JP2011086156A - System and program for tracking of leaked information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform quantitative candidate specification of an information leakage source and specification of a leakage candidate. <P>SOLUTION: A leaked information tracking system includes: a knowledge data collection and registration unit 112 for respectively collecting stored data from a technical document data server 30 and a technical information management system 40 which are mutually connected through a company's internal network 20, converting the collected data into text data and registering the text data as knowledge data; a knowledge database 111 for storing knowledge data; a knowledge database retrieval unit 113 for retrieving the knowledge database 111 on the basis of an externally input retrieval condition and for output of an access log including retrieval user's identification information; an access log storage unit 114 for storing access logs; a leakage source candidate information specification unit 121 for specifying leakage source candidate information while referring to the knowledge database 111 by text data of leaked information; and an access log tracking unit 123 for tracking an access log on the basis of the specified leakage source candidate information and extracting a user having probability of information leakage. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a leakage information tracking system and a leakage information tracking program for narrowing down and specifying leakage source information and information leakers when information leakage occurs.

Conventionally, when technical information is leaked and the information is made public, follow-up investigations have been performed manually by the following procedure.
(1) Confirmation of contents of leaked (public) information (2) Manual search of information source that seems to be leaked and verification of leaked information, authenticity check (3) Tracking access log of leaked candidate information (4) Narrowing down and identifying information leakers Therefore, it is not possible to quantitatively grasp the degree of coincidence between the information that seems to be leaked information and the disclosed leaked information. There was no choice but to make a gap.
As a technology for supporting such narrowing / identification of leakage source information, Patent Document 1 discloses the contents of an electronic form system based on the characteristic data of leakage information and specifies leakage source candidate information. A leaked data tracking device configured to track a suspicious person from a log is disclosed. In this leaked data tracking apparatus, electronic form data candidates that match the characteristics of leaked information are identified, and the access log is tracked to identify candidates of suspicious individuals who may have become leak sources.

JP 2008-165511 A

However, the above prior art has the following problems.
(1) Problem of Diversity of Leakage Source Information Form Since the above-mentioned Patent Document 1 limits the action to an electronic form system, such as a system other than the electronic form system, an unsystemized word processor, spreadsheet, etc. Document data cannot be tracked. In other words, when information is managed in various forms such as document data (word processors, spreadsheets, etc.) and system data, humans are visually inspected for each system or for each document when searching for an information source that seems to be a leak source. There was no choice but to narrow down the source of information.
(2) Problems related to access log Since the access log of the narrowed leak source candidate information is enormous and tracking must be performed for each system, it takes time. In addition, there is usually no access log for document data (word processors, spreadsheets, etc.), and there is a lack of decisiveness in narrowing down and identifying information leakers.
Accordingly, in view of the above-described problems of the prior art, an object of the present invention is to provide a leakage information tracking system and a leakage information tracking program capable of quantitatively identifying a leakage information source and specifying a leakage candidate from an access log. And

  A leakage information tracking system according to the present invention is connected to a technical document data server holding document data of technical information and a technical information management system holding the technical information in a database via an in-house network, and the technical document data server And a knowledge data collection / registration unit for collecting the document data and the data held in the database from the technical information management system and registering the knowledge data obtained by converting the data into text data, and a knowledge database in which the knowledge data is registered, A knowledge database search unit for searching the knowledge database based on an externally input search condition and outputting an access log including user identification information and operation classification related to the search; and storing the output log Access log storage unit and the internal network A leakage source candidate information specifying unit that refers to knowledge data in the knowledge database based on text data of leakage information released outside the network and specifies leakage source candidate information that is a source of the leakage information, and the specified An access log tracking unit that tracks an access log in the access log storage unit based on the leaked source candidate information and extracts a user who has a possibility of information leakage.

  The leakage information tracking program according to the present invention is connected to a technical document data server that holds document data of technical information and a technical information management system that holds the technical information in a database via an in-house network. The document data and the data held in the database are respectively collected from the technical document data server and the technical information management system in a computer having a knowledge database for managing the knowledge data as text format knowledge data, and the knowledge data is converted into text data. Knowledge data collection / registration step to be registered in the database and knowledge database search for searching the knowledge database based on externally input search conditions and outputting an access log including user identification information and operation classification related to the search Ste And leak source candidate information specifying step of referring to knowledge data in the knowledge database based on text data of leak information published outside the in-house network and specifying leak source candidate information that is a source of the leak information And an access log tracking step of tracking the access log based on the specified leakage source candidate information and extracting a user having a possibility of information leakage.

