KR20100120798A - Tracking trail apparatus for information security and method thereof - Google Patents

Abstract

PURPOSE: A device and a method for tracing evidence for information security are provided to collect integrated laos between heterogeneous kinds and utilize the integrated log according to the type and detects the leak of the information more accurately. CONSTITUTION: A log collecting unit(110) collects log information from a plurality of information collecting sources(101~103). A first log correlation analysis unit(120) mixes the collected log information of the log collection unit according to the case. The first log correlation analyzing unit draws a plurality of rules. A first regulation analyzing unit(130) determines a danger level index through inter-rule correlation analysis between regulation about a plurality of regulations of the first log correlation analysis unit. The danger level is an evidence of determination of information leakage.

Description

[0001] TRACKING TRAIL APPARATUS FOR INFORMATION SECURITY AND METHOD THEREOF [0002]

The present invention relates to a trace tracing apparatus and method for information security, and more particularly, it relates to a trace tracing apparatus and method for information security, and more particularly to a trace tracing apparatus and method for detecting information leakage from an internal network by monitoring abnormal activity of authorized users using log information, The present invention relates to a trace tracing device and method for information security.

Information leakage detection is intended to prevent internal information leakage by insiders, and various technologies such as e-DRM (enterprise digital rights management), media control solution, and mail monitoring have been proposed for the purpose of information leak detection . Here, the internal information of a company can be viewed as' all the information generated by users in the enterprise 'if it is interpreted broadly as a broad concept, and if it is interpreted more passively,' external information A document containing the character of a non-overtrade ".

However, with respect to the internal information in this sense, it is necessary to prevent the information leakage only for the media control solution or e-DRM for controlling and analyzing the information flow at the user terminal of the PC (personal computer) There is a limit to the extent to which information leakage detection can be performed only through a product family such as e-mail monitoring.

On the other hand, there is a conventional technology that integrates logs of various unit security products such as a media control solution product family, an e-DRM product family, a mail monitoring product family, and a database monitoring product family, and uses the integrated log for information leakage detection. However, the related art discloses information leakage by analyzing and presenting the violation of the condition simply in the integrated log, and implements the prevention of the recurrence prevention. This technology can be very different in performance depending on how effective the analysis method for detecting information leakage is, and it is not enough to achieve the desired level of performance.

In addition, most of the conventional integrated log analysis methods are systems (eg, firewalls, IDS, IPS, Secure OS, etc.) for collecting system logs or analyzing log information of security products for detecting intrusions from the outside. However, this type of integrated log analysis system has a limitation in that a system for collecting and analyzing log information about internal information is not constructed.

The technical problem to be solved by the present invention is to provide a trace tracing apparatus and method for information security which can collect information of various kinds of heterogeneous logs and classify them and classify them and use them more effectively and accurately.

Another technical problem to be solved by the present invention is to provide a trace tracing device for information security that monitors abnormal activity of users and collects relevant trace data when an abnormal symptom of the monitoring result is captured or information leakage is identified, And a method thereof.

The technical objects to be achieved by the present invention are not limited to the technical matters mentioned above, and other technical subjects which are not mentioned can be clearly understood by those skilled in the art from the following description. There will be.

A trail tracing apparatus for information security according to the present invention includes: a log collecting unit for collecting log information from a plurality of information collecting sources; A primary logarithmic correlation unit for deriving a plurality of rules by combining log information collected by the log collecting unit in each case; And a secondary rule correlation analyzing unit for determining a severity index as a basis for judging whether or not to leak the information through the inter-rule correlation analysis on the plurality of rules derived from the primary log correlation analyzing unit.

Meanwhile, a trace tracing method for information security according to the present invention includes: a log collecting step of collecting log information from a plurality of information collecting sources; A primary logarithmic correlation step of deriving a plurality of rules by combining log information collected from the plurality of information collecting sources on a case-by-case basis; And a secondary rule correlation analysis step of determining a severity index as a basis for judging whether or not to leak the information through inter-rule correlation analysis on the plurality of rules.

The apparatus and method for tracing information for security according to the present invention collects various kinds of integrated logs of different kinds and classifies them according to types, thereby making it possible to perform information leak detection more effectively and accurately.

