KR100483602B1 - Method and system for monitoring e-mail - Google Patents

Abstract

The present invention relates to an email monitoring method and a monitoring system for monitoring an email leaked from a certain group. The monitoring method includes the steps of: classifying a plurality of documents in the group into confidential documents and general documents according to security requirements; Extracting a word included in the document; Converting each of the extracted words into a predetermined value; Displaying the document in a vector form applicable to an SVM algorithm by using the word converted into the value; Learning the plurality of documents using the SVM algorithm to calculate a Hyper-Plane, which is a boundary that divides the confidential document and a general document, and a support vector, which is a vector of the document closest to the limit. Document learning step; Sniffing outgoing email within the population; Extracting words contained in the sniffed email document; Converting each of the extracted words into a predetermined value; Displaying the email in the form of a vector applicable to an SVM algorithm using the word converted into the value; And determining whether the sniffed e-mail is a confidential document by applying the support vector calculated in the learning result and the e-mail converted into the vector form to the SVM algorithm. Thereby, by automatically learning the concept of general documents and confidential documents, and by analyzing the e-mail sent based on the learning results, an email monitoring method and system that can effectively monitor the leakage of confidential documents in the group through the e-mail Can be provided.

Description

Email monitoring method and system {METHOD AND SYSTEM FOR MONITORING E-MAIL}

The present invention relates to an e-mail monitoring method, and more particularly, by automatically learning the concept of the general document and confidential documents, and by analyzing the e-mail sent based on the learning results, confidential documents in the group is leaked through the e-mail It is to provide an email monitoring method and system that can effectively monitor this.

E-mail, which sends and receives mail through the network, provides not only basic postal functions, but also the ability to transfer files. The e-mail can be sent to multiple people at the same time, sent to multiple people at the same time, and stored as data. It is widely used because of its advantages.

If a company's executives or employees deliberately or not send a confidential document by email, there is a risk of leaking the company's confidential information. As a result, companies have established a system to monitor the inclusion of confidential content in outgoing e-mails. Such a conventional security system manually extracts words included in a confidential document to establish a separate database, and determines whether the email contains a confidential document depending on whether the email contained in the database contains words stored in the database. Determine. Then, e-mails containing confidential documents are classified and managed separately.

However, in such a conventional security system, since the administrator examines and extracts important words from a large number of documents by hand, it is very difficult and takes a long time to extract the words. Therefore, the management cost increases.

It is also very difficult for the administrator to decide which words to extract when reviewing confidential documents.

Therefore, an object of the present invention, by automatically learning the concept of the general document and confidential documents, and by analyzing the e-mail sent based on the learning results, it is possible to effectively monitor the leakage of confidential documents in the group through the e-mail It is to provide an email monitoring method and system.

According to the present invention, there is provided an email monitoring method for monitoring an email leaked from a predetermined group, comprising: classifying a plurality of documents in the group into confidential documents and general documents according to security requirements; Extracting a word included in the document; Converting each of the extracted words into a predetermined value; Displaying the document in a vector form applicable to an SVM algorithm by using the word converted into the value; Learning the plurality of documents using the SVM algorithm to calculate a Hyper-Plane, which is a boundary that divides the confidential document and a general document, and a support vector, which is a vector of the document closest to the limit. Document learning step; Sniffing outgoing email within the population; Extracting words contained in the sniffed email document; Converting each of the extracted words into a predetermined value; Displaying the email in the form of a vector applicable to an SVM algorithm using the word converted into the value; And determining whether the sniffed e-mail is a confidential document by applying the support vector calculated in the learning result and the e-mail converted into the vector form to the SVM algorithm.

The converting into a form applicable to the SVM algorithm may include extracting a word included in the document and the email; Converting the extracted word into a predetermined value; It is possible to further include displaying the document and the e-mail in a vector form by using the word converted into the value.

In addition, it is most desirable to enable the real-time monitoring of the e-mail sent further comprising the step of analyzing whether the sniffed e-mail is a confidential document and reporting the result.

