1. An apparatus for analyzing rule-based security event association, the apparatus comprising: a rule management unit configured to check whether an security event is a candidate security event requiring association analysis; an event management unit configured to analyze the candidate security event and check whether the analyzed security event is the candidate security event requiring association analysis; and an association processing unit configured to analyze whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with a user event list to generate an association analysis result.