threat Index) is determined to be '5'. When the autonomous ship cyber security management system 100 determines that the threat factor is 'abuse of authority', the code is assigned T102 and the threat index (TI: Threat Index) is determined to be '4'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'unauthorized access', the code is assigned T103 and the threat index (TI: Threat Index) is determined to be '4'. When the autonomous vessel cyber security management system 100 determines that the threat factor is 'unauthorized USB use', the code is assigned T201 and the threat index (TI: Threat Index) is determined to be '4'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'unauthorized terminal', the code is assigned T202 and the threat index (TI: Threat Index) is determined to be '4'. When the autonomous ship cyber security management system 100 determines that the threat factor is 'illegal SW installation', the code is assigned T203 and the threat index (TI: Threat Index) is determined to be '4'.

When the autonomous vessel cyber security management system 100 determines that the threat factor is 'operation mistake', the code is assigned T204 and the threat index (TI: Threat Index) is determined to be '2'. When the autonomous ship cyber security management system 100 determines that the threat factor is 'DDOS', the code is assigned T301 and the threat index (TI: Threat Index) is determined to be '5'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'malicious code', the code is assigned T302 and the threat index (TI: Threat Index) is determined to be '5'. When the autonomous vessel cyber security management system 100 determines that the threat factor is 'abuse of personal information', the code is assigned T401 and the threat index (TI: Threat Index) is determined to be '4'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'falsification/change of information', the code is assigned T402 and the threat index (TI: Threat Index) is determined to be '5'. When the autonomous ship cyber security management system 100 determines that the threat factor is 'information leakage', the code is assigned T403 and the threat index (TI: Threat Index) is determined to be '4'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'denial of infringement', the code is assigned T404 and the threat index (TI: Threat Index) is determined to be '4'. When the autonomous vessel cyber security management system 100 determines that the threat factor is 'hardware defect', the code is assigned T501 and the threat index (TI: Threat Index) is determined to be '3'.

When the autonomous ship cyber security management system 100 determines that the threat factor is 'power outage', the code is assigned T51 and the threat index (TI: Threat Index) is determined to be '3'.

9 is a diagram showing vulnerability scores according to this embodiment.

The autonomous ship cyber security management system 100 evaluates each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to extract a plurality of vulnerabilities. The autonomous ship cyber security management system 100 calculates scores according to a plurality of vulnerabilities.

When the autonomous ship cyber security management system 100 determines that 'account management' is required as a vulnerability, the vulnerability score is calculated as '5'. When the autonomous ship cyber security management system 100 determines that 'network management' is necessary as a vulnerability, the vulnerability score is calculated as '5'.

When the autonomous ship cyber security management system 100 determines that 'security management' is required as a vulnerability, the vulnerability score is calculated as '4'. When the autonomous ship cyber security management system 100 determines that 'service management' is necessary as a vulnerability, the vulnerability score is calculated as '4'. When the autonomous ship cyber security management system 100 determines that 'asset management' is required as a vulnerability, the vulnerability score is calculated as '3'.

When the autonomous vessel cyber security management system 100 determines that 'log management' is necessary as a vulnerability, the vulnerability score is calculated as '3'. When the autonomous ship cyber security management system 100 determines that 'patch management' is required as a vulnerability, the vulnerability score is calculated as '4'. When the autonomous ship cyber security management system 100 determines that 'setting management' is required as a vulnerability, the vulnerability score is calculated as '3'.

When the autonomous ship cyber security management system 100 determines that 'access management' is required as a vulnerability, the vulnerability score is calculated as '4'. When the autonomous ship cyber security management system 100 determines that 'file management' is necessary as a vulnerability, it calculates the vulnerability score as '3'. When the autonomous ship cyber security management system 100 determines that 'policy management' is necessary as a vulnerability, the vulnerability score is calculated as '4'.

10 is a diagram illustrating an account extortion scenario among risk scenarios according to the present embodiment.

