KR101593910B1 - System for online monitering individual information and method of online monitering the same - Google Patents

Abstract

The present invention collects log files without limitation in various log formats, analyzes log files related to personal information or internal (confidential) information according to analysis criteria defined by the user for the collected log files, And an object of the present invention is to provide a system for monitoring personal information constantly and a method for monitoring the personal information constantly.
In order to achieve the above object, a personal information constant monitoring system according to the present invention comprises a log collection target server (100) for generating log files related to outflow of work related information and personal information; And a log collection control unit (210) for defining the log file generated by the log collection target server to be collected by an arbitrary collection method; and a log collection control unit A log collection unit 220 for collecting the log files generated by the server, an analysis criteria control unit 230 for analyzing the log files collected by the log collection unit 220 according to an arbitrary analysis standard, An analysis reference storage 240 for storing the log file analyzed according to the analysis criterion defined by the analysis reference control unit 230; A call-in determination control and storage unit 250 for generating and storing call-up data for the log file requiring a call, An analysis log processing unit 260 for processing the analyzed log file and the searched log data, and a log management unit 260 for storing a raw log, which is a log file that has not been analyzed for the log file collected by the log collecting unit 220 A raw log processing unit 280 for processing the raw logs stored in the raw log storage unit 270 and a log file processing unit 260 for processing the log files processed by the analysis log processing unit 260, And a screen display unit (290) for displaying the call log data and the raw log processed by the raw log processing unit (280).

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a personal information constant monitoring system,

[0001] The present invention relates to a system and method for continuously monitoring personal information, and more particularly, to a system and method for continuously monitoring personal information, , Etc.), regular monitoring of personal information abuse, and personal information constant monitoring method for preventing leakage of important data including personal information / main secret information (confidential information).

Recently, the importance of information security management for companies such as government agencies and large corporations handling personal information has become important. Therefore, by applying advance risk detection and personal information surveillance pattern rules for personal information and internal (confidential) information abuse, establishing a response system through preliminary detection and preliminary risk analysis, and by monitoring major risk indicators and thresholds, It is necessary to prevent such a problem.

Published Japanese Patent Application No. 10-2002-0012855 (Feb. 20, 2002) Patent Document 1: Japanese Patent Application Laid-Open No. 10-2010-0074559 (July 2, 2010)

Accordingly, the present invention collects log files without limitation on various log formats, analyzes log files related to personal information or internal (secret) information according to analysis criteria defined by the user for the collected log files, And an object of the present invention is to provide a system for monitoring personal information constantly and a method for monitoring the personal information constantly.

In order to achieve the above object, a personal information constant monitoring system according to the present invention comprises a log collection target server (100) for generating log files related to outflow of work related information and personal information; And a log collection control unit (210) for defining the log file generated by the log collection target server to be collected by an arbitrary collection method; and a log collection control unit A log collection unit 220 for collecting the log files generated by the server, an analysis criteria control unit 230 for analyzing the log files collected by the log collection unit 220 according to an arbitrary analysis standard, An analysis reference storage 240 for storing the log file analyzed according to the analysis criterion defined by the analysis reference control unit 230; A call-in determination control and storage unit 250 for generating and storing call-up data for the log file requiring a call, An analysis log processing unit 260 for processing the analyzed log file and the searched log data, and a log management unit 260 for storing a raw log, which is a log file that has not been analyzed for the log file collected by the log collecting unit 220 A raw log processing unit 280 for processing the raw logs stored in the raw log storage unit 270 and a log file processing unit 260 for processing the log files processed by the analysis log processing unit 260, And a screen display unit (290) for displaying the call log data and the raw log processed by the raw log processing unit (280).

In addition, the personal information constant monitoring system according to the present invention further includes a plurality of institutional linkage target servers (300) for generating log files related to outflow of work related information and personal information, .

In the personal information constant monitoring system according to the present invention, the raw log processing unit 280 searches a raw log stored in the raw log storing unit 270, and obtains a new analysis standard .

