KR20110119988A - Apparatus and method for preventing leakage of secret data - Google Patents

Abstract

PURPOSE: A confidential information leakage prevention apparatus and method thereof using the specific information of confidential information are provided to improve the efficiency and reliability of determination by blocking the leakage of confidential information. CONSTITUTION: A storage unit(110) stores confidential information and the information of insiders. An education unit(120) creates an education result according to a security level based on a specific information by extracting the specific information form the confidential information. A sensing unit(130) senses a deduction attempt information in an inner network. When the deduction attempt is sensed, a determination unit(140) determines the security level of the deduction attempt information using the education result. A control unit(150) blocks or accepts the deduction attempt information by comparing the security level of the insiders with the security level of the deduction attempt information.

Description

Apparatus and Method for preventing leakage of secret data}

The present invention relates to prevention of confidential information leakage, and more particularly, to an apparatus and method for preventing leakage of confidential information on information carried out by an insider.

Recently, the damages caused by the leakage of internal confidential information from companies and public institutions have increased significantly. Confidential information can be leaked by outsiders or insiders. The leakage of confidential information by outsiders is made by copying files or data or reading information by illegally invading the server or database where data is stored through the network from outside. For example, confidential information has been leaked through FTP, Webhard, TELNET, hacking tools, viruses, and administrator ID theft.

On the other hand, the leakage of confidential information by insiders is leaked by deliberately or inadvertently handling confidential information by internal information creators, managers and other insiders. For example, confidential information may be leaked by an insider through file copying, file transfer, and file printing.

Conventional confidential information leakage prevention technology was mainly related to the prevention of confidential information leakage against outsiders' illegal intrusion. However, the leakage of confidential information is significantly higher than that of outsiders. In addition, the damages caused by the leakage of confidential information were found to be greater by the insiders than by the outsiders. Accordingly, in recent years, research on data loss prevention (DLP) by insiders has been conducted.

It is a method to prevent the leakage of confidential information by insiders, which restricts / blocks access to confidential information, encrypts data or files, monitors when data or files are leaked to the outside, monitors them, and copies or transmits them. It is a method to cut off, destroy / remove storage devices, and control the import and export of portable electronic devices. Such methods can prevent the leakage of confidential information, but there is a problem that the general data that is allowed to be exported outside is controlled or blocked. Therefore, in the case of companies and public institutions that frequently transmit and receive data with the outside, work efficiency may be significantly reduced.

The present invention provides an apparatus and a method for preventing the leakage of confidential information, which blocks internal confidential information from being leaked to the outside, and allows general data which is not confidential information to be exported to the outside.

The present invention also provides an apparatus and method for preventing leakage of confidential information with improved efficiency and reliability in determining whether confidential information is carried out.

According to an aspect of the present invention, a confidential information leakage prevention apparatus is disclosed.

An apparatus for preventing the leakage of confidential information according to an embodiment of the present invention includes a storage unit for storing confidential information and internal personnel information for each security level, extracting feature information from the confidential information, and learning results for each security level using the feature information. A learning unit for generating a; a detection unit for detecting an attempt to export information from an internal network to the outside; a determination unit for determining a security level of the export attempt information using the learning result when the export attempt is detected; And a control unit for allowing or blocking the export attempt information by comparing the security level of the security personnel with the security level of the internal personnel, wherein the learning unit includes a plurality of learning modules, and the determining unit corresponds to the plurality of learning modules. It includes a number of classification modules.

According to another aspect of the present invention, a method of preventing a leak of confidential information by an apparatus for preventing leakage of confidential information in an internal network is disclosed.

In the method for preventing the leakage of confidential information according to an embodiment of the present invention, the method includes: storing confidential information and internal personnel information having a security level set, extracting feature information from the confidential information, and learning results for each security level by using the feature information. Generating a step, detecting an attempt to export information from the internal network to the outside, determining a security level of the export attempt information using the learning result, and a security level of the export attempt information and a security level of the internal personnel. Comprising a comparison step including allowing or blocking the export of the export attempt information, the confidential information leakage prevention device includes a plurality of learning modules and a plurality of classification modules corresponding to the plurality of learning modules.