  According to the present invention, there are provided a leakage information tracking system and a leakage information tracking program capable of quantitatively specifying a leakage information source candidate and specifying a leakage candidate from an access log.

The figure which shows the example of whole structure of the leakage information tracking system which concerns on one Embodiment of this invention. The block diagram which shows the hardware structural example of the leak information tracking apparatus shown in FIG. The block diagram which shows the relationship between each part of the knowledge sharing server shown in FIG. 1, and a leakage information tracking device. The flowchart which shows the specific example of the process in the knowledge sharing server shown in FIG. The flowchart which shows the specific example of the process in the leak source candidate information specific | specification part shown in FIG. The figure which shows the specific example of the output format of leak source candidate information search result. The flowchart which shows the specific example of the process in the access log tracking part of the leakage information tracking apparatus shown in FIG. The figure which shows the specific example of an access log tracking condition setting screen. The figure which shows the specific example of an access log. The figure which shows the specific example of a work file. The figure which shows the example of a display of an access log tracking result. The figure which shows the specific example of a leakage information tracking result report.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of the overall configuration of a leakage information tracking system 10 according to an embodiment of the present invention. As shown in the figure, the leakage information tracking system 10 according to the present embodiment is a computer system in which a knowledge sharing server 11 and a leakage information tracking device 12 are connected via an in-house network 20.

  The knowledge sharing server 11 is connected to the technical document data servers 30 and the technical information management system 40 scattered throughout the company via an in-house network (intranet) 20 such as a LAN, and the technical information is stored in XML (eXtensible Markup Language). A knowledge database 111 managed as knowledge data in a format, a knowledge data collection / registration unit 112 that extracts and collects technical information from the technical document data server 30 and the technical information management system 40, and registers the knowledge information in the knowledge database 111; The server includes a knowledge database search unit 113 that provides a search service function of collected technical information and an output function of an access log including an operation history, and an access log storage unit 114 that stores the access log. The knowledge sharing server 11 can be implemented, for example, by combining an XML database such as TX1 (registered trademark) provided by the present applicant and Knowledge Meister (registered trademark) that is knowledge management support software.

  The leakage information tracking device 12 is configured to use the knowledge database 111 in the knowledge sharing server 11 based on the leakage information acquired from the external Web server 70 on the external network 60 (Internet) connected to the internal network 20 via the firewall 50. This is a device that narrows down and identifies candidates for leakage source information, and narrows down and identifies suspicious employees who are candidates for information leakage by tracking access logs.

  The leak information tracking device 12 searches for leak source information candidates from the knowledge sharing server 11 to generate leak source candidate information, and leak source candidate information for storing the leak source candidate information. Based on the leakage source candidate information, the storage unit 122, the access log tracking unit 123 that tracks the access log and lists suspicious employees who may leak information as the access log tracking result, and the access log tracking result As a function of an access log tracking result storage unit 124.

  The technical document data server 30 is a server that stores various document data such as word processing documents and spreadsheets, and may be a so-called file server or a document management system. The technical information management system 40 may be an application system that manages technical information, or may be a database system. Here, it is assumed that the internal network 20 is connected to the external network 60 via the firewall 50, and communication between the networks is restricted.

  The external Web server 70 is a server that creates an HTML document (Hyper Text Markup Language) in response to a request from a client terminal (not shown) connected via the external network 60 and outputs it to the client terminal. Specific examples of HTML documents include bulletin boards, news, and blogs.

  FIG. 2 is a block diagram illustrating a hardware configuration example of the leakage information tracking device 12 illustrated in FIG. A CPU (Central Processing Unit) 131 is a central control device that comprehensively controls each device connected to the system bus. A RAM (Random Access Memory) 132 is a storage device that is used as a main memory of the CPU 131 and functions as an OS area, a program area, a work area, a temporary save area, and the like.

A ROM (Read Only Memory) 133 is a read-only storage device that stores an operating system (OS) that is a control program of the CPU 131 and programs for realizing various functions of the leakage information tracking device 12.
The LAN adapter 134 is a network connection control mechanism that controls communication with an external device (knowledge sharing server 11) via a LAN (in-house network 20). The video adapter 135 is a connection mechanism with the display device.