In addition, the apparatus and method for tracing information for security according to the present invention can monitor abnormal activity of users and collect relevant tracing data when an abnormal symptom of a monitoring result is captured or an information leak is identified, .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and method for tracing a trace of information according to a preferred embodiment of the present invention will be described in detail with reference to FIGS. 1 to 3 attached hereto.

1 is a schematic block diagram of a trace tracing device for information security according to an embodiment of the present invention.

1, the trail tracking apparatus according to an exemplary embodiment of the present invention includes a log collecting unit 110, a primary log correlation analyzing unit 120, a personality classifying unit 140, (130).

The log collecting unit 110 collects log information from a plurality of information collecting sources (various unit security equipments) that can be interlocked. The trace tracing apparatus of FIG. 1 is for analyzing the government outflow from the inside, not from the outside. Therefore, the log collecting unit 110 collects log information related to outbound packets of heterogeneous outgoing packets from the internal network, rather than an audit log for inbound packets coming into the internal network through the Internet, As a collection target. As the information collection sources, there may be an internal information collection source 101, an internal / customer common collection source 102, and a customer information collection source 103.

Examples of information sources include e-DRM solutions, policy change management systems, human resource information systems (internal user information management systems), outflow auditing systems, customer information transmission management systems, media control solutions, Systems, virtual private networks (VPNs), antivirus solutions, and business rule engines. Each solution or system may be a product group developed by a management company, a manufacturer, a security company, etc., or may be a product group that is shared / standardized.

An example of log information collected from each security device is as follows.

e-DRM solution consists of e-DRM solution log (user e-DRM solution application log), administrator e-DRM solution log (administrator authorization log), security folder use log, e-DRM solution media use log, And an old e-DRM solution login information log.

The policy change management system provides a PC import / export approval log, a device control change approval log, an e-DRM solution approval log, and a network access control system anomaly approval log. The personnel information system provides a personnel information log (e.g., employee number, employee name, department code, affiliation), a department log (e.g., department code, department name, upper department code)

The outflow audit system includes an outflow audit system user information log, a reseller medium use log, a web access log, and an IP change attempt log. The customer information transmission management system provides an information transmission download log and a customer information destruction log.

The media control solution provides the media usage log and the e-mail monitoring system provides the information transmission log and the information transmission attachment log. The network access control system provides the authentication IP log and the integrity log.

The VPN provides information such as the VPN log, the antivirus solution provides information such as the virus log, the business rule engine provides the rule detection result log, and the rule detection result detailed log, respectively.

The primary log correlation analyzing unit 120 combines various kinds of log information of different kinds collected in the log collecting unit 110 according to each case to form a unit rule that is a criterion for analyzing information leakage or its symptoms. Respectively.

The second order regular correlation analyzing unit 130 determines a severity index as a basis for judging whether information leakage occurs by applying an inter-rule correlation analysis technique to a plurality of rules derived from the primary log correlation analyzing unit 120.

The second order regular correlation analyzing unit 130 may include a region-based rule classifying unit 131 and a region-based correlation analyzing unit 132 for applying a rule-based correlation analysis technique.

The region-by-region rule classifying unit 131 classifies a plurality of rules into regions and groups them. For example, the area rule classifying unit 131 can classify a plurality of rules into three types of areas: a security environment violation area, an information outflow area, and a manpower area.

The region-based correlation analyzing unit 132 determines a severity index through correlation analysis between the grouped rules in the region-specific rule classifying unit 131. [ Here, the severity index is calculated based on the number of detected rules, the area where the rules are detected, or whether a match is detected with a rule set of a predefined scenario based on the scenario, Can be determined according to the degree.

For example, if the same person is detected in two or more rules regardless of the region, the region-based correlation analyzing unit 132 may determine the severity 3, the severity of the same person is higher than the severity 3 in the security environment violation region and the information leakage region, 2, if the same person is detected in all three areas, it can be analyzed as a severity 1 with a higher level of correspondence than the severity 2.

The severity index is 3, 2, and 1, and the risk of information leakage increases, so the level of user response should be higher.

The second order regular correlation analyzing unit 130 may include a scenario registering unit 133 and a scenario based correlation analyzing unit 134 for applying a scenario-based correlation analysis technique. The scenario registering unit 133 predefines a scenario rule set that defines a severity index. The scenario-based correlation analyzing unit 134 analyzes the severity according to the detected scenario rule set when the execution of the scenario rule set defined in the scenario registering unit is detected.

