Abstract: The disclosure below relates to a security data processing device, a security data processing method, and a computer-readable storage medium for storing a program for processing security data. An embodiment provides a security data processing method comprising the steps of: classifying security events into one or more groups; extracting meaningful words from at least one security event in each of the classified groups; labeling each of the security events as a true positive group or a false positive group on the basis of the extracted meaningful words; and quantifying the security events in the true positive group and the security events in the false positive group.

Abstract: A security information visualization method including the steps of: preprocessing log data extracted from a security device; calculating, from the pre-processed log data, periodic data of element information related to internet protocol (IP) address information about a security action; and providing visualization information visualizing the IP address information and the calculated periodic data of element information.

Abstract: A security information visualization method including the steps of: preprocessing log data extracted from a security device; calculating, from the pre-processed log data, periodic data of element information related to internet protocol (IP) address information about a security action; and providing visualization information visualizing the IP address information and the calculated periodic data of element information.