In the personal information constant monitoring system according to the present invention, the analysis log processing unit 260 processes the vocabulary data requiring vocabulary by the vocabulary determination control and storage unit 250, And performs statistics and report processing on the searched log file stored in the storage unit 240.

In the personal information constant monitoring system according to the present invention, the log collection control unit 210 may store the log files generated in the log collection target server in a batch mode, an agent mode, an agentless mode, The method being characterized in that it is defined to be collected by at least one of the collection methods.

In the case where the log file generated by the log collection target server 100 is DW (Data Warehouse) data, the log collection control unit 210 collects the DW data The SAM file is converted into a SAM file to prevent forgery and falsification and then stored.

In addition, the personal information constant monitoring system according to the present invention may be configured to minimize the occurrence of false positives of the log collector 220 when the PC environment of the log collection target server 100 is changed (use S / W change) And registers the exclusion file in the analysis reference control unit 230. [

In addition, in the personal information constant monitoring system according to the present invention, when the log collection unit collects a log file using the agent method, the log collection control unit 210 collects the agent execution time to prevent overload in the same time And the like.

Also, in the personal information constant monitoring system according to the present invention, the analysis reference control unit 230 initializes the collection of the log file when an error occurs during collection of the log file from the log collection unit 220 or rework is required .

In addition, a method for continuously monitoring personal information according to the present invention includes a first step (S100) of generating a log file related to an outflow of work related information and personal information in a log collection target server, A third step (S300) of collecting the log file in the log collecting unit by the defined collecting method, a third step (S300) of collecting the log file in the log collecting unit, A fourth step S400 of defining the log file as an analysis standard by the analysis reference control unit, a fifth step S500 of storing the log file analyzed according to the defined analysis standard in the analysis reference storage unit, A sixth step (S600) of searching for the stored log file and generating the vocabulary data for the log file requiring the vocabulary by the vocabulary determination control and storage unit; A seventh step (S700) of processing the analyzed log file and the searched name data stored in the analysis log processing unit (S700); and a seventh step (S700) of processing the log file and the vocabulary data processed by the analysis log processing unit (Step S800).

The personal information constant monitoring method according to the present invention further includes a step S400 'of storing, in the step S300, a raw log, which is a log file that has not been analyzed with respect to the collected log file, (S500 ') processing the stored original log in a raw log processing unit, and displaying the processed raw log on a screen display unit (S600').

In addition, the personal information constant monitoring method according to the present invention is characterized in that the personal information constant monitoring system further comprises a plurality of institutional linkage target servers for generating log files related to work related information and personal information.

In the personal information constant monitoring method according to the present invention, the raw log processing unit searches for a raw log stored in the raw log storing unit, and derives a virtual analysis standard for the retrieved raw log .

Further, in the personal information constant monitoring method according to the present invention, the analytical log processing unit may process the vocabulary data requiring vocabulary by the vocabulary determination control and storage unit, And performs statistics and report processing on the log file.

According to another aspect of the present invention, there is provided a method for continuously monitoring personal information, comprising the steps of: collecting log files generated by the log collection target server in a batch mode, an agent mode, and an agentless mode; And to be collected by one collection method.

When the log file generated by the log collection target server 100 is DW (Data Warehouse) data, the log collection control unit 210 collects the DW data The SAM file is converted into a SAM file to prevent forgery and falsification and then stored.

In addition, the personal information constant monitoring method according to the present invention is a method for minimizing false detection of the log collection unit 220 when the PC environment of the log collection target server 100 is changed (use S / W change) And registers the exclusion file in the analysis reference control unit 230. [

In the personal information constant monitoring method according to the present invention, when the log collection unit collects the log files by the agent method, the log collection control unit 210 stores the agent execution time in order to prevent overload in the same time period And the like.

In addition, in the personal information constant monitoring method according to the present invention, the analysis reference control unit 230 initializes the collection of the log file when an error occurs during collection of the log file from the log collection unit 220 or rework is required .