The present invention not only prevents confidential information from being leaked to the outside, but general data that is not confidential information can be exported to the outside.

In addition, the present invention can improve the efficiency and reliability with respect to the determination of whether confidential information of the exported information.

1 is a configuration diagram schematically illustrating a configuration of an internal network for preventing the leakage of confidential information.
2 is a configuration diagram schematically illustrating a configuration of an apparatus for preventing leakage of confidential information.
3 is a flowchart illustrating a procedure of calculating a learning result by a device for preventing leakage of confidential information;
4 is a flowchart illustrating a procedure of determining, by the apparatus for preventing the leakage of confidential information, the security level of the export attempt information;
5 is a flowchart illustrating a method of preventing the leakage of confidential information performed by the apparatus for preventing the leakage of confidential information.

The present invention may be variously modified and have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals used in the description of the present invention are merely an identifier for distinguishing one component from another.

In addition, in the present specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that, unless there is an opposite substrate, it may be connected or connected via another component in the middle.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, the same reference numerals will be used for the same means regardless of the reference numerals in order to facilitate the overall understanding.

1 is a configuration diagram schematically illustrating a configuration of an internal network for preventing the leakage of confidential information. The internal network may be an internal network of companies and public institutions.

Referring to FIG. 1, the internal network includes an apparatus 100 for preventing leakage of confidential information and a plurality of terminals 200.

The plurality of terminals 200 are terminal devices connected to the confidential information leakage prevention apparatus 100 through a internal network in a wired or wireless manner, and may be PCs, laptops, or the like. The internal personnel may take out the internal information to the outside using the terminal 200. For example, the internal personnel may export the internal information to the outside by transmitting the file to an external network, copying the file using a mobile storage device, or printing the file using an office device such as a printer.

When the confidential information leakage prevention apparatus 100 detects an attempt to export information through the terminal 200, the confidential information leakage prevention apparatus 100 permits or blocks the export based on the presence or absence of confidential information.

The confidential information leakage prevention apparatus 100 includes a database storing confidential information and internal personnel information. Here, the security information and internal personnel may be set in advance a security level, the confidential information and internal personnel information may be stored in a database for each security level. The security level may be set by an internal security committee or security officer.

The confidential information leakage prevention apparatus 100 extracts feature information from graded confidential information and calculates a learning result using the feature information. In this case, the confidential information leakage prevention apparatus 100 may include a plurality of learning modules to calculate a learning result according to each learning module. Each learning module is a module that calculates a learning result according to a unique learning algorithm, and various learning algorithms may be applied.

When the confidential information leakage prevention apparatus 100 detects an attempt to export information by the terminal 200, the confidential information leakage prevention device 100 determines a security level of the export attempt information and allows or blocks the export attempt information according to the determined security level.

In more detail, the confidential information leakage prevention apparatus 100 extracts feature information from the export attempt information. Here, the confidential information leakage prevention apparatus 100 includes a plurality of classification modules corresponding to the plurality of learning modules. Thus, each classification module may calculate a classification result for determining the security level of the export attempt information by comparing the extracted feature information and the learning result. Here, the classification result may be a level (eg, the number of times a keyword is matched, a ratio, etc.) in which export attempt information is matched for each security level. In addition, classification results calculated by each classification module may be different from each other. In addition, the confidential information leakage prevention apparatus 100 determines the security level for the corresponding information by combining the classification results calculated by each classification module. Thereafter, the confidential information leakage prevention apparatus 100 may allow or block the carrying out of the export attempt information by comparing the determined security level with the security level of the internal personnel. For example, if the security level of the internal personnel is greater than or equal to the determined security level of the export attempt information, the confidential information leakage prevention apparatus 100 may allow the export.

