1. An apparatus for analyzing rule-based security event association, the apparatus comprising: a memory unit; a first manager configured to check whether a security event is a candidate security event requiring association analysis; a second manager configured to: determine whether the security event is a user event associated with a user, when the user event is a new user event associated with an ingress, create an event list associated with the user in the memory unit and create an entry for the user event in the event list, when the user event is a departing user event associated with a departure, delete the event list associated with the user from the memory unit, when the user event is one of a logon event, a logoff event, and an alert event, create an entry for the user event in the event list associated with the user, and provide a user event list of a requested user; and a processor configured to analyze whether an association event of a rule DB corresponding to a user ID of the candidate security event is matched with the user event list to generate an association analysis result.