Autonomous vessel cyber security management system 100 describes a method for providing scenarios corresponding to account theft by evaluating each of router 108, IT network 120, OT network 150, and crew network 130 .

The autonomous ship cyber security management system 100 recognizes the threat factor as 'account hijacking' and provides a response scenario when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'account hijacking' when business (operation) delays occur due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'account hijacking' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The cyber security management system 100 for autonomous ships recognizes the threat factor as 'account hijacking' and provides a response scenario in the event of intentional delay in business (operation) by accessing and changing unauthorized information.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'account hijacking' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'account hijacking' and provides a response scenario when a malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'account takeover' in the event of unauthorized tampering (manipulation) of important systems, business delays/operation interruptions.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'account hijacking' when important information (network/cargo/financial information) is leaked by a hacker.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'account hijacking' and provides a response scenario when system shutdown occurs due to unauthorized person's arbitrary manipulation.

When a navigation accident occurs due to arbitrary manipulation of the OT network 150 / alteration of important information, the autonomous ship cyber security management system 100 recognizes the threat factor as 'account hijacking' and provides a response scenario.

11 is a diagram illustrating a privilege abuse scenario among risk scenarios according to the present embodiment.

An autonomous ship cyber security management system (100) describes a method for evaluating each of a router (108), an IT network (120), an OT network (150), and a crewman network (130) to provide a scenario to respond to abuse of authority. .

The autonomous ship cyber security management system 100 recognizes that 'abuse of authority' has occurred by recognizing the threat factor as 'internal information leakage' when important information is leaked to the outside (competitor/institution) after accessing the system. do.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'internal information tampering' and recognizes it as 'authority abuse' and provides response scenarios when business (operation) delays occur due to access to the system and change of important information. do.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'destruction of internal information' and recognizes it as 'abuse of authority' to provide response scenarios in the case of stealing important information and malicious behavior by accessing administrator/user rights do.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'disclosure of navigation information' and recognizes it as 'abuse of authority' to provide response scenarios in case of intentional delay in business (flight) due to access to and change of unauthorized information. do.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'falsification of flight information' and recognizes it as 'abuse of authority' when malicious code propagation occurs by connecting to the internal network with an unauthorized terminal, and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'destruction of navigation information' and recognizes it as 'abuse of authority' to provide response scenarios in the event of unauthorized modification (manipulation) of important systems, delays/operation interruptions, etc. .

The autonomous ship cyber security management system (100) recognizes 'delay/accident' as a threat factor when accessing important information and arbitrary manipulation of the OT network (150) by connecting to the internal network with an unauthorized terminal ' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes 'environmental pollution' as an 'environmental pollution' when important information (network/cargo/financial information) is leaked by a hacker, recognizes the threat factor as 'authority abuse', and provides a response scenario. do.

The autonomous ship cyber security management system 100 recognizes a 'life accident' when a system shutdown occurs due to arbitrary manipulation by an unauthorized person, recognizes the threat factor as 'authority abuse', and provides a response scenario.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'authority abuse' and provides a response scenario when a navigation accident occurs due to arbitrary manipulation/modulation of important information of the OT network 150.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'authority abuse' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'authority abuse' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous ship cyber security management system 100 recognizes the threat factor as 'authority abuse' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'authority abuse' and provides a response scenario when a system failure occurs due to the execution of a patch whose stability has not been verified.

12 is a diagram illustrating information tampering/altering scenarios among risk scenarios according to the present embodiment.

How the autonomous ship cyber security management system 100 evaluates each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to provide a scenario corresponding to an information tampering/altering scenario explain

The autonomous vessel cyber security management system 100 accesses the system and changes important information to cause business (operation) delays by accessing the system, recognizing it as 'internal information leakage' and changing the threat factor to 'information falsification/alteration'. Recognize and provide countermeasure scenarios.