The confidential information leakage prevention apparatus 100 will be described later in detail with reference to FIG. 2.

2 is a configuration diagram schematically illustrating a configuration of an apparatus for preventing leakage of confidential information.

Referring to FIG. 2, the apparatus 100 for preventing leakage of confidential information includes a storage 110, a learner 120, a detector 130, a determiner 140, and a controller 150.

The storage unit 110 stores confidential information and internal personnel information. The security committee or the security officer may set a security level for confidential information and internal personnel, and the storage 110 may store confidential information and internal personnel information for each security level.

In addition, the storage unit 110 stores the learning results generated by the learning unit 120 for each learning module.

The learning unit 120 extracts feature information from confidential information for each security level and generates a learning result for each of a plurality of learning modules using the feature information.

The learning unit 120 includes a learning information extracting unit 121 and a learning result generating unit 123.

The learning information extracting unit 121 extracts feature information for each security level from confidential information for each security level.

For example, the learning information extracting unit 121 extracts a keyword or multimedia (image, voice, video, etc.) that can accurately reflect the characteristics of the confidential information through normalization of converting the confidential information into mechanical processing. In this case, the normalization may include removing special characters and tags, converting Chinese characters to Hangul, and extracting characters from an image. Keywords can be nouns included in confidential information, and words common to many documents can be excluded. For example, stopwords can be conjunctions, pronouns, articles, and verbs.

The learning result generator 123 includes a plurality of learning modules, and each learning module generates a learning result for confidential information for each security level by using feature information extracted according to a set learning algorithm. Each learning module stores the generated learning result in the storage 110. In this case, the storage 110 may store a learning result for confidential information for each security level for each learning module.

Here, the learning module may be applied to algorithms such as a Baysian filter, a neural network, a K nearest neighbor algorithm, and the like.

Hereinafter, the learning result generator 123 will be described as an example including the A learning module to which the Bayesian filter is applied, the B learning module to which the neural network is applied, and the C learning module to which the K proximity algorithm is applied. In the following description, a learning module to which a Bayesian filter is applied will be described.

The Bayesian filter applies the mathematician Thomas Bayes' theorem to text classifications, storing all occurrences of individual words in a particular text, continuing to add similar classification text as sample data, and then placing any text into that classification. An algorithm that can be used to determine whether it belongs.

The learning module A calculates information statistics on feature information extracted by the learning information extracting unit 121. Here, it is assumed that the learning module A uses keywords as feature information and calculates chi square statistics (X ² statistics) as information statistics.

The chi-square statistic measures the dependency of the keyword (t) and the category (c) and can be calculated using Equation 1 below.

[Equation 1]

Where A is the number of documents with keyword t among documents in category c, B is the number of documents with keyword t among documents that are not category c, and C does not include keyword t among documents in category c. The number of documents, D is the number of documents that do not include the keyword t among documents that are not in category c, and N is the total number of learning documents.

For example, suppose that category c is Grade 1 and Grade 2, and 50 classes of Grade 1 and Grade 2 confidential information are learned, respectively. In addition, assuming that keyword t is transcoding and A = 20, B = 1, C = 30, and D = 49, the chi-square statistic may be calculated as follows.

The chi square statistics calculated as described above may be summarized as shown in Table 1 below. That is, the learning module A may generate a learning result as shown in Table 1, and stores the generated learning result in the storage unit 110.

Grade 1 Grade 2 X ² (Transcoded, Class 1) = 21.76
X ² (Content, Grade 1) = 15.00
X ² (network, class 1) = 12.00
X ² (Realtime, Grade 1) = 10.00
X ² (Transmission, Class 1) = 8.00
…
X ² (Device, Class 1) = 1.01 X ² (benzene, class 2) = 25.00
X ² (Base, Grade 2) = 20.00
X ² (Composition, Grade 2) = 15.00
X ² (Cell, Grade 2) = 10.00
X ² (Catalyst, Grade 2) = 5.00
…
X ² (Material, Class 2) = 1.50

In addition, each learning module (B learning module, C learning module, etc.) performs a corresponding learning algorithm to calculate information statistics on feature information, such as A learning module, and stores the learning results in which the calculated information statistics are summarized. Save to 110.