On the other hand, according to another field of the present invention, in the email monitoring system for monitoring the e-mail leaked from a predetermined group, a plurality of documents in the group are classified and stored in accordance with the level of security requirements classified as confidential documents and general documents A document database; A sniffer sniffing outgoing emails within the population; An email database in which the sniffed email is stored; A vector converter for extracting a word included in the document database and the email database and converting the word into a vector form applicable to an SVM algorithm; A vector database storing the converted vector; A support vector which is a vector of a document that is closest to a limit plane (Hyper-Plane) and a limit plane that distinguishes a confidential document from a general document by using the SVM algorithm. A document learner for calculating (Support vector); A learning result database in which a limit plane and a support vector, which are learning results from the document learner, are stored; A discriminator for determining whether the sniffed e-mail is a confidential document by applying a support vector calculated by the document learner as a learning result of the SVM algorithm and an e-mail converted into a vector form by the vector converter; It is also achieved by the email monitoring system, characterized in that it comprises a determination result database in which the result value determined from the discriminator is stored.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the present invention.

As shown in Figs. 1 and 2, the e-mail monitoring system includes a corporate internal network 1 in which an internal network is established, and a mail server 5 connected to a corporation through an external network. Here, the external network means the Internet, but other networks may include, for example, a LAN, a WAN, a public switched telephone network (PSTN), a public switched data network (PSDN), a cable network, a wireless communication network, and the like.

The corporate internal network (1) is an email monitoring server for monitoring whether a confidential document is included in an e-mail sent through the employee terminal (3) connected to the internal network and the employee terminal (3) used by the employee. It includes (2).

The e-mailing monitoring server 2 applies a support vector machine (SVM) algorithm in the learning process and the judgment process for classifying confidential documents. The SVM algorithm is a statistical learning method theory introduced by V. Vapnik, and is commonly used in terms of learning theory. The theoretical understanding and analysis is applied in various parts.

Text Categorization with Support Vector Machined: Learning with Many Relevant Features, LS-8 Report 23, Thorsten Joachims, Dormund, 27, November, 1997 (Revised: 19, April, 1998). Paper and A probabilistic analysis of the rocchio algorithm with tfidf for text categorizaton, In international Comference on Machne Learning (ICML), (Joachims, T. 1997); G. Salton and M. McGill, Introduction to Modern Informatio Retrieval, McGraw Hill, New York, 1983; J. Platt, "Fast Tranining of SVMs Using Sequential Miimal Optimizaton," tobe published in Advances in Kernel Methods-Support Vector Machine Learning, B.Scholkpf, C. Burgs, and A. Smola, eds., MIT Press, Cambridge, Mass. And many other documents, such as 1998.

According to the document classification method using the SVM algorithm, an example of classifying documents into two types is as follows. First, words included in a plurality of documents classified into two types are extracted and converted into a predetermined value, and each document is displayed in a vector form by using the converted word. Each document contains a number of words, so that the coordinate system representing the vector of the document is also composed of multidimensional or more spaces, and the displayed dimension becomes more extensive when there are many learned documents. In these coordinate systems, if documents are placed according to the vector value of each document, a hyper-plane that divides a plurality of vectorized documents into two kinds, and a support vector which is a vector of documents closest to the boundary plane (Support Vector) can be calculated. This series of processes is achieved by software with SVM algorithm, and the usefulness of SVM theory can be confirmed through experimental data of SVM-based document classification work introduced in various literatures.

On the other hand, the e-mail monitoring server 2 of the e-mail monitoring system according to the present invention, as shown in Figure 2, a document register for registering documents classified into confidential and general documents according to the security requirements level by the executive or employee (11), a document database (13) storing documents classified by the document register (11), a sniffer (19) for sniffing and storing e-mails transmitted from the employee terminal (3) to the mail server (5); , An email database 21 for storing sniffed emails, a vector converter 23 for converting words in documents and emails into a vector formatter, and a vector database 25 for storing documents and emails converted in vector form And a document learner 15 for learning the document converted into the vector form through the vector converter 23, a learning result database 17 for storing the learning results from the document learner 15, and the SVM algorithm. A discriminator 27 for determining whether the sniffed email is a confidential document by applying the support vector and the email converted into the vector, a discrimination result database 29 for storing whether the email is a confidential document; And a reporter 31 for displaying the confidential document discrimination result, and a control unit 10 for controlling them.