A keyboard 136 and a mouse 137 are input devices that input input information in accordance with user operations to the CPU 131.
The auxiliary storage device 138 is a large-capacity storage device that accumulates programs and data, and is, for example, a hard disk or an SSD (Solid State Drive).
The storage medium drive 139 is a device that reads / writes data from / to a storage medium such as a flexible disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, and a DVD-R. Note that the program for realizing the various functions of the leakage information tracking device 12 described above may be acquired from these storage media and supplied to the CPU 131, or other communication via a communication medium such as the Internet. It may be acquired from the apparatus and supplied to the CPU 131.

  The hardware configuration of the knowledge sharing server 11 is the same as that of the leakage information tracking device 12. That is, programs for realizing various functions described later by the CPU 131 of the knowledge sharing server 11 are stored in the auxiliary storage device 138 of the knowledge sharing server 11 or the like. In addition to the auxiliary storage device 138, this program may be supplied from the storage medium drive 139 to the CPU 131 or may be supplied via a communication medium such as the Internet.

  FIG. 3 is a block diagram showing the relationship between each part of the knowledge sharing server 11 and the leaked information tracking device 12 shown in FIG. First, the knowledge sharing server 11 will be described in detail. As shown in the figure, the knowledge data collection / registration unit 112 of the knowledge sharing server 11 receives technical information as text from the technical document data server 30 and the technical information management system 40 connected to the in-house network 20 (LAN). This is a program for extracting and registering and storing information in the knowledge database 111 in XML format. Since technical information is registered in an XML format that can adopt a flexible data structure, it is also effective for managing atypical data, and it is easy to cope with changes in items and system expansion. Specific examples of text extracted in the case of document data include attribute information such as the creation date, update date, and creator name of the document file, and text (text) in the document file. Also, the document content itself is registered together with the extracted text. If the technical document data server 30 is a document management system in which an access log exists, the technical document data server 30 registers this in the knowledge database 111 and then converts the access log into a predetermined format for registration. The same applies to the technical information management system 40 when there is an access log.

  The knowledge database search unit 113 is a program that provides a search service for technical information that is centralized in the knowledge database 111 in a centralized manner, and the person in charge of searching for technical information always uses this search function to search for technical information. Shall be performed. The knowledge database search unit 113 performs a search using natural sentences or keywords, and displays a list of hit document titles as search results. The searcher can select the title of the hit document from the list, and can browse, print, or download the text or content of the document. At this time, the knowledge database search unit 113 outputs an access log including “who”, “when”, “what”, “how (view / print / download)” to the access log storage unit 114.

  Next, the leakage information tracking device 12 will be described in detail. The leakage information tracking device 12 is used when tracking leakage information when information leakage occurs and the disclosure of the information becomes clear. The leaked information in the present embodiment is information disclosed on a network such as a website on the Internet or a bulletin board site, but indicates confidential information widely disclosed to the public. For example, even an electronic file stored on a CD-R or a printed document can be traced by reading it as text data.

As shown in FIG. 3, the functions of the leak source candidate information specifying unit 121 of the leak information tracking device 12 are a text extraction unit 121a, a text analysis unit 121b, a leak source candidate information extraction unit 121c, and a leak source candidate information output unit 121d. are categorized.
The text extraction unit 121a is a program that extracts leaked contents as text from publicly disclosed leaked information. The text extraction unit 121a has a function of converting a file conforming to a specific application format into a text format. That is, data such as a file in a format used by an application such as a document editing program (word processing document) or a spreadsheet program, or a file in an HTML format is converted into a file (text format) that does not include a specific format. The text of the leaked content captured at this time is used as a search condition for the leaked source information.

  The text analysis unit 121b is a program that performs morphological analysis, syntax analysis, and semantic analysis of the text captured by the text extraction unit 121a, and generates a search keyword that actually searches the knowledge database 111. “Morphological analysis” is to divide a sentence into morphemes and divide the parts of speech of the morphemes. “Syntactic analysis” means analyzing the structure of a sentence and clarifying the relationship between dependency and reception. “Semantic analysis” plays a role of improving the accuracy of a search keyword by searching related terms based on a thesaurus dictionary and capturing the meaning of a sentence in a derivative manner. Based on these analysis results, the text analysis unit 121b generates a search keyword from the input text and outputs it to the leak source candidate information extraction unit 121c.

The leakage source candidate information extraction unit 121c is a program that searches the knowledge database 111 based on the search keyword generated and output by the text analysis unit 121b.
The leak source candidate information output unit 121d is a program that sorts the search results in descending order of matching and outputs them to the leak source candidate information storage unit 122.