For example, the learning result generated by the learning result generator 123 and stored in the storage 110 may be represented as shown in Table 2 below.

A Learning Module B Learning Module C Learning Module Grade 1
Keywords: transcoding (21.76), content (15.00)…
Image: XXXX
Grade 2
Keywords: benzene (25.00), base (20.00)…
Image: YYYYY
…

n grade
keyword: …
image: … … …

The detector 130 detects an attempt to carry out from the internal network to the outside. That is, the sensing unit 130 may detect an attempt to export information by the terminal 200.

For example, the export attempt by the terminal 200 may include a file transfer, a file copy, a file print, and the like. The detector 130 may copy the file to the mobile storage device by the terminal 200 or detect that the file is transmitted to the external network.

When the determination unit 140 detects an export attempt by the detection unit 130, the determination unit 140 determines a security level of information (hereinafter, export attempt information) that attempts to export.

The determination unit 140 includes a classification information extraction unit 141, a classification result generation unit 143, and a rating determination unit 145.

The classification information extracting unit 141 extracts feature information from the export attempt information. The classification information extracting unit 141 may perform the same operation as the learning information extracting unit 121 described above.

For example, the classification information extracting unit 141 may extract keywords or multimedia by normalizing export attempt information.

The classification result generator 143 includes a plurality of classification modules corresponding to the plurality of learning modules, and each classification module compares the characteristic information of the export attempt information extracted by the classification information extraction unit 141 with the learning results. . Accordingly, each classification module may calculate a classification result for determining the security level of the export attempt information. Here, the classification result may be a level (eg, the number of times a keyword is matched, a ratio, etc.) in which export attempt information is matched for each security level. In addition, classification results calculated by each classification module may be different from each other.

Hereinafter, an example will be described based on the A classification module corresponding to the A learning module to which the Bayesian filter is applied among the plurality of classification modules.

Like the learning module A, the A classification module may calculate information statistics on keywords extracted from the export attempt information. In addition, the A classification module compares the extracted keyword with the learning results calculated by the A learning module. That is, the A classification module checks whether a keyword matching the keyword of the export attempt information exists among the keywords of the learning result and calculates the result.

For example, the information statistics calculated for the keywords extracted by the classification module A from the export attempt information may be represented as shown in Table 3 below. Here, the A classification module may calculate the chi square statistics as the information statistics like the A learning module.

keyword Information statistics Device 30 Technology 20 system 10 … … send 5 communications network 3 catalyst 3 contents 2 … …

The A classification module compares the keywords of export attempt information (Table 3) with the learning results generated by the A learning module (Table 1). That is, the classification module A compares the keywords of Table 3 and the keywords of Table 1 and checks whether a matching keyword exists.

For example, when comparing Table 1 and Table 2, there are transmissions, networks, and contents in the keyword matching the first class, and catalyst in the keyword matching the second class. Here, it is assumed that the keyword whose information statistics are below a certain level (for example, 2) is excluded. That is, the device that is a keyword matching the first grade may be excluded because the information statistics is 1.01.

For example, the classification result calculated by checking whether a matching keyword exists in a classification module A may be represented as shown in Table 4 below. Here, the classification result is represented using Boolean weighting.

1 rating keyword Transcoding contents communications network real time send Information statistics 21.76 15.00 12.00 10.00 8.00 Binary weights 0 One One 0 One 2 ratings keyword benzene base Composition cell catalyst Information statistics 25.00 20.00 15.00 10.00 5.00 Binary weights 0 0 0 0 One

As shown in Table 4, the classification A group can calculate the classification result to determine the security level for the export attempt information. In addition, the classification module A may calculate a matching ratio of the export attempt information for each security level using the classification result.