Autonomous ship cyber security management system 100 recognizes 'internal information tampering' and recognizes the threat as 'information tampering/altering' in the event of stealing important information and malicious behavior by accessing administrator/user privileges, and responding to scenarios provides

The cyber security management system 100 for autonomous vessels responds by recognizing the threat as 'information tampering/altering' by recognizing it as 'internal information destruction' in case of intentional delay in business (operation) due to access to and modification of unauthorized information. provide a scenario.

The autonomous ship cyber security management system (100) recognizes as 'disclosure of navigation information' and responds by recognizing the threat factor as 'information tampering/altering' when an unauthorized person attempts to log in at random and steals an account and falsification or destruction of important information occurs. provide a scenario.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'falsification/altering of information' when an account is stolen when a hacker infiltrates because the password (PW) is not encrypted and stored. Provide response scenarios.

The autonomous ship cyber security management system 100 recognizes 'destruction of navigation information' in the case of unauthorized modification (manipulation) of important systems, and 'destruction of operational information' in case of unauthorized modification (manipulation) of important systems, and recognizes the threat factor as 'information alteration/alteration' to develop a response scenario. to provide.

The autonomous ship cyber security management system 100 recognizes 'delay/accident' as a 'delay/accident' and recognizes the threat factor as 'information falsification/alteration' in the event of a system shutdown due to arbitrary manipulation by an unauthorized person, and provides a response scenario.

When a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150, the autonomous vessel cyber security management system 100 recognizes it as 'environmental pollution' and recognizes the threat as 'information alteration/alteration' Provide response scenarios.

The autonomous vessel cyber security management system 100 recognizes a threat factor as 'information tampering/altering' in case of delay in business (operation) due to access to the system and changes in important information, and responds to scenarios. to provide.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'information falsification/change' when vulnerability to cyber attacks occurs due to missing security patches.

13 is a diagram illustrating an information leakage scenario among risk scenarios according to the present embodiment.

Autonomous vessel cyber security management system 100 describes a method for providing a scenario corresponding to an information leakage scenario by evaluating each of the router 108, the IT network 120, the OT network 150, and the crew network 130 do.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'information leakage' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'information leakage' when important information stealing or malicious behavior occurs by accessing administrator/user rights.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'information leakage' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as 'information leak' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'information leakage' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous ship cyber security management system 100 recognizes the threat factor as 'information leakage' and provides a response scenario.

14 is a diagram illustrating an unauthorized person access scenario among risk scenarios according to the present embodiment.

The autonomous ship cyber security management system 100 evaluates each router 108, IT network 120, OT network 150, and crew network 130 to provide a scenario corresponding to an unauthorized access scenario. Explain.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' when business (operation) delays occur due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized person access' when intentional business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario when malicious code propagation occurs by connecting to the internal network with an unauthorized terminal.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' in case of unauthorized modification (manipulation) of important systems, delay / operation interruption.

Autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario when access to important information and arbitrary manipulation of the OT network 150 occurs by connecting to the internal network with an unauthorized terminal do.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario when system interruption occurs due to removal/change of the LAN port.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'access by an unauthorized person' when system shutdown occurs due to arbitrary manipulation by an unauthorized person.

When a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150, the autonomous vessel cyber security management system 100 recognizes the threat factor as 'unauthorized access' and provides a response scenario.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized access' when business (operation) delays occur due to access to the system and change of important information.

15 is a diagram illustrating an unauthorized USB use scenario among risk scenarios according to the present embodiment.

The autonomous ship cyber security management system 100 evaluates each router 108, IT network 120, OT network 150, and crew network 130 to provide a scenario corresponding to an unauthorized USB usage scenario. Explain.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized USB use' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized USB use' when intentional business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized USB use' when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'unauthorized USB use' when a malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'unauthorized USB use' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal do.

16 is a diagram illustrating an illegal SW installation scenario among risk scenarios according to the present embodiment.