The secondary rule correlation analyzing unit 130 applies the rule-based correlation analysis technique and the scenario-based correlation analysis technique alone or in an integrated manner to detect abnormal business patterns, abnormal symptoms, information leakage, etc. of authorized users in the internal network The severity index for discrimination can be analyzed.

For example, when the two schemes are integrally applied to analyze information leakage, the secondary rule correlation analyzing unit 130 classifies a plurality of rules derived through the primary log correlation analyzing unit 120 into regions After grouping, the correlation analysis method is used to analyze the severity index as the number of detected regions increases. In addition, if the detected rules are consistent with the rule group of the predefined scenario by applying the scenario-based correlation analysis technique, a higher severity index is applied than the case of the inter-rule correlation analysis technique.

This will be described in more detail as follows.

In order to analyze the information leakage severity through the inter-rule / scenario-based correlation analysis and to establish a policy according to the analysis result, the secondary rule correlation analyzing unit 130 analyzes the rules derived from the primary log correlation analyzing unit 120 Security environment violation area, information leakage area, and manpower area.

If two or more rule runs are detected regardless of the region, the severity index is set to be higher than one rule (inter-rule correlation analysis technique 1). When the rules of the security environment violation area and the information leakage area are detected, the severity index is higher than the 'inter-rule correlation analysis technique 1' (correlation analysis technique 2), and the security environment violation area and information leakage area, When the rule is detected in all the manpower domains, the severity index is higher than the 'inter-rule correlation analysis technique 2' (inter-rule correlation analysis technique 3).

Scenario-based correlation analysis technique is based on the information of the security solution (information source) operated in the internal network of the company, predefines scenarios in which information can be leaked by bypassing such security solution, Implement scenarios through a combination of rules so that relevant information can be detected. When rule execution is detected according to the technique, a higher severity index than the inter-rule correlation analysis technique 3 is set.

The personality-based rule classifying unit 140 interlocks with the primary log correlation analyzing unit 120 to detect a plurality of rules so that the information leakage countermeasure process can be performed according to the level of the risk level based on the detected unit rule Classify by personality according to spill response process. For example, the personality-based rule classifier 140 may classify a plurality of rules into an information leakage precautionary measure-related rule, an information leakage indication monitoring-related rule, and an information leakage detection-related rule. The personality-based rule classifier 140 may be omitted in some cases, and may be associated with the secondary rule correlation analyzer 130 in order to enhance the analysis result of the secondary rule correlation analyzer 130 with reference to the analysis result It can also be used.

FIG. 2 is a flowchart of a trace tracing method for information security according to an embodiment of the present invention, and FIGS. 3 to 5 are reference views for explaining some steps of FIG.

First, the trace tracing apparatus collects log information from a plurality of information collecting sources (S110). Here, the log information to be collected is information on outbound packets of different types flowing out from the internal network.

Next, the trail tracking device derives a plurality of rules by combining the collected heterogeneous log information for each case (S120).

Figure 3 is a diagram illustrating a process for deriving unit rules. For example, the trace tracing system divides the cases where information leakage is possible in the infrastructure environment into cases, and then combines (analyzes) the information collected from the information gathering source to derive rules that can satisfy each case. Through this process, as shown in the right table of FIG. 3, 46 kinds of unit rules can be derived from 'Case 1' to 'Case 46'.

Thereafter, the trace tracing device recognizes the risk level related to the information leakage by detecting whether or not the rule violation is based on the unit rule, and recognizes a plurality of rules (S130) in accordance with the information leakage process.

4 is a diagram illustrating an exemplary process of sorting a plurality of rules derived from the process of S120 by personality. The trace tracing device classifies the rules according to the information leakage response process in consideration of the analysis result by rule. For example, as shown in FIG. 4, the data detected by the rule derived in S120 are classified into three types according to the information leakage countermeasure process: information leakage precaution measure rules, information leak indication monitoring rules, and information leak detection rules Can be classified.

Here, the rule (for example, 16) for deriving the precautionary measure is a rule in which the collected audit log form can be judged as an outflow-related precautionary measure, and a rule (for example, 23) It is a rule with a sign that the log type is judged to be a leak. Rules for detecting information leakage (for example, seven) are rules for when, where, who, what, how, and why, in the event of an information leakage incident, by the six principles.