For example, if the binary weights of Table 4 are simply compared, the matching ratio between the first and second grades may be 3: 1. In addition, when the binary weights and the information statistics are considered and the respective binary weights are multiplied by the information statistics to calculate the ratio, the matching ratio between the first and second grades may be (15 + 12 + 8): 5 = 35: 5. .

The rating determiner 145 determines the security level of the export attempt information by using the classification result generated by the classification result generator 143. That is, the rating determiner 145 determines the security level of the export attempt information by combining the classification results calculated by each classification module.

For example, the matching ratio of the export attempt information calculated for each security level by each classification module may be expressed as shown in Table 5 below.

A classification module B classification module C classification module Grade 1 70% 50% 40% Grade 2 20% 30% 30% Grade 3 10% 20% 30%

For example, the class determining unit 145 calculates a security level having a high matching ratio with export attempt information in each classification module as a decision level of the corresponding classification module as a binary decision method, and by each classification module. The largest number of decision levels among the calculated decision levels may be determined as the security level of the export attempt information. That is, referring to Table 5, the A classification module, the B classification module, and the C classification module indicate that the first grade is the highest matching ratio. Accordingly, the grade determination unit 145 may determine the export attempt information as the first grade.

For example, the rating determiner 145 may add the matching ratio for each grade calculated by each classification module, and compare the sum of the matching rates for each grade to determine the grade having the highest value as the grade of the export attempt information. have. That is, referring to Table 5, the first grade is 70% + 50% + 40% = 160%, the second grade is 20% + 30% + 30% = 80%, and the third grade is 10% + 20% + 30. % = 60%. Accordingly, the grade determination unit 145 may determine the export attempt information as the first grade.

For example, the grade determiner 145 may determine the grade of the export attempt information by summing values obtained by multiplying the weights of the respective classification modules and the matching ratio by the grades using the weights assigned to the respective classification modules. That is, it is assumed that the weight of the A classification module is 1.0, the weight of the B classification module is 0.8, and the weight of the C classification module is 1.2. Referring to Table 5, the first grade is 70% * 1.0 + 50% * 0.8 + 40% * 1.2 = 158%, the second grade is 20% * 1.0 + 30% * 0.8 + 30% * 1.2 = 80%, Tier 3 is 10% * 1.0 + 20% * 0.8 + 30% * 1.2 = 62%. Accordingly, the grade determination unit 145 may determine the export attempt information as the first grade.

The controller 150 controls the above-described configuration unit (storage unit 110, learning unit 120, sensing unit 130, determination unit 140).

For example, the controller 150 may control the determination unit 140 to determine the security level of the export attempt information when the export attempt is detected by the sensing unit 130.

In addition, the controller 150 allows or blocks the export attempt information by comparing the security level of the export attempt information with the security level of an internal person who attempts to export the information. For example, if the security level of the internal person who attempts to export is less than the security level of the export attempt information, the export may be blocked.

The controller 150 may control the determination unit 140 to re-determine the security level of the export attempt information when the grade of the internal person attempting to export is smaller than the grade of the export attempt information. In this case, the controller 150 may control the determination unit 140 to determine the grade by adjusting the number of classification modules. For example, when the first class is determined after detecting the export attempt, the determination unit 140 may determine the security level of the export attempt information by using a predetermined number of classification modules among a plurality of classification modules. Then, when re-determining the grade, the determination unit 140 may determine the security level of the export attempt information by using the remaining classification module other than the classification module used when determining the first grade. In addition, when re-determining the grade, the determination unit 140 may determine the security grade by using all of the plurality of classification modules.