Further, as shown in FIG. 3, the function of the access log tracking unit 123 of the leakage information tracking device 12 is that a tracking condition input unit 123a, a tracking processing unit 123b, an accessor extraction processing unit 123c, and an access log tracking result output unit 123d. are categorized.
The condition input unit 123a outputs a screen for inputting conditions for tracking the access log stored in the access log storage unit 114 of the knowledge sharing server 11, and information input using a mouse or a keyboard from the screen. It is a program that acquires.

  The tracking processing unit 123b refers to the access log in the knowledge sharing server 11 (access log storage unit 114) based on the tracking start / end date condition input in the tracking condition input unit 123a and the content of the leakage source candidate information search result. And tracking program.

The accessor extraction processing unit 123c is a program that extracts accessor information based on the accessor ID in the work file created by the tracking processing unit 123b and adds the information to the work file.
The access log tracking result output unit 123d is a program that sorts the contents of the work file updated by the accessor extraction processing unit 123c in the order of accessor ID, aggregates matching scores for each accessor ID, and outputs the aggregation result. is there.

  Hereinafter, the operation of each device constituting the leakage information tracking system 10 according to the present embodiment will be described with reference to the drawings. FIG. 4 is a flowchart showing a specific example of processing in the knowledge sharing server 11 shown in FIG.

  In S401, the knowledge data collection / registration unit 112 extracts technical information as text from the technical document data server 30 and the technical information management system 40 connected to the in-house network 20 (LAN).

  In S402, the knowledge data collection / registration unit 112 registers and accumulates the extracted text data in the knowledge database 111 in the XML format. At this time, if the collected technical information is document data, the document content itself is registered together with the extracted text. The technical information collection / registration process may be performed by night-time batch processing, or may be performed in real time in accordance with the registration / update of the technical information at the collection source.

  In step S403, the knowledge data collection / registration unit 112 determines whether an access log exists in the server or system from which the technical information is collected. If it is determined that there is an access log at the collection source, the process proceeds to S404. If it is determined that no access log exists, the process proceeds to S405.

  In S404, the knowledge data collection / registration unit 112 acquires an access log that exists at the collection source of the technical information, registers the access log in the knowledge database 111, converts the access log into a predetermined format, and then accesses the access log. Registration in the storage unit 114 is performed.

  In step S <b> 405, the knowledge database search unit 113 determines whether or not there is a search request for technical information integrated in the knowledge database 111. If it is determined that there is a search request for the knowledge database 111 from the user, the process proceeds to S406. On the other hand, if it is determined that there is no search request, the system waits until there is a search request.

In S <b> 406, the knowledge database search unit 113 searches the knowledge database 111 based on the input search conditions such as natural sentences and keywords, and displays the titles of hit documents as search results.
In step S407, the knowledge database search unit 113 acquires the document title and operation category selected by the user on the screen.

In step S <b> 408, the knowledge database search unit 113 performs processing according to the title and operation classification (viewing / printing / downloading, etc.) of the document selected by the user.
In S409, the knowledge database search unit 113 creates an access log including “who”, “when”, “what”, “how (viewing / printing / downloading)” based on the processing content of S407, This access log is output to the access log storage unit 114, and the process ends.

FIG. 5 is a flowchart showing a specific example of processing in leakage source candidate information specifying unit 121 shown in FIG.
In step S501, the text extraction unit 121a extracts the leakage content as text from the disclosed leakage information and takes it in. At this time, the text extraction unit 121a converts a file conforming to a specific application format into a text format. That is, data such as a file in a format used in an application such as a document editing program (word processing document) or a spreadsheet program or a file in HTML format is converted into a file (text format) that does not include a specific format. The text of the leaked content captured at that time is used as a search condition for the leaked source information.

In S502, the text analysis unit 121b performs morphological analysis, syntax analysis, and semantic analysis of the text captured by the text extraction unit 121a, and generates a search keyword for actually searching the knowledge database 111.
In S503, the leakage source candidate information extraction unit 121c searches the knowledge database 111 based on the search keyword generated and output by the text analysis unit 121b. A full text search of the knowledge database 111 is performed using the search keyword, and technical information including the search keyword is extracted. The search is performed with higher accuracy by using not only the keyword of the morphological analysis result of the input text but also the related word or derivative word generated from the result of the semantic analysis.

  In S504, the leakage source candidate information extraction unit 121c determines whether there is knowledge data (technical information) including the search keyword. If it is determined that the corresponding knowledge data exists, the process proceeds to S505. On the other hand, if it is determined that there is no corresponding knowledge data, the process ends.

