KR20180071699A - System for online monitoring individual information and method of online monitoring the same - Google Patents

Abstract

The present invention provides an online monitoring system for individual information and a real-time monitoring method thereof to reduce the cost and time for processing web logs which are unstructured data having a large amount of data and improve the stability of log data. The online monitoring system for individual information according to the present invention includes a log collection target server (10) for creating a log file related to leakage of work-related information and personal information; and a log collection server (20) including a Hadoop distributed file system control unit (21), a Hadoop distributed file system (22), a log analysis control unit (23), an analysis log storage unit (24), an explanation determination storage unit (25), an explanation log processing unit (26), a raw log storage unit (27), a raw log processing unit (28), and a screen display unit (29).

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an online monitoring system for personal information,

The present invention relates to a personal information online surveillance system and method thereof, and more particularly, to a personal information information monitoring system and a method thereof, , Etc.), regular monitoring of personal information abuse, and personal information / main secret information (confidential information) to prevent leakage of personal information.

Recently, the importance of information security management for companies such as government agencies and large corporations handling personal information has become important. Therefore, by applying advance risk detection and personal information surveillance pattern rules for personal information and internal (confidential) information abuse, establishing a response system through preliminary detection and preliminary risk analysis, and by monitoring major risk indicators and thresholds, It is necessary to prevent such a problem.

For example, the following patent document 1 discloses a technique for an online personal information monitoring system.

A schematic configuration of the personal information online monitoring system disclosed in Patent Document 1 is shown in Fig. Referring to FIG. 16, the personal information online surveillance system of Patent Document 1 includes a log collection target server 100 for generating log files related to outflow of work related information and personal information; And a log collection control unit (210) for defining the log file generated by the log collection target server to be collected by an arbitrary collection method; and a log collection control unit A log collection unit 220 for collecting the log files generated by the server, an analysis criteria control unit 230 for analyzing the log files collected by the log collection unit 220 according to an arbitrary analysis standard, An analysis reference storage 240 for storing the log file analyzed according to the analysis criterion defined by the analysis reference control unit 230; A call-in determination control and storage unit 250 for generating and storing call-up data for the log file requiring a call, An analysis log processing unit 260 for processing the analyzed log file and the searched log data, and a log management unit 260 for storing a raw log, which is a log file that has not been analyzed for the log file collected by the log collecting unit 220 A raw log processing unit 280 for processing the raw logs stored in the raw log storage unit 270 and a log file processing unit 260 for processing the log files processed by the analysis log processing unit 260, And a screen display unit (290) for displaying the call log data and the raw log processed by the raw log processing unit (280), wherein the raw log processing unit (280) The analysis log processing unit 260 retrieves a raw log stored in the raw log storage unit 270 and derives a new analysis standard for the searched raw log, Processing the vocabulary data required to be called by the storage unit 250 and performing statistics and report processing on the searched log file stored in the analysis reference storage unit 240, 230), and then generates an event required to calculate the risk, adds the risk index of the generated event to the risk index of the corresponding employee to determine the risk per employee, It is disclosed that the risk index at the critical stage is weighted to calculate the risk per employee, department, and total risk.

According to the personal information online monitoring system disclosed in Patent Document 1, it is possible to analyze the logs related to the personal information or the main (confidential) information of the company to calculate the risk by monitoring and analysis criteria.

Patent Registration No. 10-1593910 (Feb.

However, in the personal information online monitoring system disclosed in Patent Document 1, since there are more than 30,000 Weblogs, which are data to be processed, not only belong to unstructured data but also have a large amount of data to be processed, There is a problem that the processing cost and time of the server increases and the instability of the log data due to the failure of the storage device constituting the server increases.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a personal information online surveillance system using a Hadoop distributed file system (HDFS) and an ordinary monitoring method thereof.