The autonomous ship cyber security management system 100 evaluates each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to provide a scenario corresponding to an illegal SW installation scenario. Explain.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'illegal SW installation' when important information stealing or malicious behavior occurs by accessing administrator/user rights.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when a deliberate business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when a malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario in the case of unauthorized modification (manipulation) of important systems, delay / operation interruption.

Autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides response scenarios when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal do.

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario.

When business delay occurs due to excessive traffic, the autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario.

When a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150, the autonomous vessel cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'illegal SW installation' when a business delay occurs due to system overload.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous vessel cyber security management system 100 recognizes the threat factor as 'illegal software installation' and provides a response scenario.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when a system failure occurs due to the execution of a patch whose stability has not been verified.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'illegal SW installation' and provides a response scenario when vulnerability to cyber attacks occurs due to missing security patches.

17 is a diagram showing a DDOS scenario among risk scenarios according to the present embodiment.

Autonomous ship cyber security management system 100 describes a method of providing a scenario corresponding to a DDOS scenario by evaluating each of a router 108, an IT network 120, an OT network 150, and a crewman network 130 .

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'DDOS' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario in case of unauthorized modification (manipulation) of important systems, delay / operation interruption.

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when system shutdown occurs due to unauthorized manipulation.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when business delay occurs due to excessive traffic.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'DDOS' and provides a response scenario when a business delay occurs due to system overload.

18 is a diagram illustrating an unauthorized terminal scenario among risk scenarios according to the present embodiment.

Autonomous ship cyber security management system 100 describes a method of providing a scenario corresponding to an unauthorized terminal scenario by evaluating each of a router 108, an IT network 120, an OT network 150, and a crew member network 130 do.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'unauthorized terminal' and provides a response scenario when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when important information stealing or malicious behavior occurs by accessing administrator/user rights.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when a deliberate business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'unauthorized terminal' and provides a response scenario when an account theft occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'unauthorized terminal' and provides a response scenario when malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'unauthorized terminal' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal .

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'unauthorized terminal' and provides a response scenario when system interruption occurs due to removal/change of the LAN port.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when system shutdown occurs due to arbitrary manipulation by an unauthorized person.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when a business delay occurs due to system overload.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'unauthorized terminal' when exposure to intrusion through a port of a vulnerable service occurs.

19 is a diagram showing a malicious code scenario among risk scenarios according to the present embodiment.

Autonomous ship cyber security management system 100 describes a method of providing a scenario corresponding to a malicious code scenario by evaluating each of the router 108, the IT network 120, the OT network 150, and the crew network 130 do.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'malicious code' when important information stealing or malicious behavior occurs by accessing administrator/user rights.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when a deliberate business (operation) delay occurs by accessing and changing unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal .

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when system shutdown occurs due to unauthorized manipulation.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when a business delay occurs due to excessive traffic.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when a business delay occurs due to system overload.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious code' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

20 is a diagram illustrating a malicious action scenario among risk scenarios according to the present embodiment.

The autonomous ship cyber security management system (100) evaluates each of the router (108), IT network (120), OT network (150), and crew network (130) to provide a scenario for responding to malicious behavior scenarios. Explain.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'malicious act' when accessing the system and leaking important information to the outside (competitor/institution).

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'malicious act' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'malicious behavior' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'malicious act' in case of intentional delay in business (operation) by accessing and changing unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'malicious act' and provides a response scenario when an unauthorized person randomly attempts to log in and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'malicious act' and provides a response scenario when malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'malicious act' in case of unauthorized modification (manipulation) of important systems, business delays/operation interruptions.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'malicious behavior' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal do.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'malicious act' and provides a response scenario when system interruption occurs due to removal/change of the LAN port.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'malicious act' and provides a response scenario when system shutdown occurs due to unauthorized manipulation.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'malicious act' when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

21 is a diagram illustrating a personal information abuse scenario among risk scenarios according to the present embodiment.