In addition, in another embodiment, the controller 150 is a security officer (or security committee) of the plurality of terminals 200 when receiving a request for re-determination of the rating, if the rating of the internal personnel attempting to export is less than the rating of the export attempt information The terminal may request to re-determine the security level of the export attempt information. In this case, the security officer or security committee may review the security level of the corresponding export attempt information to re-determine the security level, and transmit the re-determined security level to the apparatus 100 for preventing leakage of confidential information through the terminal 200. Subsequently, the controller 150 may allow or block the export attempt information by comparing the security level of the received export attempt information with the security level of an internal person who attempts to export the information.

At this time, if the re-determined security level is different from the existing security level, the controller 150 adds the export attempt information of which the security level is re-determined to the storage unit 110 as confidential information of the corresponding security level. As such, the controller 150 may update the confidential information for each security level, and then the learner 120 may increase the accuracy of the learning result through the updated confidential information for each security level when calculating the learning result.

3 is a flowchart illustrating a procedure of calculating a learning result by the apparatus for preventing leakage of confidential information.

In step S310, the internal security officer or security committee sets a rating for the confidential information and internal personnel information stored in the confidential information leakage prevention apparatus 100. Here, the confidential information leakage prevention apparatus 100 may store confidential information and internal personnel information for each security level in the storage unit 110.

In operation S320, the confidential information leakage prevention apparatus 100 extracts feature information for each grade from the confidential information for each grade. For example, the confidential information leakage prevention apparatus 100 extracts a keyword or multimedia (image, voice, video, etc.) that can accurately reflect the characteristics of the confidential information through normalization of converting the confidential information into mechanical processing. .

In operation S330, the confidential information leakage prevention apparatus 100 generates a learning result for each grade using a plurality of learning modules. Here, the confidential information leakage prevention apparatus 100 includes a plurality of learning modules, and each learning module generates a learning result for confidential information for each grade by using feature information extracted according to a set learning algorithm. Since the generation of the learning result has been described above with reference to FIG. 2, a detailed description thereof will be omitted.

In operation S340, the confidential information leakage prevention apparatus 100 stores the learning results for each learning module. Here, the confidential information leakage prevention apparatus 100 may store the learning results organized by grade for each learning module.

4 is a flowchart illustrating a procedure of determining, by the apparatus for preventing the leakage of confidential information, the security level of the export attempt information.

In operation S410, the confidential information leakage prevention apparatus 100 detects an attempt to export. The internal personnel may take out the internal information to the outside using the terminal 200. For example, the internal personnel may export the internal information to the outside by transmitting the file to an external network, copying the file using a mobile storage device, or printing the file using an office device such as a printer.

In operation S420, the confidential information leakage prevention apparatus 100 extracts feature information from the export attempt information. For example, the confidential information leakage prevention apparatus 100 may extract keywords or multimedia by normalizing the export attempt information.

In operation S430, the confidential information leakage prevention apparatus 100 generates a classification result using a plurality of classification modules. The confidential information leakage prevention apparatus 100 includes a plurality of classification modules corresponding to the plurality of learning modules. Each classification module compares the feature information of the extracted export attempt information with the learning result. Accordingly, each classification module may calculate a classification result for determining the security level of the export attempt information. In this case, the confidential information leakage prevention apparatus 100 may control the classification module of a predetermined number of all classification modules provided to calculate a classification result. Since the classification result generation has been described above with reference to FIG. 2, a detailed description thereof will be omitted.

In operation S440, the confidential information leakage prevention apparatus 100 determines a security level of the export attempt information according to the classification result of each classification module. The confidential information leakage prevention apparatus 100 may determine the security level of the export attempt information by combining the classification result of each classification module. For example, the confidential information leakage prevention apparatus 100 calculates the highest matching ratio for each classification module by using the matching ratio of the export attempt information for each level generated by each classification module, and exports the most calculated rating. This may be determined by the degree of the attempt information.

5 is a flowchart illustrating a confidential information leakage prevention method performed by the confidential information leakage prevention apparatus.