According to the present invention, after collecting log files without limitation in various log formats, the collected log files are analyzed and analyzed according to analysis standards defined by the user for convenience, such as personal information or logs related to internal (confidential) information, It has the effect of calculating the risk by analysis standard.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a configuration diagram showing the entire configuration of a personal information constantly monitoring system according to the present invention; FIG.
2 is a flowchart showing an overall flow of a personal information constant monitoring method according to the present invention.
FIG. 3 is a view showing a configuration in which a log related to the outflow of work related information and personal information is distributedly collected and stored in a log collecting unit in a log collecting server.
4 is a display screen that can be monitored through the personal information constant monitoring system according to the present invention.
5 is a threshold calculation screen for the number of daily work processes for personal information and important information per employee.
FIG. 6 is a screen for inputting a risk assessment criterion for detection of personal information abuse.
7 is a screen showing a risk analysis formula;
Figure 8 is an exemplary screen for qualitative analysis.
Figure 9 is an exemplary screen for quantitative analysis.
10 is a flowchart for explaining the flow of work in which a call is made by the call sign determination storage unit 250 in the personal information constant monitoring system according to the present invention.
11 is a view for explaining the defined excerpt criterion definition and related data.
12 is a screen for explaining a function that an administrator can manually request a user who is suspected of abuse, in addition to the automatic calling defined by the user.
13 is a screen for registering the call history.
FIG. 14 is a screen for explaining a primary judgment procedure for the entered calling name; FIG.
FIG. 15 is a screen for explaining a secondary determination procedure for the entered call list; FIG.
16 is a screen for performing a search for a raw log collected by a search engine of the present system.
FIG. 17 is a simulation screen capable of creating a new extraction condition based on a scenario / rule or performing a virtual analysis. FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Also, the terms " part, "" module," and the like, which are described in the specification, mean a unit for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram showing the entire configuration of the personal information monitoring system according to the present invention.

1, the personal information constantly monitoring system according to the present invention includes a log collection target server 100 for generating log files related to outflow of work related information and personal information, The log collection control unit 210 collects the log files generated by the log collection target server 100 according to the collection method defined by the log collection control unit 210 An analysis reference control unit 230 that analyzes the log files collected by the log collection unit 220 to analyze the log files by an arbitrary analysis standard, An analytical reference storage 240 for storing a log file analyzed by the analytical reference storage 240 and an analytical reference storage 240 for analyzing the analytical log file stored in the analytical reference storage 240, An analysis log processing unit 260 for analyzing the analyzed log files stored in the analysis reference storage unit 240 and the searched name data, A raw log storage unit 270 for storing a raw log, which is a log file that has not been analyzed for a log file collected by the log analyzer 220, and a raw log processing unit 270 for processing a raw log stored in the raw log storage unit 270 And a screen display unit 290 for displaying the log file processed by the analysis log processing unit 260, the call log data and the raw log processed by the raw log processing unit 280, ).

In addition, the personal information constant monitoring system may further include a plurality of institutional linkage target servers 300 that generate log files related to the outflow of work related information and personal information.

The raw log processing unit 280 may search the raw log stored in the raw log storage unit 270 and derive a new analysis standard for the retrieved raw logs.

The analysis log processing unit 260 processes the vocabulary data requiring vocabulary by the vocabulary determination control and storage unit 250 and performs statistics and report processing on the retrieved log files stored in the analysis reference storage unit can do.

In addition, the log collection control unit 210 may define that the log file generated by the log collection target server is collected by one of a batch method, an agent method, and an agentless method .

This will be described in more detail.

The log collection target server 100 is a server that stores business related information such as business systems or application logs of each public institution or large corporation, and logs related to the outflow of personal information. The logs thus collected are collected and stored in the log collection unit 220 using a distributed collection method. In this case, the method of collecting logs may be collected using an agent and agentless method in addition to the distributed collecting method, and the log related to the outflow of business related information and personal information collected by the collecting method may be filtered And stored in the log collecting unit 220 in a real-time or batch manner.