Such a classification result (rule unit detection history) is reflected in the user interface, thereby guiding the user in managing the information leakage handling process. For example, in FIG. 4, when the risk level is detected as 'up' due to violation of several rules other than 'unauthorized storage media user' among a certain defined number of rules, the trail tracking device detects 'information leak detection' And the corresponding analysis result is reflected in the user interface so that the user can respond.

In this way, the trace tracing device can detect the information leakage from the group to which the rule that derives the information that is likely to leak information is included when analyzing the information detected in the rule, or the basis Can be provided.

However, the step S130 is for determining the information leakage correspondence level based on the unit rule, and may be applied together with the inter-rule correlation analysis technique (S150) or the scenario-based correlation analysis technique (S160) .

Then, a plurality of rules are subjected to correlation analysis based on inter-rule / scenario-based correlation (S140), and a severity index as a basis for determining the information leakage is determined (S150, S160). Here, the inter-rule correlation analysis technique and the scenario-based correlation analysis technique may be implemented selectively or integrally according to the implementation method (S140).

The severity index is classified according to the degree to which the information leak symptom is judged to be reliable. Whether the number of detected rules, the area where the rules are detected, or the signature matching the rule set of the predefined scenario based on the scenario is detected And the like.

For example, each rule can be classified into three types of areas: a security environment violation area, an information leakage area, and a manpower area. If the same person is detected in two or more rules regardless of area, the tracing device will have severity level 3, if the same person is detected in security environment violation area and information leakage area, If all of them are detected in the type region, the severity 1 can be analyzed to have a higher level of correspondence than the severity 2 (S150). Alternatively, if the user is detected by a rule set of a predefined scenario regardless of the area, the severity may be analyzed according to the detected scenario (S160).

Specifically, the trail tracking apparatus classifies a plurality of rules derived in S120 into regions, groups them (S151), and determines a severity index through correlation analysis between the grouped rules (S152 to S156). Or a set of rules satisfying a specific scenario among a plurality of rules is defined (S161). If a series of analysis rules satisfying the scenario is detected (S162), the corresponding severity index is reflected in the user interface as an analysis result (S163).

FIG. 5 is a diagram illustrating a secondary severity analysis process, illustrating the process of establishing a detection policy according to information leakage severity through inter-rule correlation analysis (or scenario-based correlation analysis).

In FIG. 5, the trail tracking apparatus classifies a plurality of rules into regions, groups them, and analyzes the severity index as the number of regions in which rules detected by applying correlation analysis between rules is larger. In addition, when the rules detected by applying the scenario-based correlation analysis method are consistent with the rule group of the predefined scenario, a higher severity index is applied than the inter-rule correlation analysis method.

At this stage, the trail tracking apparatus can establish a more accurate and reliable information leakage scenario-based detection policy through correlation analysis among the 46 kinds of analysis rules derived in step S120.

First, a region classification scheme is established with respect to the 46 kinds of analysis rules derived through the primary log correlation analysis process in step S120, and then region rule grouping is performed (S151).

For example, among the 46 kinds of analysis rules, a rule for deriving a violation of the PC security environment is derived and grouped into a security environment violation area. An information leakage area is set by deriving and grouping rules for deriving security violation items in an environment in which information is moved from a local PC to another insider PC or an external PC among 46 kinds of analysis rules . Likewise, the manpower domain is set by deriving and grouping the rules for finding the manpower to be specifically managed and monitored, targeting all users who are likely to leak information out of the 46 kinds of analysis rules.

Here, the rules (for example, 18) of the security environment violation area are rules that determine that the user has performed an operation violating the security policy of the company while using the PC. For example, there may be cases where essential security software is not installed, unauthorized external storage is used, a PC is unauthorized and used outside. The rules (for example, 19) of the information leakage area are rules that determine that the user has performed an information leakage operation through various media (USB, CD-RW, etc.) and paths (e-mail, instant messenger, etc.). For example, when the number of output of important documents exceeds the threshold value, there may be a case where the internal / external time excess capacity, external transmission of attachments, or downloading of critical files exceeds a threshold value. The rules of the manpower domain (eg, nine) may include interested personnel-related rules such as outsourcers, retirees, and core research personnel.

Then, the severity index is determined through correlation analysis between the grouped rules (S152 to S157). For example, in FIG. 5, the severity index is classified as severity 3, severity 2, severity 1, and scenario-based severity 1.

