Abstract: A multistep integrated security management system and method using an intrusion detection log collection engine and a traffic statistic generation engine is disclosed. An intrusion detection log collection engine capable of collecting logs generated from diverse intrusion detection engines and a traffic statistic generation engine collect and transmit analyzed data to a control intermediate management server. The control intermediate management server performs more accurate intrusion detection by relationally analyzing the intrusion detection log information and the traffic statistic information. A control uppermost management server performs an integrated security management on a large-scale group subject to control by performing an integrated analysis on a large-scale group subject to control, and thus can support the large-scale integrated security management efficiently.