In addition, the log collection control unit 210 defines a method of collecting the log related to the outflow of the business related information and the personal information, and controls the log collecting unit 220 to collect the log. Of course, the present invention uses an arrangement method, an agent method, or an agentless method for ease of description, but is not limited thereto.

Next, the log stored in the log collecting unit 220 is defined to be analyzed on the basis of an arbitrary analysis standard by the analysis reference control unit 230, and a log file analyzed according to the analysis standard defined by the analysis standard control unit 230 And stored in the analysis reference storage unit 240.

In this way, the log-file stored in the analysis-reference storage unit 240 is searched for, and the log-name determination control and storage unit 250 generates log-in data for log files for which the user has used personal information. Thereafter, the analytical log processing unit 260 processes the analyzed log file stored in the analysis reference storage unit 240 and the vocation data requiring the vocation of the data stored in the analysis reference storage unit 240 .

In this manner, the log file and vocabulary data processed by the analysis log processing unit 260 are displayed on the screen display unit 290.

On the other hand, the raw log, which is a log file that has not been analyzed with respect to the log files collected by the log collecting unit 220, is stored in the raw log storage unit 270. As described above, the raw logs stored in the raw log storage unit 270 can be searched for the analysis and search of the raw logs by the AND / OR condition using the search engine of the present system.

The raw log processing unit 280 derives a virtual analysis criterion for the searched raw logs and displays them on the screen display unit 290.

Meanwhile, the log collecting unit 220 may store the log in an RDBMS or a no-sql manner according to a user's request and conditions.

If the log file generated by the log collection target server 100 is data warehouse (DW) data, the log collection control unit 210 collects the DW data and converts it into a SAM file to prevent forgery and store .

Here, DW (Data Warehouse) is an analytical database that can be easily accessed by users based on a large amount of data and can perform various analyzes. The Sequentil Access Method File is a sequential file that is directly compared with a file. In short, it refers to a file in which records are sequentially recorded.

In addition, when the PC environment of the log collection target server 100 is changed (use S / W change), an exclusion file for minimizing false detection of the log collection unit 220 is registered in the analysis standard control unit 230 desirable.

The log collection control unit 210 may control the agent execution time to prevent the same time period from being overloaded when the log collection unit collects log files by the agent method.

Meanwhile, it is preferable that the analysis reference control unit 230 initializes the collection of the log file when an error occurs in collecting the log file from the log collecting unit 220 or rework is required.

Next, FIG. 3 is a diagram illustrating a configuration in which logs related to the outflow of business-related information and personal information are logically collected and stored in the log collection unit 220 in the log collection target server 100. FIG.

3, the range of logs collected by the log collection unit 220 includes a user authentication log, a business system access log, a permission inquiry log, an administrator activity log, an API log, a teleweb / DRM access control, media access history, real time printer log, usage record for encrypted file, business log record, and so on.

These logs are collected in real time, and may be collected at specific times according to the user's request.

Meanwhile, the Teleweblog in FIG. 3 also compares the logs of the recordings of the consultation history, and collects in real time the analysis history of the personal information starting from the receipt of the customer's complaint.

In this system, you can convert DW medical institution, personnel information, eligibility details, and household details into SAM file by using batch system. And by using a specific collection program, , Payment log, user authentication log, DB access control, permission inquiry log, usage history of encrypted file, business log record management, and media access history can be collected in real time.

The logs thus collected are defined in the standard fields of the DB through the steps of normalization, filtering, and reduction, and are stored in the log collection unit 220. The normalization, filtering, and reduction are analyzed by referring to the DB defined by the user in the analysis reference control unit 230 and the DB in the agency linkage target server 300 and the personnel DB, which need to be linked.

The collected logs are stored in no-sql and can be stored in the standard 66 column of the RDBMS if necessary. Depending on the needs of the user, the standard fields may be changed organically. In addition, an RDBMS can use a commercial RDBMS and can be replaced with a free RDBMS in proportion to the daily log size. no-sql is a non-relational DB that does not require complex relationship definitions and can write different columns for each row, allowing you to organically expand and collapse fields other than the defined standard fields, You can save logs without.