In order to achieve the above object, a personal information online surveillance system according to the present invention comprises a log collection target server (10) for generating log files related to outflow of business related information and personal information; And a Hadoop distributed file system control unit (21) for defining the log file generated by the log collection target server to be collected by an arbitrary collection method; and a control unit A Hadoop distributed file system 22 for collecting the log files generated by the log collection target server 22 and a log analysis unit 23 for analyzing the log files collected by the Hadoop distributed file system 22 to analyze them by arbitrary analysis criteria An analysis log storage unit 24 for storing the log file analyzed by the analysis standard defined by the log analysis control unit 23 and a log analysis unit 24 for storing the analysis log in the analysis log storage unit 24 (25) for searching for the analyzed log file and generating and storing call log data for the log file requiring a call, A signature log processing unit (26) for processing the analyzed log file and the searched signature data stored in the analysis log storage unit (24); and an analysis unit for analyzing the log file collected by the Hadoop distributed file system A raw log processing unit 28 for processing the raw logs stored in the raw log storing unit 27 and a raw log processing unit 28 for processing the raw logs stored in the raw log storing unit 27, And a log display server (20) having a screen display unit (29) for displaying the log file processed by the log management unit (26), the call log data, and the raw log processed by the raw log processing unit .

The personal information online surveillance system according to the present invention further includes a plurality of institutional linkage target servers 30 for generating a log file related to the outflow of work related information and personal information .

Also, in the personal information online monitoring system according to the present invention, the raw log processing unit 28 searches the raw log stored in the raw log storing unit 27, Is derived.

In the personal information online monitoring system according to the present invention, the vocabulary log processing unit 26 processes the vocabulary data requiring vocabulary by the vocabulary determination storage unit 25, And performs statistical and report processing on the searched log file stored in the log database 24.

In addition, the personal information online monitoring system according to the present invention minimizes false detection of the Hadoop distributed file system 22 when the PC environment of the log collection target server 10 is changed (use S / W change) And registers an exclusion file for the log analysis control unit 23 in the log analysis control unit 23.

According to another aspect of the present invention, there is provided an online monitoring method for personal information, comprising a first step (S100) of generating a log file related to an outflow of work related information and personal information in a log collection target server, A second step (S200) of defining a collection mode by the Hadoop distributed file system control unit of the log collection server, a third step (S300) of collecting the log file in the Hadoop distributed file system by the defined collection method A fourth step (S400) of defining the collected log file as an arbitrary analysis reference by a log analysis control unit, and a fifth step (S400) of storing the log file analyzed according to the defined analysis standard in an analysis log storage unit (S500) for searching the stored log file, and generating a vocabulary data for the log file requiring vocabulary by the vocabulary determination control and storage unit (S700) of processing the analyzed log file and the searched log data stored in the analysis log storage unit by a log-processing unit (S700); and a seventh step (S700) of processing the log file processed by the log- And an eighth step (S800) of displaying the vocabulary data on a screen display unit.

In addition, the personal information online monitoring method according to the present invention may further include a step S400 'of storing, in the step S300, a raw log, which is a log file that has not been analyzed with respect to the collected log files, (S500 ') processing the stored original log in a raw log processing unit, and displaying the processed raw log on a screen display unit (S600').

Also, the personal information online monitoring method according to the present invention is characterized in that the personal information online surveillance system further includes a plurality of institution-linked servers for generating log files related to the work related information and the personal information.

In the personal information online monitoring method according to the present invention, the raw log processing unit searches for a raw log stored in the raw log storing unit, and derives a virtual analysis standard for the retrieved raw log .

Further, in the personal information online monitoring method according to the present invention, the voicing log processing unit may process the voicing name data requiring voicing by the voicing determination control and storage unit, And performs statistics and report processing on the log file.

Also, the method for online monitoring of personal information according to the present invention is a method for minimizing false detection of the Hadoop distributed file system 22 when the PC environment of the log collection target server 10 is changed (use S / W change) And registers an exclusion file for the log analysis control unit 23 in the log analysis control unit 23.

According to the present invention, although the amount of data to be processed is large for weblogs, which are unstructured data, the processing cost in actual implementation can be reduced, the time can be shortened, the stability of log data can be improved, The log files are analyzed according to the analysis criteria defined according to the user's convenience, and the logs related to the personal information or the main secret information are analyzed to calculate the risk level according to the monitoring and analysis criteria.