If the same person is detected in two or more rules among 46 kinds of rules (S156), the analysis result becomes severity 3 (S157). 'Severity 3' is the case where the same person is detected in two or more rules regardless of the area, and such user should be selected as the user to be centrally managed and continuously monitored.

If the same person is detected in two areas (S154), for example, if the person detected in the rule belonging to the security environment violation area is also detected in the rule belonging to the information leakage area, the analysis result becomes severity 2 (S155). In this case, 'Severity 2' is a case where the same person is detected in a rule belonging to a security environment violation area and is also detected in a rule belonging to an information leakage area. Such a user should be selected as a user for concentration management, Procedures should be verified to verify that internal information is included.

If the same person is detected in all three areas (S152), for example, if a person detected in a rule belonging to a security environment violation area is also detected in a rule belonging to an information leakage area, and a rule belonging to a manpower area is also detected, Becomes a severity 1 (S153). 'Severity 1' indicates that the same person is detected in both the security violation area, information leakage area, and manpower area. This indicates that the information leakage is attempted as a violation of all areas, And forensic analysis through forensics (Forensics).

When a scenario-based detection is performed (S162), for example, detection is performed by a rule set corresponding to a scenario created considering the case where actual information leakage is possible in a rule belonging to each of security environment violation area, information leakage area, and manpower area , The analysis result becomes the scenario-based severity 1 (S163). 'Scenario-based severity 1' is a case where scenario-based rules are detected as a combination of rules belonging to three areas so that information can be leaked in real business environment and information leaked to the scenario is detected. This indicates the degree of confidence that information leakage has been attempted, and provides a basis for conducting precision work analysis through forensics and the like.

The tracer tracking device can then be used as a forensic basis by specifying the reason for the detection based on the detection result for the rule / scenario. Detection by rules / scenarios is ultimately a violation of the policy, and by checking the details of the policy violation, it can be judged whether or not the information is leaked. In addition, when a rule / scenario is detected, the concept of period can be applied to provide a traceability data to determine whether the information is leaked or not by confirming the information leakage related to a previous or another system.

According to the preferred embodiment of the present invention described above, the following effects can be expected.

First, it is possible to reinforce the prevention of recurrence through accurate cause analysis in the event of a security incident. Specifically, it is possible to secure the possibility of misbehavior by ensuring the traceability of security incidents by carrying out accurate analysis activities on the cause of the accident, the cause of the accident, and the outflow route based on the Sixth Principles. Also, based on this, it is possible to reduce the frequency of information leakage accidents by preventing the recurrence by performing post-measures activities so that the same information leakage accident does not recur, and by utilizing it as a basis for establishing new policies / patterns for information gathering sources.

Second, it can strengthen the monitoring of work patterns on outsourcing security personnel. In other words, it is possible to monitor the performance of the security workforce, which may become a loophole in security, and to enhance the security consciousness for monitoring enhancement.

Third, it is possible to identify the information leakage path and the responsible person by judging and presenting information leakage based on the trace.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand.

Therefore, it should be understood that the above-described embodiments are provided so that those skilled in the art can fully understand the scope of the present invention. Therefore, it should be understood that the embodiments are to be considered in all respects as illustrative and not restrictive, The invention is only defined by the scope of the claims.

The present invention is useful for information leak detection and integrated log analysis.

According to the trace tracing device and method for information security of the present invention, various integrated logs of different kinds are collected and classified according to types and utilized, so that information leakage can be detected more efficiently, abnormal activities of users are monitored, Or information leakage can be identified, the relevant evidence can be gathered to provide an accurate basis.

1 is a schematic block diagram of a trace tracing device for information security according to an embodiment of the present invention.

2 is a flowchart of a trace tracing method for information security according to an embodiment of the present invention.

Figs. 3 to 5 are reference views for explaining some steps of Fig. 2. Fig.