The document register 11 registers documents classified into confidential documents and general documents in the document database 13 by an executive or employee. The document register 11 is performed on a web basis as software for document registration. When registering a document by the document register 11, by dividing and registering the document by department or work characteristics can increase the accuracy of the learning. In particular, when the size of the organization is large and the contents of the confidential document vary, it is desirable to classify and register the documents by department. In this case, the general document may not be registered for each department but only confidential documents may be registered. Therefore, all documents other than documents classified as confidential documents are to be registered as general documents. For example, if Part A, Part B, and Part C registered only confidential documents, the confidential documents registered in Part A are classified documents registered in Part A, and the general documents in Part A are confidential documents registered in Part B. Use confidential documents registered in Sections C and C. In the same way, the general documents of part B use the confidential documents registered in part A and the confidential documents registered in part C. Using this method, each department can manage the document database 13 without the trouble of registering the general document separately.

The document learner 15 receives the vector of the converted document through the vector converter 23 and uses the SVM algorithm, the document that is closest to the limit plane (Hyper-Plane) and the limit plane that distinguishes a confidential document from a general document. A support vector, which is a vector of, is calculated and stored in the learning result database 17. The document learner 15 may be operated at a time when a document is collected more than a predetermined time by an administrator who manages the mail monitoring server 2 or automatically at a predetermined time.

The sniffer 19 sniffs outgoing emails and stores them in the email database 21. In this case, the sniffer 19 preferably monitors network communication packets on the network and extracts only packets corresponding to an e-mail, and TCP based sniffing and sniffer 19, which are simple wiretap forms, exist as logical gateways. It is most desirable to mix ARP-Based Sniffing in a way that is designed to minimize the change of network structure and the load of the network according to the company's network structure. The sniffer 19 can extract all emails sent using protocols such as SMTP, POP3, HTTP (including webmail). You can also extract attachments as well as the body of the email.

 The vector converter 23 stores a numeric code table corresponding to each word (not shown), extracts words from documents and emails stored in the document database 13 and the email database 21, and recalls each extracted word. The document is converted to a corresponding numeric code based on a numeric code table (not shown), and each document and an email are converted into a vector form that can be input to the SVM using the converted word.

The discriminator 27 compares the support vector calculated by the document learner 15 with the learning result of the SVM algorithm using the SVM algorithm and the e-mail converted into the vector form by the vector converter 23, respectively, into the vector form. It is determined whether the sniffed email is a confidential document, and the result value is stored in the discrimination result database 29. However, when different confidential documents and general documents are registered for each department, there may be various types of learning models that serve as a criterion for determining whether confidential documents are used. In this case, the discriminator 27 applies the sniffed e-mail to each learning model generated for each department, and if one of them is identified as a confidential document, the e-mail is identified as a confidential document.

On the other hand, the control unit 10 is a form that can be read into the SVM of the document learner 15 through the vector converter 23 by reading the classified documents and general documents stored in the document database 13 through the document register, as needed. By converting the document into a document learner 15, the learning result from the document learner 15 is stored in the learning result database 17 in the form of a file. At this time, the learning result is displayed as the limit vector for classifying classified documents and general documents calculated when using the SVM and a support vector which is the closest document.

In addition, the controller 10 may be sniffed through the sniffer 19 to convert the email stored in the email database 21 into a form that can be input to the SVM of the document learner 15 through the vector converter 23, and then the discriminator ( 27, while providing the limiter and the support vector stored in the learning result database 17 to the discriminator 27, the discriminator 27 analyzes whether the sniffed email is classified as a confidential document. .

The controller 10 monitors the confidential document of the e-mail transmitted by displaying the analysis result of the confidential document of the e-mail analyzed by the discriminator 27 and stored in the determination result database 29 to the user through the reporter 31. Do it.

The e-mail monitoring process using the e-mail monitoring system will now be described with reference to FIG. 3.

First, the words of confidential and general documents are extracted and converted into numeric codes corresponding to each word, and each document is converted into a vector form that can be input to the SVM using the words converted into numeric codes. The document which is a vector of the document which is closest to the limit plane (Hyper-Plane) and the limit plane that distinguishes the confidential document from the general document by using the SVM algorithm through the document learner (15) A support vector is calculated (S10), and the calculated support vector is stored and databased (S20).