Brief Description of the Drawings Fig. 1 is a block diagram showing the overall configuration of a personal information online monitoring system according to the present invention; Fig.
2 is a display screen that can be monitored through the personal information online surveillance system according to the present invention.
FIG. 3 is a threshold calculation screen for the number of daily work processes for personal information and important information per employee.
FIG. 4 is a screen for inputting a risk assessment criterion for detecting personal information abuse.
5 is a screen showing a risk analysis formula;
Figure 6 is an exemplary screen for qualitative analysis.
Figure 7 is an exemplary screen for quantitative analysis.
8 is a flowchart for explaining the flow of work in which voicing is performed by the voicing determination storage unit 25 in the personal information online monitoring system according to the present invention.
9 is a view for explaining defined excerpt criteria details and related data;
10 is a screen for explaining a function that an administrator can manually request a user who is suspected of abuse, in addition to the automatic calling defined by the user.
11 is a screen for registering a call history.
FIG. 12 is a screen for explaining a primary judgment procedure for the entered calling name; FIG.
FIG. 13 is a screen for explaining a secondary determination procedure for the entered calling card; FIG.
14 is a screen for performing a search for a raw log collected by a search engine of the present system.
15 is a simulation screen capable of generating a new extraction condition based on a scenario / rule or performing a virtual analysis.
FIG. 16 is a block diagram showing the overall configuration of a conventional personal information online monitoring system according to the related art; FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Also, the terms " part, "" module," and the like, which are described in the specification, refer to a unit for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram showing the entire configuration of the personal information monitoring system according to the present invention.

Referring to FIG. 1, the personal information online surveillance system according to the present invention includes a log collection target server 10 for generating log files related to outflow of work related information and personal information, A log file created by the log collection target server 10 by a collection method defined by the Hadoop distributed file system control unit 21; A log analysis control unit 23 that analyzes the log files collected by the Hadoop distributed file system 22 to analyze them on an arbitrary analysis basis, a log analysis control unit 23 that analyzes the log files collected by the Hadoop distributed file system 22, An analysis log storage unit 24 for storing a log file analyzed according to the analysis standard defined by the analysis log storage unit 24, A vocabulary log processing unit 26 for processing the analyzed log files stored in the analysis log storage unit 24 and the vocabulary data searched for, A raw log storage unit 27 for storing a raw log, which is a log file that has not been analyzed with respect to the log files collected by the Hadoop distributed file system 22, and a raw log storage unit 27, A log file processed by the log-name processing unit 26, call-in data, and a screen display unit 29 for displaying a raw log processed by the raw log processing unit 28 And a log collection server 20 having the log collection server 20.

In addition, the personal information online surveillance system may further include a plurality of institutional linkage target servers 30 that generate log files related to the outflow of work related information and personal information.

On the other hand, the raw log processing unit 28 can search the raw log stored in the raw log storage unit 27 and derive a new analysis standard for the searched raw log.

Then, the vocabulary log processing unit 26 processes the vocabulary data requiring vocabulary by the vocabulary determination storage unit 25, and can perform statistics processing and report processing on the retrieved log files stored in the analysis log storage unit have.

1, the Hadoop distributed file system (HDFS) 22 is a distributed extended file system written in the Java language for the Hadoop framework. The Hadoop distributed file system 22 divides large files into several machines and stores them in a plurality of servers so that the data can be stored in a plurality of servers in a redundant manner. Thus, the host does not use a RAID storage device. Unlike the general purpose file system, the Hadoop distributed file system 22 is designed so that the reaction rate is optimized for the throughput per hour, a file has a size of about gigabytes or terabytes, It can have hundreds of nodes in a cluster, supports tens of millions of files in a single instance, and is highly configurable with other types of hardware and software platforms.

On the other hand, the log collection target server 10 is a server that stores business related information such as business systems or application logs of each public institution or large corporation, and logs related to the outflow of personal information. The stored logs are collected and stored in the Hadoop distributed file system 22 using the distributed collection method. In this case, the method of collecting logs may be collected using an agent and agentless method in addition to the distributed collecting method, and the log related to the outflow of business related information and personal information collected by the collecting method may be filtered And is stored in the Hadoop distributed file system 22 in a real-time or batch manner.

In addition, the Hadoop distributed file system control unit 21 defines a method of collecting logs related to the outflow of the task related information and the personal information, and controls the Hadoop distributed file system 22 to collect the logs.

Next, the log stored in the Hadoop distributed file system 22 is defined to be analyzed by the log analysis control unit 23 on an arbitrary analysis basis, and the log file analyzed by the analysis criteria defined by the log analysis control unit 23 In the analysis log storage unit 24.