Description of the Related Art [0002]

110: log collecting unit 120: primary log correlation analyzing unit

130: Second order regular correlation analyzing unit 140: Character classification rule unit

Claims (20)

A log collecting unit collecting log information from a plurality of information collecting sources; A primary logarithmic correlation unit for deriving a plurality of rules by combining log information collected by the log collecting unit in each case; And And a second order correlation analyzing unit for determining a severity index as a basis for judging whether or not to leak the information through the inter-rule correlation analysis on the plurality of rules derived from the primary log correlation analyzing unit. Device. 2. The apparatus according to claim 1, The plurality of rules are classified and grouped according to the regions, and then the severity index is analyzed as the number of regions in which the rules to be detected by applying the inter-rule correlation analysis technique is high, and the detected rules Is applied to a rule group of a predefined scenario, a higher severity index is applied than in the case of the inter-rule correlation analysis technique. 2. The apparatus according to claim 1, A rule classifying unit for classifying the plurality of rules into regions and grouping the rules; And And a region-based correlation analyzer for determining a severity index through correlation analysis between the rules grouped in the region-specific rule classifier. 4. The apparatus of claim 3, wherein the region- Based on the number of detected rules, or the region where the rules are detected, or whether a match is detected with a rule set of a predefined scenario based on the scenario, the severity index Wherein the trace tracing device comprises: 4. The apparatus according to claim 3, Wherein the plurality of rules are classified into one of three types of areas: a security environment violation area, an information outflow area, and a manpower area. 6. The apparatus of claim 5, wherein the region- If the same person is detected in two or more rules regardless of area, Severity 3, if the same person is detected in the security environment violation area and information leakage area, the severity level 2 is higher than the severity level 3, and the same person is detected in all three areas And a severity 1 with a higher level of correspondence than the severity 2. 2. The apparatus according to claim 1, A scenario registration unit that defines in advance a scenario rule set defining a severity index; And And a scenario-based correlation analyzer for analyzing the severity according to the scenario rule set when the execution of the scenario rule set defined in the scenario registration unit is detected. The method according to claim 1, A plurality of rules are classified by personality according to the information leakage countermeasure process so that an information leakage countermeasure process can be performed according to the level of the risk level based on the detected unit rule in conjunction with the primary log correlation analysis unit And further comprising a separate rule classification unit. The method according to claim 8, Wherein the plurality of rules are classified into one of a rule relating to an information leakage prevention measure, a rule relating to information leakage indication monitoring, and an information leakage detection related rule. The apparatus of claim 1, And the log information about heterogeneous outbound packets flowing from the internal network is collected. A log collecting step of collecting log information from a plurality of information collecting sources; A primary logarithmic correlation step of deriving a plurality of rules by combining log information collected from the plurality of information collecting sources on a case-by-case basis; And And a secondary rule correlation analysis step of determining a severity index as a basis for judging whether or not to leak the information through inter-rule correlation analysis on the plurality of rules. 12. The method of claim 11, wherein in the second order correlation analysis step, The plurality of rules are classified and grouped according to the regions, and then the severity index is analyzed as the number of regions in which the rules to be detected by applying the inter-rule correlation analysis technique is high, and the detected rules Is applied to a rule group of a predefined scenario, a higher severity index is applied than the case of the inter-rule correlation analysis technique. 12. The method of claim 11, wherein in the second order correlation analysis step, Wherein the plurality of rules are grouped according to areas, and the severity index is determined through correlation analysis between the grouped rules. 14. The method of claim 13, The severity index is classified according to the degree to which the information leakage symptom is judged to be reliable. The number of detected rules or the area where the rules are detected, or a trace matching with a rule set of a predefined scenario based on the scenario is detected Wherein the method comprises the steps of: 15. The method of claim 14, Wherein the plurality of rules are classified into one of three kinds of areas: a security environment violation area, an information outflow area, and a manpower area. 16. The method of claim 15, If the same person is detected in two or more rules regardless of area, Severity 3, if the same person is detected in the security environment violation area and information leakage area, the severity level 2 is higher than the severity level 3, and the same person is detected in all three areas And a severity of 1 is higher than a severity of 2. 13. The method of claim 12, Wherein the severity is analyzed according to the detected scenario if the user is detected by a rule set of a predefined scenario regardless of the area. 13. The method of claim 12, wherein after the primary log correlation analysis step, Further comprising classifying the plurality of rules by their nature in accordance with the information leakage countermeasure process so that the information leakage countermeasure process can be performed according to the level of the risk level based on the detected unit rule, Way. 19. The method of claim 18, Wherein the plurality of rules are classified into one of a rule relating to an information leakage precautionary measure, an information leakage indication monitoring rule, and an information leakage detection related rule. 13. The method according to claim 12, wherein, in the log collecting step, Wherein the log information to be collected is information on heterogeneous outbound packets flowing out from the internal network.

Images