The original log stored in the original log storage unit 270 is searched using a raw log analysis unit and a search engine of the raw log processing unit 280. The raw log processing unit 280 analyzes It is possible to facilitate the analysis and retrieval of the raw logs other than the information obtained.

After analyzing these logs, the raw log processing unit 280 can provide functions for pre-detection, detection for each extraction condition, and trend analysis and monitoring as shown in the dashboard of FIG.

4 is a display screen that can be monitored through the personal information constant monitoring system according to the present invention. The display screen can be freely changed by the user and the display screen can be changed organically according to the user's demand. Each analysis data on the display screen is displayed in real time, and the period can be set by user's definition.

Next, FIG. 5 is a threshold calculation screen for the number of daily work processes for personal information and important information for each employee. Enter the threshold calculation population data interval on the collection date. For example, if the acquisition range is 97%, the upper 1.5% and lower 1.5% data are excluded. This assumes that 1.5% of the top / bottom is abnormal and excludes 3% in order not to affect the overall average. Also, the error range is selected from 1 to 6 sigma. The error range can be used as a probabilistic analysis of the threshold setting. Based on the computed thresholds, an overstatement for thresholds can be extracted by employee or department.

FIG. 6 is a screen for inputting a risk assessment criterion for detection of personal information abuse. Risk assessment criteria may vary depending on system analysis / design results and requirements of the project team. The risk level of this system is composed of 5 steps which are the same as the national risk level. The analysis result of the collected logs is calculated by the method shown in FIG. 7 by applying the cavitation. After analyzing the collected logs according to the set extraction conditions, the system generates events necessary to calculate the risk, and the risk index of the generated event is added to the risk index of the corresponding employee to determine the risk per employee. According to the risk index for each employee, the risk level can be generated by department, group or region according to the risk analysis formula of FIG. We also assign risk weights at the critical stage in determining risk, weighting employees, departments, and total risks.

Next, FIGS. 8 and 9 are exemplary screens for qualitative and quantitative analysis. Referring to FIGS. 8 and 9, a trend analysis is performed using a trend analysis technique. The trend analysis is performed based on various information such as the number of work by each employee, department, and the number of detection conditions, and the result is displayed on the screen as shown in FIG. For example, the change in personal information / main information processing rate by employee and department, and the trend trend of the trend top 10 in the last 30 days are expressed in a time series graph. Drill down when clicking on an employee whose suspicion of information leakage is tracked. The analytical techniques used in the trend analysis are as follows.

In the above technique, the daily variation rate can be checked by applying the comparison time (2 days) to the reference time (30 days) of the variation rate of the number of business processes.

10 is a flowchart for explaining the flow of tasks in which a call is made by the call sign determination storage unit 250 in the personal information constantly monitoring system according to the present invention.

Referring to FIG. 10, a log file is collected (S1), and the log file is converted according to the details of the extract criteria defined in FIG.

Figure 11 is a diagram illustrating the defined excerpt criteria breakdown and related data.

Referring to FIG. 11, it is possible to search for personal information without any complaints, security weaknesses such as personal information / important information outsourcer or retirement / worker, and important information about monitoring registered information , The main data retrieval for downloading or browsing the registered main data, the upper output for the user to perform more output / browsing than the numerical value set by the user, the upper viewer, If the amount of daily work exceeds the threshold for the periodical transaction log by individual viewers, department, and specific screen viewers for the monitoring of numerical abnormality, the periodical transaction threshold for the event exceeding the threshold is analyzed and the behavior for 3 months from the date of occurrence is analyzed for 3 months A plurality of viewers, a plurality of viewers, a plurality of viewers, In addition to the extraction criteria, personal information / key information extracted by random numbers (probability) set by the user for browsing of main information / personal information, and personal information / important information outside the designated business hours during the period And out-of-office hours. These extraction scenarios can be obtained based on business logs and basic set values.