In this manner, the log file stored in the analysis log storage unit 24 is searched for, and the signature identification storage unit 25 generates the signature data for the log file for which the user has used the personal information. Thereafter, the analyzed log file stored in the analysis log storage unit 24 and the vocabulary data requiring the vocation of the data stored in the analysis log storage unit 24 are processed by the vocabulary log processing unit 26 .

In this way, the log file and the vocabulary data processed by the vocabulary log processing section 26 are displayed on the screen display section 29.

On the other hand, the raw log, which is a log file that has not been analyzed for the log file collected by the Hadoop distributed file system 22, is stored in the raw log storage unit 27. As described above, the raw logs stored in the raw log storage unit 27 can be searched for the analysis and search of the raw logs by the AND / OR condition using the search engine of the present system.

The raw log processing unit 28 derives a virtual analysis criterion for the searched raw logs and displays them on the screen display unit 29.

On the other hand, a mongo DB capable of storing logs in a no-sql manner can be used for the Hadoop distributed file system 22.

When the PC environment of the log collection target server 10 is changed (use S / W change), an exclusion file for minimizing false detection of the Hadoop distributed file system 22 is registered in the log analysis control unit 23 .

Next, in the present invention, logs related to the outflow of work related information and personal information are collected in a distributed manner on the log collection target server 10, and are then stored in the Hadoop distributed file system 22.

The range of logs collected by the Hadoop distributed file system 22 includes the user authentication log, business system access log, permission inquiry log, administrator activity log, API log, teleweb / customer center log, PC security solution, DRM access control, media access history, real-time printer log, usage logs for encrypted files, and business log records.

These logs are collected in real time, and may be collected at specific times according to the user's request.

On the other hand, Teleweblog according to the present invention also compares log records of consultation history records, and collects in real time the analysis history of personal information starting from the receipt of a customer's complaint.

In this system, a specific collection program is used to manage administrator activity log API, payment application log, user authentication log, DB access control, permission inquiry log, usage record for encrypted file, business log record management, It is possible to collect the details in real time.

The collected logs are stored in the Hadoop distributed file system 22 as unstructured data.

On the other hand, collected logs are stored in no-sql. If necessary, a separate database can be installed and stored in the standard 66 column of the RDBMS. Depending on the needs of the user, the standard fields may be changed organically. In addition, an RDBMS can use a commercial RDBMS and can be replaced with a free RDBMS in proportion to the daily log size. no-sql is a non-relational DB that does not require complex relationship definitions and can write different columns for each row, allowing you to organically expand and collapse fields other than the defined standard fields, You can save logs without.

The raw log stored in the raw log storage unit 27 is retrieved using the raw log analysis unit and the search engine of the raw log processing unit 28. The raw log processing unit 28 analyzes It is possible to facilitate the analysis and retrieval of the raw logs other than the information obtained.

After analyzing these logs, the raw log processing unit 28 can provide the functions for the pre-detection, the detection according to the extraction condition, the trend analysis and the monitoring as shown in the dashboard of FIG.

2 is a display screen that can be monitored through the personal information online monitoring system according to the present invention. The display screen can be freely changed by the user and the display screen can be changed organically according to the user's demand. Each analysis data on the display screen is displayed in real time, and the period can be set by user's definition.

Next, FIG. 3 is a threshold calculation screen for the number of daily work processes for personal information and important information per employee. Enter the threshold calculation population data interval on the collection date. For example, if the acquisition range is 97%, the upper 1.5% and lower 1.5% data are excluded. This assumes that 1.5% of the top / bottom is abnormal and excludes 3% in order not to affect the overall average. Also, the error range is selected from 1 to 6 sigma. The error range can be used as a probabilistic analysis of the threshold setting. Based on the computed thresholds, an overstatement for thresholds can be extracted by employee or department.

FIG. 4 is a screen for inputting a risk assessment criterion for detecting abuse of personal information. Risk assessment criteria may vary depending on system analysis / design results and requirements of the project team. The risk level of this system is composed of 5 steps which are the same as the national risk level. The analysis result of the collected logs is calculated by the method shown in Fig. After analyzing the collected logs according to the set extraction conditions, the system generates events necessary to calculate the risk, and the risk index of the generated event is added to the risk index of the corresponding employee to determine the risk per employee. According to the risk index for each employee, risk can be generated by department, by group, and region by the risk analysis formula of FIG. We also assign risk weights at the critical stage in determining risk, weighting employees, departments, and total risks.

