WO2019017550A1 - Integrated control system and method for personal information security products - Google Patents

Abstract

The present invention relates to an integrated control system and method for personal information security products, and comprises: a profiling cluster storage module comprising a work-based data conversion unit for converting data, which results from users' work behaviors using personal information, into work behavior list data, a work-based data extraction unit for extracting work behavior lists, acquired from the data conversion unit, according to users, a work-based vector conversion unit for vectorizing the work behavior lists extracted according to users, a work-based clustering unit for forming a work-based cluster by clustering the vectorized work behavior lists by using the k-means algorithm, a work-based threshold value calculation unit for calculating a distance threshold value for distances between the center of the work-based cluster and elements thereof by using the t-digest algorithm, a clustering storage unit for storing the work-based cluster and the distance threshold value in a column-type data format; and an abnormal pattern analysis module comprising an abnormal pattern determination unit for determining whether a user's subsequent access behavior to personal information is an abnormal behavior, by comparing an analyzed cluster distance value derived from the subsequent access behavior with the work-based distance threshold value acquired from the storage module. Therefore, it is possible to reduce the false positive rate or false negative rate by analyzing a user's work behavior through created and collected logs without fixing abnormal patterns in advance.

Description

Personal information security product integrated control system and method

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a monitoring system and method for monitoring a personal information use record of a user accessing personal information data, and more particularly, And to a system and method for integrating and controlling personal information security products capable of judging whether or not the information is leaked.

2. Description of the Related Art Generally, a plurality of execution servers connected through a wired / wireless communication network such as the Internet and a wireless network are constructed in a government agency, a corporation, a bank, a research institute, or a school. Respectively. These plurality of execution servers are connected to the security system.

As IT technology evolves, the business environments of companies and others are changed to e-business. As a result, companies that provide products and services to customers are collecting and accumulating personal information of customers in large quantities in the form of applications and databases. When such personal information is leaked, it can be abused by privacy invasion, crime, etc., so that the risk of leakage of personal information is monitored and responded early.

Conventionally, log information about the security system is analyzed to prevent information leakage. For example, if the log of the heterogeneous security system is integrated and the simple lookup and behavior conforms to the predefined definition, it is determined to be a normal behavior pattern. Otherwise, the abnormal behavior pattern is determined.

Korean Patent Laid-Open Publication No. 10-2014-0088712 (prior art 1) includes a monitoring unit for monitoring an access status of personal information and detecting an abnormal transaction; A monitoring unit that receives the output of the monitoring unit and monitors the status of personal information access in real time; And a control unit for controlling the monitoring unit, the monitoring unit, and the log management unit. The control unit controls the monitoring unit, the monitoring unit, and the log management unit to analyze and track the path of the application accessing the personal information from the personal information access status output through the monitoring unit. Discloses a personal information access monitoring system and a method thereof for classifying an abnormal symptom by calculating a separation index (QCL) index based on a Six Sigma index using a database.

Korean Patent Registration No. 10-0980117 (Prior Art 2) discloses a data collection step of collecting data on individual behaviors of a person to be evaluated; A user data warehouse establishing step of performing user standardization and storing the result; A data mart constructing step of constructing a data mart by grasping an individual commerce behavior, an abandonment behavior exceeding a normal behavior, an abnormal behavior by a person, and a relationship of a personal network according to a security risk assessment item; A step of analyzing and calculating a personal action security risk by assigning a security step weight assigned to each action to a user defined action built in the data mart; Personal networking security risk analysis and calculation step that gives personal network security risk; Discloses an internal information leakage threat analysis method comprising an individual personnel security risk analysis and calculation step for assigning individual personnel security risk and an individual security risk analysis and calculation step for calculating individual security risks by combining the above three security risks.

Korean Patent Laid-Open Publication No. 10-2014-0035146 (Prior Art 3) includes a log information collection unit for collecting log information for each of a plurality of users; A standardization database for integrating log information and user information for each user to construct an integrated database; Discloses an information security apparatus including a pattern extracting unit for extracting a pattern for each user and defining a normal pattern from a pattern for each user, and a pattern analyzing unit for comparing a pattern for each user with a normal pattern to determine whether or not a security risk exists.

Korean Patent Laid-Open Publication No. 10-2010-0121896 (Prior Art 4) includes a step of acquiring a plurality of user situation information; Applying each of the user context information to individual rules of the individual rule database to deduce a prediction result according to each user context information; Generating a prediction pattern according to user context information from the inferred prediction result; A pattern-based prediction method comprising the steps of: searching for a pattern matching a predictive pattern among a correct answer pattern or an incorrect answer pattern stored in a pattern database; and predicting the next situation to be experienced by the user according to the search result.

Korean Patent Registration No. 10-1462608 (Prior Art 5) discloses a data collection unit for collecting user data; A big data DB accumulating collected user data; A data mining unit for analyzing data on the big data to pattern user-specific data, determining a characteristic type for each behavior type of a user-specific pattern, and setting an abnormal symptom patterning criterion through the identified behavior type characteristic selection; A modeling unit for setting an abnormality symptom judgment reference using a sagittal symptom patterning criterion; There is disclosed an adaptive big data processing based abnormality symptom detection system including a data collection state in which an abnormal symptom judgment criterion set by a modeling unit is applied to user data provided by a data collecting unit to determine an abnormal symptom in a context adaptive manner.