Next, FIG. 12 is a screen for explaining a function that an administrator can manually request a user who is suspected of abuse, in addition to the automatic calling defined by the user. When manual calling is requested by the step S5 of FIG. 10, the user registers the calling details on the screen as shown in FIG. 13, and when the registration is completed, the calling request is transmitted to the manager.

FIGS. 14 and 15 are explanatory diagrams for explaining the step-by-step determination procedure for the entered calling card.

When the user inputs a call, a determination request is transmitted to the primary determination device (S8). When the primary determination device completes the determination, the determination request (S9) is transmitted to the secondary determination device. If there is insufficient information about the call, the call can be processed again. If the call is to be re-called, the procedure returns to step S6.

Basically, the details of the calling are stored in the personal information / important information storing unit of the step S10, and the user can set the period or select the calling name to initialize the calling name.

In addition, an alarm may be delivered to the person to be called upon occurrence of a step set by the user through SMS, mail, messenger, etc. in the agency linkage server 300, and the history is automatically stored. If necessary, the alarm can be delivered at the time entered by the user.

Meanwhile, FIG. 16 is a search engine capable of searching the collected log itself, and is an engine based on a data model based on a Big Table column.

Unlike relational databases, it is based on NO-SQL that does not use SQL, and high-performance processing is possible for large-volume data transactions. Even when the capacity is expanded, the capacity can be expanded laterally without lowering the performance by adding a node. Also, the log stored in the log collecting unit 220 can be searched by any keyword without a specific query condition.

In addition, when there is a suspicion of further abuse among the logs stored in the log collecting unit 200, it is possible to newly generate an extraction condition based on a scenario / rule using the simulation function of FIG. 17 or to perform a virtual analysis.

Although the embodiments of the present invention have been described above, various modifications may be made by those skilled in the art. Therefore, it should be understood that the present invention should not be construed as being limited to the above embodiments, but should be construed in accordance with the following claims.

100: Log collection target server
200: log collection server
210: log collection control unit
220: log collecting unit
230: analysis reference control unit
240: Analysis reference storage unit
250: Calling judgment storage section
260: Analysis log processor
270: raw log storage unit
280: raw log processing unit
290:
300: Institutional link target server

Claims (19)