  In step S505, the leakage source candidate information output unit 121d counts the number of times the search keyword has been hit to obtain a matching score, and sorts the results in descending order of matching and outputs the result to the leakage source candidate information search result file. Exit. FIG. 6 is a diagram illustrating a specific example of the output format of the leak source candidate information search result. The primary key shown in FIG. 6 is the title key of the knowledge database 111 that can uniquely identify the title of the search result. The title name is a title name of a technical information document registered in the knowledge database 111. The matching score is a result of counting the keyword hit count when a search is performed by the leakage source candidate information extraction unit 121c. Here, the leakage source candidate information search results are sorted in descending order from the highest matching score, and are output in descending order of possibility of the leakage source information.

  FIG. 7 is a flowchart showing a specific example of processing in the access log tracking unit 123 of the leaked information tracking device 12 shown in FIG.

  In step S <b> 701, the tracking condition input unit 123 a acquires the tracking condition of the access log input by the user using the mouse or the keyboard from the screen. FIG. 8 is a diagram showing a specific example of the access log tracking condition setting screen. The date condition specifies from what point in time to which point the access log is tracked. Usually, the date when the leakage information is supposed to be published / published is designated as the “tracking end date”, and the starting date of the time when the information leakage may occur is designated as the “tracking start date”. When the user clicks the “start” button on the screen with the mouse, tracking of the access log is started. When the “Cancel” button is clicked, the input of the tracking condition is canceled and the program ends.

  In step S <b> 702, the tracking processing unit 123 b refers to the leakage source candidate information storage unit 122 and determines whether leakage source candidate information exists. If it is determined that there is leakage source candidate information, the process proceeds to S703. On the other hand, when it is determined that there is no leak source candidate information, the leak is not specified and there is no leak information that should identify the leaker.

  In step S <b> 703, the tracking processing unit 123 b determines the knowledge sharing server 11 (knowledge database 111) based on the tracking start / end date conditions input in the tracking condition input unit 123 a and the contents of the leakage source candidate information (document file name, etc.). Track access logs stored in. Specifically, the access log is searched based on the primary key / title name of the leakage source candidate information search result, the corresponding access log record is extracted within the range of the tracking start / end date, and this is stored in the work file. Write out. FIG. 9 is a diagram illustrating a specific example of an access log. As shown in the figure, the access log record manages a history of information browsing / printing / downloading and the like in the knowledge database search unit 113. Further, the operation category of FIG. 9 is a category representing what operation the access person has performed on the corresponding title. In the present embodiment, the tracking processing unit 123b extracts access log records with the titles “browsing: B”, “printing: P”, and “downloading: D” among the operation categories, and extracts other operation categories. However, the extraction target can be arbitrarily changed.

  In S704, the accessor extraction processing unit 123c extracts the accessor information from the user information based on the accessor ID in the work file created by the tracking processing unit 123b, and adds it to the work file. FIG. 10 is a diagram illustrating a specific example of a work file. User information managed by the knowledge sharing server 11 is searched using the accessor ID in the work file as a search key. The name and department name of the corresponding person indicated by the accessor ID are extracted from the user information and added to the work file. As a result, the information shown in FIG. 10 is managed in the work file.

  In S705, the access log tracking result output unit 123d sorts the contents of the work file in FIG. 10 updated by the accessor extraction processing unit 123c in the order of the accessor ID, and totals the matching score for each accessor ID. Output as tracking results. FIG. 11 is a diagram illustrating a display example of the access log tracking result. In the figure, after the matching score for all the accessor IDs in the work file is completed, the contents of the access log tracking results are sorted in descending order of the matching score and ascending order of the accessor ID. Has been.

  In S706, the access log tracking result output unit 123d creates and outputs a leakage information tracking result report from the processing result, and ends the processing. FIG. 12 is a diagram illustrating a specific example of a leakage information tracking result report. As shown in the figure, the leakage information tracking result report includes the title name and matching score in descending order of the matching score (in order of high possibility of leakage source) from the content of the leakage source information search result of the leakage source candidate information. ) Is displayed. In addition, from the access log tracking result, which is the result of tracking the access log, the names, departments, and matching score totals of the top five rankings of accessor of leaked candidate information are displayed. Further, the name of the work file, the access date / time, the title name, and the operation classification are displayed in the access log details of the top five rankings.