6 and 7 are exemplary screens for qualitative and quantitative analysis. Referring to FIGS. 6 and 7, trend analysis is performed using a trend analysis technique. The trend analysis is performed based on various information such as the number of work by each employee, the number of work by department, and the number of detection conditions of extraction conditions, and the result is displayed on the screen as shown in FIG. For example, the change in personal information / main information processing rate by employee and department, and the trend trend of the trend top 10 in the last 30 days are expressed in a time series graph. Drill down when clicking on an employee whose suspicion of information leakage is tracked. The analytical techniques used in the trend analysis are as follows.

In the above technique, the daily change rate can be checked by applying a comparison time (2 days) to the reference time (30 days) of the change rate of the business process.

Fig. 8 is a flowchart for explaining the flow of work in which voicing is performed by the voicing judgment storage unit 25 in the personal information online monitoring system according to the present invention.

Referring to FIG. 8, a log file is collected (S1), and the log file is converted according to the details of the extract criteria defined in FIG.

Figure 9 is a diagram illustrating the defined excerpt criteria breakdown and related data.

Referring to FIG. 9, it can be seen that, in the case of personal information retrieved without a complaint, a security inquirer such as a personal information / major information leaker or a retired / , The main data retrieval for downloading or browsing the registered main data, the upper output for the user to perform more output / browsing than the numerical value set by the user, the upper viewer, If the amount of daily work exceeds the threshold for the periodical transaction log by individual viewers, department, and specific screen viewers for the monitoring of numerical abnormality, the periodical transaction threshold for the event exceeding the threshold is analyzed and the behavior for 3 months from the date of occurrence is analyzed for 3 months A plurality of viewers, a plurality of viewers, a plurality of viewers, In case of monitoring personal information / important information outside the designated business hours within the period, personal information / key information retrieved by random number (probability) set by the user for browsing the main information / And out-of-office hours. These extraction scenarios can be obtained based on business logs and basic set values.

Next, FIG. 10 is a screen for explaining a function that an administrator can manually request a user who is suspected of abuse, in addition to the automatic calling defined by the user. When manual calling is requested by the step S5 of FIG. 8, the user registers the calling details in the screen as shown in FIG. 11, and a request for calling a calling is delivered to the manager when the registration is completed.

12 and 13 are explanatory diagrams for explaining the step-by-step determination procedure for the entered calling card.

When the user inputs a call, a determination request is transmitted to the primary determination device (S8). When the primary determination device completes the determination, the determination request (S9) is transmitted to the secondary determination device. If there is insufficient information about the call, the call can be processed again. If the call is to be re-called, the procedure returns to step S6.

Basically, the details of the calling are stored in the personal information / important information storing unit of the step S10, and the user can set the period or select the calling name to initialize the calling name.

In addition, an alarm may be delivered to the person to be called upon occurrence of a step set by the user via SMS, mail, messenger, etc. in the agency linkage server 30, and the history is automatically stored. If necessary, the alarm can be delivered at the time entered by the user.

Meanwhile, FIG. 14 is a search engine capable of searching the collected log itself, and is an engine based on a data model based on a Big Table column.

Unlike relational databases, it is based on NO-SQL that does not use SQL, and high-performance processing is possible for large-volume data transactions. Even when the capacity is expanded, the capacity can be expanded laterally without lowering the performance by adding a node. In addition, the log stored in the Hadoop distributed file system 22 can be searched by any keyword without a specific query condition.

In addition, when there is a suspicion of further abuse among the logs stored in the Hadoop distributed file system 20, it is possible to newly generate an extraction condition based on a scenario / rule using the simulation function of FIG. 15 or to perform a virtual analysis.

Although the embodiments of the present invention have been described above, various modifications may be made by those skilled in the art. Therefore, it should be understood that the present invention should not be construed as being limited to the above embodiments, but should be construed in accordance with the following claims.