A log collection target server 100 for generating log files related to the outflow of work related information and personal information; And
A log collection control unit 210 for collecting the log files generated by the log collection target server by an arbitrary collection method,
A log collection unit 220 for collecting the log files generated by the log collection target server by the collection method defined by the log collection control unit 210,
An analysis reference control unit 230 for analyzing the log file collected by the log collecting unit 220 according to an arbitrary analysis criterion,
An analysis reference storage unit 240 for storing the log file analyzed by the analysis reference defined by the analysis reference control unit 230,
A momen- tarine determination control and storage unit 250 for searching the analyzed log file stored in the analysis reference storage unit 240 to generate and store mine data for the log file requiring mine,
An analysis log processing unit 260 for processing the analyzed log file and the searched name data stored in the analysis reference storage unit 240,
A raw log storage unit 270 for storing a raw log, which is a log file that has not been analyzed with respect to the log file collected by the log collecting unit 220,
A raw log processing unit 280 for processing the raw logs stored in the raw log storage unit 270,
A log collection server (290) having a screen display unit (290) for displaying the log file processed by the analysis log processing unit (260), the vocabulary data, and the raw log processed by the raw log processing unit 200);
, ≪ / RTI &
The raw log processing unit 280,
Searches a raw log stored in the raw log storage unit 270, derives a new analysis criterion for the retrieved raw logs,
The analysis log processing unit 260,
Processing the vocabulary data required to be called by the vocabulary determination control and storage unit 250 and performing statistics and report processing on the searched log file stored in the analysis reference storage unit 240,
After analyzing the collected logs according to the extraction conditions set by the analysis reference control unit 230, an event necessary for risk calculation is generated, and the risk index of the generated event is added to the risk index of the corresponding employee to determine the risk per employee And a risk index at a critical stage is weighted in determining a risk, and the risk of each employee, department, and total is calculated. The method according to claim 1,
The personal information constant monitoring system,
And a plurality of institutional linkage target servers (300) for generating log files related to the outflow of work related information and personal information. delete delete The method according to claim 1,
The log collection control unit 210 defines the log file generated by the log collection target server to be collected by at least one of a batch method, an agent method, and an agentless method. Personal information constant monitoring system. The method according to claim 1,
When the log file generated by the log collection target server 100 is data warehouse (DW) data, the log collection control unit 210 collects the DW data and converts the collected data into a SAM file, And then storing the personal information. The method according to claim 1,
When the PC environment of the log collection target server 100 is changed (use S / W change), an exclusion file for minimizing false detection of the log collection unit 220 is registered in the analysis standard control unit 230 Wherein the personal information monitoring system comprises: 6. The method of claim 5,
The log collection control unit 210 may control the agent execution time to prevent overload in the same time zone when the log collection unit collects the log file by the agent method. . The method according to claim 1,
Wherein the analysis reference control unit (230) initializes the collection of the log file when an error occurs during collection of the log file from the log collection unit (220) or rework is required. A first step S100 of generating a log file related to the outflow of work related information and personal information in the log collection server,
A second step S200 of defining an arbitrary collection method for the generated log file by the log collection control unit of the log collection server,
A third step (S300) of collecting the log file by the log collection unit by the defined collection method,
A fourth step (S400) of defining the collected log file as an analysis standard by the analysis reference control unit,
A fifth step S500 of storing the log file analyzed according to the defined analysis standard in the analysis reference storage,
A sixth step (S600) of searching for the stored log file and generating the vocabulary data for the log file requiring the vocabulary by the vocabulary determination control and storage unit;
A seventh step (S700) of processing the analyzed log file stored in the analysis reference storage unit and the searched name data searched by the analysis log processing unit;
And an eighth step (S800) of displaying the log file processed by the analysis log processing unit and the vocabulary data on a screen display unit,
In the third step S300,
(S400 ') of storing a raw log, which is a log file that has not been analyzed for the collected log files, in a raw log storage unit;
Processing the original log stored in the original log processing unit (S500 '),
(S600 ') displaying the processed raw log on a screen display unit,
The raw log processing unit,
A raw log stored in the raw log storage unit is searched, a virtual analysis standard is derived from the searched raw log,
The analysis log processing unit,
Processing the vocabulary data requiring vocabulary by the vocabulary determination control and storage unit and performing statistical and report processing on the searched log file stored in the analysis reference storage unit,
After analyzing the collected logs according to the extraction condition set by the analysis reference control unit, the system generates an event necessary for risk assessment, adds the risk index of the generated event to the risk index of the employee, Wherein the risk index at the critical stage is weighted to determine employee, department, and overall risk. delete 11. The method of claim 10,
Wherein the plurality of institutional linkage target servers generate a log file associated with task related information and personal information. delete delete 11. The method of claim 10,
Wherein the log collection control unit defines the log file generated by the log collection target server to be collected by at least one of a batch method, an agent method, and an agentless method. Information regular monitoring method. 11. The method of claim 10,
When the log file generated by the log collection target server 100 is data warehouse (DW) data, the log collection control unit 210 collects the DW data and converts the collected data into a SAM file, And then storing the personal information. 11. The method of claim 10,
When the PC environment of the log collection target server 100 is changed (use S / W change), an exclusion file for minimizing false detection of the log collection unit 220 is registered in the analysis standard control unit 230 Wherein the personal information is monitored continuously. 16. The method of claim 15,
The log collection control unit 210 may control the agent execution time to prevent overload in the same time zone when the log collection unit collects the log files by the agent method. . 11. The method of claim 10,
Wherein the analysis reference control unit (230) initializes the collection of the log file when an error occurs during collection of the log file from the log collection unit (220) or rework is required.

Images