The email sent to the outside of the group is sniffed by the sniffer 19 and stored in the email database 21 (S30). The sniffed email is converted into a corresponding numeric code of each word of the email through the vector converter 23, and the email is converted into a vector form that can be input to the SVM using the converted word of the numeric code (S40). The discriminator 27 compares the support vector calculated by the learning result of the SVM algorithm and the email converted into the vector form by the vector converter 23, respectively, and determines whether the email sniffed in the vector form is a confidential document (S50). . If the result of the analysis of the discriminator 27 is determined to be a confidential document, the result value is stored (S60). Otherwise, the result value determined as the normal document is stored (S70). The controller 10 operates the reporter 31 to show the result using various charts and the like (S80).

As described above, the present invention applies the SVM, which is a statistical learning theory, to automatically learn the concepts of general documents and confidential documents, and to sniff outgoing emails, based on pre-learned data on whether the sniffed emails are confidential documents. To judge.

As described above, according to the present invention, by automatically learning the concept of the general document and confidential documents, and by analyzing the e-mail sent based on the learning results, it is possible to effectively monitor the leakage of confidential documents in the group through the e-mail E-mail monitoring methods and systems can be provided.

1 is a configuration diagram of an email monitoring system according to the present invention;

2 is a detailed configuration diagram of the monitoring server of FIG.

3 is a flowchart illustrating an e-mail monitoring process by the e-mail monitoring system of FIG. 1.

* Explanation of symbols for the main parts of the drawings

 1: Internal corporate network 2: Email monitoring server

 3: employee terminal 5: mail server

10 control unit 11: document register

13: Document Database 15: Document Learner

17: Learning Document Database 19: Sniffer

21: Email Database 23: Vector Converter

25: vector database 27: discriminator

29: Discrimination result database 31: Reporter

Claims (7)

An email monitoring method for monitoring an email leaked from a predetermined group, Classifying a plurality of documents in the group into confidential documents and general documents according to security requirements; Extracting a word included in the document; Converting each of the extracted words into a predetermined value; Displaying the document in a vector form applicable to an SVM algorithm by using the word converted into the value; Learning the plurality of documents using the SVM algorithm to calculate a Hyper-Plane, which is a boundary that divides the confidential document and a general document, and a support vector, which is a vector of the document closest to the limit. Document learning step; Sniffing outgoing email within the population; Extracting words contained in the sniffed email document; Converting each of the extracted words into a predetermined value; Displaying the email in the form of a vector applicable to an SVM algorithm using the word converted into the value; And determining whether the sniffed e-mail is a confidential document by applying the support vector calculated in the learning result and the e-mail converted into the vector form to the SVM algorithm. The method of claim 1, wherein the converting to a form applicable to the SVM algorithm, Extracting words contained in the documents and emails; Converting each of the extracted words into a predetermined value; And displaying the document and the email in a vector form by using the word converted into the value. The method of claim 1, Analyzing whether the sniffed email is a confidential document and reporting the result. An email monitoring system for monitoring an email leaked from a certain group, A document database storing the plurality of documents in the group into classified documents and general documents according to security requirements; A sniffer sniffing outgoing emails within the population; An email database in which the sniffed email is stored; A vector converter for extracting a word included in the document database and the email database and converting the word into a vector form applicable to an SVM algorithm; A vector database storing the converted vector; A support vector which is a vector of a document that is closest to a limit plane (Hyper-Plane) and a limit plane that distinguishes a confidential document from a general document by using the SVM algorithm for the document from the document database of the vector form converted by the vector converter. A document learner for calculating (Support vector); A learning result database in which a limit plane and a support vector, which are learning results from the document learner, are stored; A discriminator for determining whether the sniffed e-mail is a confidential document by applying a support vector calculated by the document learner as a learning result of the SVM algorithm and an e-mail converted into a vector form by the vector converter; And a determination result database in which the result value determined from the discriminator is stored. The method of claim 4, wherein And a reporter for displaying a result of determining the confidential document of the email analyzed through the discriminator. The method of claim 1, Classifying the confidential document and the general document, Registering confidential documents for each of the plurality of departments; And registering a document classified as a confidential document by a department other than the corresponding department as a general document. The method of claim 6, The step of determining whether the confidential document, The sniffing of the confidential documents registered by the plurality of departments is applied to each of the sniffed emails by applying a support vector and an email converted into a vector form, and when the comparison result is determined to be a confidential document of at least one of the departments. E-mail monitoring method characterized in that the step of judging the e-mail as a confidential document.