In operation S510, the confidential information leakage prevention apparatus 100 determines an export attempt information level by detecting an export attempt. Step S510 is performed according to the security level determination procedure described above in FIG.

In operation S520, the apparatus 100 for preventing leakage of confidential information compares the grade of the internal person who attempted to carry out with the grade of the export attempt information determined in operation S510.

In operation S530, when the export attempt internal personnel rating is larger than the export attempt information level, the confidential information leakage prevention apparatus 100 allows the export of the export attempt information.

In operation S540, when the export attempt internal personnel rating is smaller than the export attempt information rating, the confidential information leakage prevention apparatus 100 determines whether to request a re-determination of the rating. When the internal person who attempted to carry out is not allowed to export because his or her grade is smaller than the export attempt information level, the insider may request a re-determination to the confidential information leakage prevention apparatus 100 through the terminal 200.

If the confidential information leakage prevention apparatus 100 is not requested to re-determined, the process proceeds to step S580 to block the export of the export attempt information.

In operation S550, the confidential information leakage prevention apparatus 100 re-determines the grade of the export attempt information when receiving the grade re-determination request. At this time, the confidential information leakage prevention apparatus 100 may re-determine the class of the export attempt information by using the remaining classification module except the classification module used in step S430. In addition, the confidential information leakage prevention apparatus 100 may re-determine the security level of the export attempt information using the entire classification module provided after receiving the request for re-determination of the rating again.

In addition, in another embodiment, when the confidential information leakage prevention apparatus 100 receives a request for re-determination of the rating, the request for re-determination of the security level of the information on the release attempt to the terminal of the security officer (or security committee) of the plurality of terminals 200 Through the terminal, the security level of the export attempt information determined by the security officer or the security committee may be received.

In operation S560, the confidential information leakage prevention apparatus 100 determines whether the grade is changed. If the re-determined grade is consistent with the existing grade, the confidential information leakage prevention device 100 enters the step S580 to block the export of the export attempt information.

In operation S570, when the reclassified grade does not match the existing grade, the confidential information leakage prevention apparatus 100 adds the export attempt information of which the security grade is re-determined to the storage 110 as confidential information of the corresponding security grade. As such, the confidential information leakage prevention apparatus 100 may update the confidential information for each security level, and when calculating the learning result thereafter, may increase the accuracy of the learning result through the updated confidential information for each security level.

Thereafter, the confidential information leakage prevention apparatus 100 enters the step S520, and when the export attempt internal personnel rating is greater than the re-determined rating of the export attempt information, allows the export of the export attempt information.

Meanwhile, the method for preventing the leakage of confidential information according to the present embodiment may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like.

The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Hardware devices specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art to which the present invention pertains without departing from the spirit and scope of the present invention as set forth in the claims below It will be appreciated that modifications and variations can be made.

100: confidential information leakage prevention device
200: terminal

Claims (18)