The autonomous vessel cyber security management system 100 evaluates each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to provide a scenario corresponding to a personal information abuse scenario. Explain.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'abuse of personal information' and provides a response scenario when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'abuse of personal information' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'personal information abuse' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'abuse of personal information' and provides a response scenario when intentional business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'abuse of personal information' and provides a response scenario when an unauthorized person randomly attempts to log in and steals an account and falsification or destruction of important information occurs.

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous vessel cyber security management system 100 recognizes the threat factor as 'abuse of personal information' and provides a response scenario.

22 is a diagram illustrating a denial of infringement scenario among risk scenarios according to the present embodiment.

Autonomous ship cyber security management system 100 describes a method for providing a scenario corresponding to a denial of infringement scenario by evaluating each of a router 108, an IT network 120, an OT network 150, and a crewman network 130 do.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'denial of infringement' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'infringement denial' when intentional business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'denial of infringement' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'infringement denial' and provides a response scenario when account hijacking occurs when a hacker infiltrates because the password (PW) is not encrypted.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'infringement denial' and provides a response scenario when malicious code propagation occurs by connecting to the internal network with an unauthorized terminal.

The autonomous vessel cyber security management system (100) provides a response scenario by recognizing the threat factor as 'infringement denial' in case of unauthorized modification (manipulation) of important systems, business delays/operation interruptions.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'denial of infringement' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal .

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as 'denial of infringement' and provides a response scenario.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'infringement denial' when system shutdown occurs due to unauthorized manipulation.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as 'infringement denial' when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'denial of infringement' when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'infringement denial' when business (operation) delays occur due to access to the system and change of important information.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'infringement denial' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

23 is a diagram illustrating an operation mistake scenario among risk scenarios according to the present embodiment.

Autonomous vessel cyber security management system (100) describes a method for evaluating each router (108), IT network (120), OT network (150), and crew network (130) to provide scenarios corresponding to operational error scenarios do.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a deliberate business (operation) delay occurs due to accessing and changing unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'operation mistake' and provides a response scenario when malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' in the event of an unauthorized modification (manipulation) of important systems, delay / operation interruption.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario when access to important information and arbitrary manipulation of the OT network 150 occur by connecting to the internal network with an unauthorized terminal .

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario.

In the event of a system outage due to the removal/change of the LAN port, the autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a system shutdown occurs due to an unauthorized person's arbitrary manipulation.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when business delay occurs due to excessive traffic.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when a business delay occurs due to system overload.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as an 'operational mistake' and provides a response scenario when a system failure occurs due to the execution of a patch whose stability has not been verified.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as an 'operational mistake' when vulnerability to cyber attacks occurs due to missing security patches.

24 is a diagram illustrating a hardware failure scenario among risk scenarios according to the present embodiment.

Autonomous ship cyber security management system 100 describes a method for evaluating each router 108, IT network 120, OT network 150, and crew network 130 to provide a scenario corresponding to a hardware fault scenario do.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'hardware defect' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'hardware defect' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a deliberate delay in business (operation) occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when an unauthorized person randomly attempts to log in and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous vessel cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'hardware defect' in the event of an unauthorized modification (manipulation) of an important system, a delay / operation interruption.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal .

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when system interruption occurs due to removal/change of the LAN port.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a system shutdown occurs due to an unauthorized person's arbitrary manipulation.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when business delay occurs due to excessive traffic.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as a 'hardware defect' when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a business delay occurs due to system overload.

The autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous vessel cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when a system failure occurs due to the execution of a patch whose stability has not been verified.

The autonomous ship cyber security management system 100 recognizes the threat factor as a 'hardware defect' and provides a response scenario when vulnerability to cyber attacks occurs due to missing security patches.

25 is a diagram illustrating a power outage scenario among risk scenarios according to the present embodiment.

The autonomous ship cyber security management system 100 describes a method for evaluating each of the router 108, the IT network 120, the OT network 150, and the crew network 130 to provide a scenario corresponding to a power outage scenario. .