10: Log collection target server
20: Log collection server
21: Hadoop distributed file system control unit
22: The Hadoop Distributed File System
23: log analysis control section
24: Analysis log storage section
25:
26:
27: raw log storage
28: raw log processing unit
29:
30: Institutional link target server

Claims (6)

A log collection target server 10 for generating log files related to the outflow of work related information and personal information; And
A Hadoop distributed file system controller (21) for defining the log file generated by the log collection target server to be collected by an arbitrary collection method,
A Hadoop distributed file system 22 for collecting the log files generated by the log collection target server by the collection method defined by the Hadoop distributed file system control unit 21,
A log analysis control unit (23) for analyzing the log file collected by the Hadoop distributed file system (22)
An analysis log storage unit 24 for storing the log files analyzed by the analysis criteria defined by the log analysis control unit 23,
(25) for searching the analyzed log file stored in the analysis log storage unit (24) to generate and save the voicing data for the log file requiring voicing,
A signature log processing unit (26) for processing the analyzed log file and the searched name data stored in the analysis log storage unit (24)
A raw log storage unit 27 for storing a raw log, which is a log file that has not been analyzed for the log file collected by the Hadoop distributed file system 22,
A raw log processing unit 28 for processing the raw logs stored in the raw log storing unit 27,
A log collection server (29) including a log display unit (29) for displaying the log file processed by the log log processing unit (26), the call log data, and the raw log processed by the log log processing unit 20);
, ≪ / RTI &
The raw log processing unit 28,
Searches for a raw log stored in the raw log storage unit 27, derives a new analysis standard for the retrieved raw log,
The calling log processing unit (26)
Processing the vocabulary data requiring vocabulary by the vocabulary determination storage unit (25), performing statistics and report processing on the searched log file stored in the analysis log storage unit (24)
After analyzing the collected logs according to the extraction conditions set by the log analysis control unit 23, it generates an event necessary for risk assessment and adds the risk index of the generated event to the risk index of the corresponding employee to determine the risk per employee And a risk index is assigned to the risk index at a critical stage in determining the risk, and the risk of each employee, department, and the entire risk is calculated. The method according to claim 1,
Personal information online surveillance system,
Further comprising a plurality of institutional linkage target servers (30) for generating log files related to the outflow of work related information and personal information. The method according to claim 1,
When the PC environment of the log collection target server 10 is changed (use S / W change), an exclusion file for minimizing false detection of the Hadoop distributed file system 22 is registered in the log analysis control unit 23 Wherein said personal information monitoring system comprises: A first step of creating, in a log collection target server, a log file related to the outflow of work related information and personal information;
A second step of defining an arbitrary collection method for the log file generated by the Hadoop distributed file system controller of the log collection server;
A third step of collecting the log file in the Hadoop distributed file system by the defined collection method;
A fourth step of defining the collected log file as an analysis criterion by a log analysis control unit,
A fifth step of storing the log file analyzed according to the defined analysis standard in an analysis log storage unit;
A sixth step of searching for the stored log file and creating a vocabulary data for the log file requiring vocabulary by the vocabulary determination control and storage section;
A seventh step of processing the analyzed log file stored in the analysis log storage unit and the searched name data searched by the searched log processing unit;
And displaying the log file and the vocabulary data processed by the vocabulary log processing unit on a screen display unit,
In the third step,
Storing raw logs, which are log files that have not been analyzed on the collected log files, in a raw log storage unit;
Processing the stored raw logs in a raw log processing unit;
And displaying the processed raw log on a screen display unit,
The raw log processing unit,
A raw log stored in the raw log storage unit is searched, a virtual analysis standard is derived from the searched raw log,
Wherein the calling log processing unit comprises:
Processing the vocabulary data requiring vocabulary by the vocabulary determination control and storage unit and performing statistics and report processing on the searched log file stored in the analysis log storage unit,
After analyzing the log collected according to the extraction condition set by the log analysis control unit, an event necessary to calculate the risk is generated, and the risk index of the generated event is added to the risk index of the corresponding employee to determine the risk per employee. Wherein the risk index at the critical stage is weighted to determine employee, department, and overall risk. 5. The method of claim 4,
Wherein the plurality of institutional linkage target servers generate log files related to task related information and personal information. 5. The method of claim 4,
When the PC environment of the log collection target server 10 is changed (use S / W change), an exclusion file for minimizing false detection of the Hadoop distributed file system 22 is registered in the log analysis control unit 23 Wherein the personal information is stored in the storage unit.

Images