A storage unit which stores confidential information and internal personnel information for each security level;
A learning unit extracting feature information from the confidential information and generating a learning result for each security level using the feature information;
A detector for detecting an attempt to export information from the internal network to the outside;
A determination unit determining a security level of export attempt information by using the learning result when the export attempt is detected; And
And a controller for allowing or blocking the export attempt information by comparing the security level of the export attempt information with the security level of an internal person.
The learning unit includes a plurality of learning modules, and the determining unit includes a plurality of classification modules corresponding to the plurality of learning modules.
The method of claim 1,
The learning unit
A learning information extraction unit for normalizing the confidential information to extract feature information including any one or more of keywords and multimedia; And
Comprising a learning result generating unit for calculating the information statistics on the feature information, and generating a learning result of gathering the feature information and the information statistics for each security level; Prevention device.
The method of claim 1,
The determining unit
A classification information extracting unit for extracting feature information including at least one of a keyword and a multimedia by normalizing the export attempt information;
A classification result generation unit having a plurality of classification modules configured to compare the feature information of the export attempt information with the learning result and generate a classification result for calculating a ratio at which the export attempt information is matched for each security level; And
And a rating determiner configured to determine a security level of the export attempt information by using the classification result.
The method of claim 3,
The class determining unit calculates a security level having the highest matching ratio for each classification module by using the classification result, and determines the most calculated security level as the security level of the export attempt information. .
The method of claim 3,
The class determining unit compares the sum of the matching ratios of the classification modules for each class, and determines the security level having the highest value as the security level of the export attempt information.
The method of claim 5,
And the rating determiner applies a weight set in advance for each classification module to the matching ratio.
The method of claim 1,
And the controller controls the determining unit to determine a security level of the export attempt information by adjusting the number of classification modules.
The method of claim 1,
When the controller receives a request for re-determining the security level of the export attempt information, the controller requests a re-determination request from the terminal of the security officer and receives the security level of the export attempt information determined by the security officer from the terminal. Device for preventing the leakage of confidential information, characterized in that.
According to claim 1,
The control unit, if the security level determined according to the request for re-determining the level of the export attempt information is different from the existing security level, add the export attempt information as confidential information of the corresponding security level and store the confidential information in the storage unit. Spill Prevention Device.
In the method of preventing the leakage of confidential information in the internal network leakage prevention device,
Storing confidential information and internal personnel information having a security level set;
Extracting feature information from the confidential information and generating a learning result for each security level by using the feature information;
Detecting an attempt to export information from the internal network to the outside;
Determining a security level of the export attempt information by using the learning result; And
Comprising the step of allowing or blocking the export attempt information by comparing the security level of the export attempt information and the security level of the internal personnel,
The confidential information leakage prevention apparatus includes a plurality of learning modules and a plurality of classification modules corresponding to the plurality of learning modules.
The method of claim 10,
Generating a learning result for each security level by using the feature information
Normalizing the confidential information to extract feature information including at least one of a keyword and a multimedia;
Calculating information statistics on the feature information through the plurality of learning modules; And
And generating a learning result for each learning module, in which the feature information and the information statistics are sorted for each security level.
The method of claim 11,
Determining the security level of the export attempt information by using the learning result
Normalizing the export attempt information to extract feature information including at least one of a keyword and a multimedia;
Generating a classification result for each classification module that compares the feature information of the export attempt information with the learning result and calculates a ratio in which export attempt information is matched for each security level; And
And determining the security level of the export attempt information by using the classification result.
The method of claim 12,
Determining a security level of the export attempt information
And calculating the security level having the highest matching ratio for each classification module by using the classification result, and determining the most calculated security level as the security level of the export attempt information.
The method of claim 12,
Determining a security level of the export attempt information
And comparing the sum of the matching ratios of the classification modules for each level to determine the security level having the highest value as the security level of the export attempt information.
The method of claim 14,
Confidential information leakage prevention method, characterized in that for applying the weight set in advance for each of the classification module to the matching ratio.
The method of claim 10,
Determining the security level of the export attempt information by using the learning result
Determining the first security level of the export attempt information by using a predetermined number of classification modules of the plurality of classification modules,
The step of allowing or blocking the export attempt information by comparing the security level of the export attempt information and the security level of the internal personnel
If the first security level is greater than the security level of the internal personnel, determining a second security level of the export attempt information by using a classification module other than the preset number of classification modules when receiving a rating re-determination request; And
And comparing or disallowing the export of the export attempt information by comparing the second security level with the security level of the internal personnel.
The method of claim 16,
Determining a second security level of the export attempt information
Method for re-determining a rating to the terminal of the security officer, and receives a second security level of the export attempt information re-determined by the security officer from the terminal.
The method of claim 16,
After determining the second security level of the export attempt information,
And if the second security level is different from the first security level, adding the export attempt information as confidential information of the corresponding security level.

Images