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'power outage' when important information is leaked to the outside (competitor/institution) by accessing the system.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a business (operation) delay occurs due to access to the system and change of important information.

The autonomous ship cyber security management system 100 provides a response scenario by recognizing the threat factor as 'power outage' when important information stealing or malicious behavior occurs by accessing administrator/user privileges.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a deliberate business (operation) delay occurs due to access to and change of unauthorized information.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when an unauthorized person attempts to log in randomly and steals an account and falsification or destruction of important information occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when account hijacking occurs when a hacker invades because the password (PW) is not encrypted.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when infection and propagation of malicious code/ransomware occurs.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a malicious code propagation occurs by connecting to an internal network with an unauthorized terminal.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario in case of unauthorized modification (manipulation) of important systems, delay / operation interruption.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when accessing important information and arbitrary manipulation of the OT network 150 by connecting to the internal network with an unauthorized terminal.

When important information (network/cargo/financial information) is leaked by a hacker, the autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a system interruption occurs due to the removal/change of the LAN port.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a system shutdown occurs due to unauthorized manipulation.

The autonomous vessel cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when business delay occurs due to excessive traffic.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a navigation accident occurs due to arbitrary manipulation/modulation of important information on the OT network 150.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a business delay occurs due to system overload.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when exposure to intrusion through a port of a vulnerable service occurs.

When exposure to a zero-day attack occurs, the autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when a system failure occurs due to the execution of a patch whose stability has not been verified.

The autonomous ship cyber security management system 100 recognizes the threat factor as 'power outage' and provides a response scenario when vulnerability to cyber attacks occurs due to missing security patches.

The above description is merely an example of the technical idea of the present embodiment, and various modifications and variations can be made to those skilled in the art without departing from the essential characteristics of the present embodiment. Therefore, the present embodiments are not intended to limit the technical idea of the present embodiment, but to explain, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The scope of protection of this embodiment should be construed according to the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of rights of this embodiment.

CROSS-REFERENCE TO RELATED APPLICATION

In accordance with Article 119 (a) of the United States Patent Act (35 U.S.C § 119 (a)), this patent application claims priority to Patent Application No. 10-2022-0019444 filed in Korea on 2022.02.15. The contents are incorporated into this patent application by reference. In addition, if this patent application claims priority for the same reason as above for countries other than the United States, all the contents are incorporated into this patent application as references.

Claims (5)

a data collection unit that generates collection data by collecting transmission and reception data for a plurality of networks in an autonomous ship; a cyber attack identification unit that analyzes the collected data and checks whether a cyber attack or abnormal traffic to one or more networks among the plurality of networks is detected; and a cyber attack blocker blocking the cyber attack or the network in which the abnormal traffic is detected among the plurality of networks; A cyber security management device comprising a. According to claim 1, The plurality of networks A Very Small Aperture Terminal (VSAT) interworking with a satellite, a router communicating with a mobile communication base station, respectively; IT (Information Technology) network communicating with a business PC and a business server installed inside the autonomous ship; A crew network communicating with a wireless access point (AP) installed inside the autonomous ship and a crew terminal; An OT (Operational Technology) network interworking with a monitoring device, a navigation device, and a control device installed inside the autonomous ship; A cyber security management device comprising a. According to claim 2, The data collection unit Generating collected data by combining transmission and reception data collected from the router, the IT network, the crew network, and the OT network, compressing the collected data, and applying an open stack for a maximum protocol range to generate the collected data A cyber security management device characterized in that for doing. According to claim 2, The cyber attack confirmation unit The cyber security management device characterized in that it checks whether a cyber attack or abnormal traffic of the collected data on the IT network is detected by using an agent program installed on the work PC and the work server. According to claim 2, The cyber attack confirmation unit Cyber security management characterized in that it checks whether a cyber attack or abnormal traffic of the collected data for the OT network is detected from a traffic detection sensor that detects traffic for the monitoring device, the navigation device, and the control device Device.

Images