Thus, by providing the leakage information tracking system 10, the following effects can be expected.
(1) By collecting and searching technical information in the knowledge database 111, it is possible to reliably collect and track the access log to the technical information.
(2) By using leaked information itself as a search condition for leaked source candidate information, it is possible to narrow down and identify candidates for leaked source information with high accuracy.
(3) By systematizing the identification of leakage source information and the tracking of access logs, which conventionally depended on humans, it is possible to greatly reduce the time and labor required for the identification and tracking work when information leakage occurs.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, although the knowledge sharing server 11 and the leakage information tracking device 12 are connected via the in-house network 20, they may be formed as an integrated device. The target of leaked information is not limited to technical information, and the system can be applied to tracking when business information such as trade secrets leaks.

DESCRIPTION OF SYMBOLS 10 ... Leakage information tracking system 11 ... Knowledge sharing server 12 ... Leakage information tracking device 20 ... Internal network 30 ... Technical document data server 40 ... Technical information management system 50 ... Firewall 60 ... External network 70 ... External Web server 111 ... Knowledge database 112 ... Knowledge data collection / registration unit 113 ... Knowledge database search unit 114 ... Access log storage unit 121 ... Leakage source candidate information identification unit 121a ... Text extraction unit 121b ... Text analysis unit 121c ... Leakage source candidate information extraction unit 121d ... Leakage source Candidate information output unit 122 ... Leakage source candidate information storage unit 123 ... Access log tracking unit 123a ... Tracking condition input unit 123b ... Tracking processing unit 123c ... Accessor extraction processing unit 123d ... Access log tracking result output unit 124 ... Access log tracking result Storage unit 131 CP
132 ... RAM
133 ... ROM
134 ... LAN adapter 135 ... video adapter 136 ... keyboard 137 ... mouse 138 ... auxiliary storage device 139 ... storage medium drive

Claims (5)

A technical document data server that holds technical data document data and a technical information management system that holds the technical information in a database are connected via an in-house network, and the document data from the technical document data server and the technical information management system. And a knowledge data collection / registration unit for collecting knowledge data stored in the database and registering knowledge data obtained by converting the data into text data,
A knowledge database in which the knowledge data is registered;
A knowledge database search unit that searches the knowledge database based on an externally input search condition and outputs an access log including user identification information and operation classification related to the search;
An access log storage unit for storing the output access log;
Leakage source candidate information identifying unit for referring to knowledge data in the knowledge database based on text data of leaked information published outside the in-house network, and identifying leakage source candidate information that is the source of the leakage information;
An access log tracking unit that tracks an access log of the access log storage unit based on the identified leakage source candidate information and extracts a user having a possibility of information leakage;
A leakage information tracking system characterized by comprising: The leakage source candidate information specifying unit
A text extraction unit for extracting text data from the leakage information;
A text analysis unit that performs morphological analysis, syntax analysis, and semantic analysis on the extracted text data, and generates a search key according to leakage source candidate information;
Leakage source candidate information extraction that refers to the knowledge database based on the generated search key, counts the number of hits of the search key for each knowledge data, and extracts the leak source candidate information based on the number of hits And
The leakage information tracking system according to claim 1, further comprising: The access log tracking unit
A tracking processing unit that tracks the access log for each leakage source candidate information extracted by the leakage source candidate information extraction unit and obtains an accessor and the number of accesses;
An accessor extraction processing unit that counts the number of accesses of the accessor for each leakage source candidate information, and extracts an accessor having a higher access number;
The leakage information tracking system according to claim 2, further comprising:   The knowledge database search unit categorizes operations performed on the knowledge database into at least browsing, printing, and downloading operation categories, and outputs the operation categories included in the access log. The leakage information tracking system according to any one of claims 1 to 3. Knowledge that manages the technical information as text-format knowledge data, connected to a technical document data server that holds technical data document data and a technical information management system that holds the technical information in a database via an in-house network On the computer with the database,
A knowledge data collection / registration step for collecting the document data and the data held in the database from the technical document data server and the technical information management system, respectively, converting them into text data and registering them in the knowledge database;
A knowledge database search step of searching the knowledge database based on an externally input search condition and outputting an access log including user identification information and operation classification related to the search;
Leakage source candidate information identifying step for referring to knowledge data in the knowledge database based on text data of leakage information published outside the in-house network, and identifying leakage source candidate information that is the source of the leakage information;
An access log tracking step of tracking the access log based on the specified leak source candidate information and extracting a user having a possibility of information leakage;
Leakage information tracking program characterized by causing

Images