The systems disclosed in the prior arts detect a user's abnormal behavior pattern on the basis of a predetermined normal pattern based on the statistical number, which makes it difficult to trace intelligent personal information leakage.

Prior arts do not consider the user's work behavior and define and fix the normal behavior in advance and judge it as the abnormal behavior pattern when the definition is out of the definition. Therefore, the user appropriately responds to the characteristic There is a problem that can not be done.

The prior art causes a problem in that, when new data is generated or a standard of action is changed, a new rule can be defined to define it.

Disclosure of Invention Technical Problem [8] The present invention has been proposed in order to solve the conventional problems as described above, and it is an object of the present invention to provide a system and method for integrating a personal information security product, have.

Another object of the present invention is to provide a personal information security product integration control system capable of reducing the ratio of false positive or false negative that can be caused by using a statistical rule-based analysis method for fixing an anomaly pattern in advance System and method.

Another object of the present invention is to provide a personal information security product integrated control system capable of reducing the ratio of positive or negative errors by analyzing a user's business behavior with respect to logs generated and collected without fixing an abnormal pattern in advance There is.

In order to achieve the above object, a personal information security product integrated control system according to the present invention converts personal information utilization data using personal information into business behavior list data through a log of a security product generated in a user's business behavior A task-based data conversion unit for extracting a business behavior list obtained by the data conversion unit by a user, a task-based vector conversion unit for vectorizing a business behavior list extracted for each user, Based clustering processing unit for forming a task-based cluster by clustering using a K-means algorithm and a task-based threshold calculation unit for calculating a distance value threshold between the center and elements of the task-based cluster using a t-digest algorithm , The task-based cluster and the distance value Based values of a column format which is composed of a cluster storage that stores a data format profiling cluster storage module; An abnormal pattern judgment for judging whether an abnormal behavior is made by comparing the analysis distance value of the cluster obtained from the business behavior list used for personal information through the log of the security product generated by the user's subsequent business action and the task based distance value threshold obtained from the storage module And an abnormal pattern analyzing module including the abnormal pattern analyzing module.

The abnormal pattern analysis module further includes an analysis data conversion unit, an analysis vector conversion unit, an analysis clustering processing unit, an analysis distance value calculation unit, and a task-based cluster loading unit.

The method of integrating a personal information security product according to the present invention includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow; A business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user; A business-based vector conversion step of vectorizing a business behavior list extracted for each user in the business-based data extraction step; A task-based clustering processing step of forming a task-based cluster by clustering the vectorized business behavior list using the K-average algorithm in the task-based vector conversion step; A task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm; A clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a columnar data format; The analysis target distance value between the center of the analysis target cluster and the elements obtained from the data generated by the user in the analysis object business behavior of the user who uses the personal information through the log of the security product in the future and the business base distance value threshold stored in the clustering storage step And an abnormal pattern analysis step of determining whether an abnormal operation is performed.

The analysis target distance value between the center of the analysis target cluster and the elements is converted into an analysis target business behavior list by data generated as the analysis target business behavior of the user who uses the personal information at a later time through the log of the security product An analysis target data conversion step; An analysis target vector conversion step of vectorizing the analysis target business behavior list generated in the analysis target data conversion step; An analysis object clustering processing step of forming a analysis object cluster by clustering an analysis target business action list vectorized in the analysis object vector conversion step using a K-means algorithm; and a target distance value calculation step of calculating a target distance value between the center of the target cluster and the elements formed in the target clustering processing step using the t-digest algorithm.

According to the present invention, the integrated information security product integrated control system and method analyze a business activity of a user who uses personal information through a log of a security product generated by a user's business activity without fixing an abnormal pattern in advance, The ratio of errors can be reduced.

1 is a block diagram of a personal information security product integrated control system according to the present invention.

FIG. 2 is a flowchart illustrating an operation state of a profiling cluster storage module of a personal information security product integrated control system according to the present invention.

FIG. 3 is a flowchart illustrating an operation state of an abnormal pattern analysis module of the integrated personal information security product control system according to the present invention.

The personal information security product integrated control system according to the present invention includes a task-based data conversion unit for converting personal information utilization data using personal information into business activity list data through a log of a security product generated by a business activity of a user, A task-based vector conversion unit for vectorizing a business behavior list extracted for each user; a vector-based business behavior list, which uses a K-average algorithm; A task-based clustering processor for clustering the task-based clusters to form a task-based cluster, a task-based threshold calculator for calculating a distance value threshold between the center and elements of the task-based cluster using a t-digest algorithm, The value threshold is stored in a column-type datapo A profiling cluster storage module configured with a clustering storage unit for storing the data; An abnormal pattern judgment for judging whether an abnormal behavior is made by comparing the analysis distance value of the cluster obtained from the business behavior list used for personal information through the log of the security product generated by the user's subsequent business action and the task based distance value threshold obtained from the storage module And an abnormal pattern analyzing module including the abnormal pattern analyzing module.

The method of integrating a personal information security product according to the present invention includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow; A business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user; A business-based vector conversion step of vectorizing a business behavior list extracted for each user in the business-based data extraction step; A task-based clustering processing step of forming a task-based cluster by clustering the vectorized business behavior list using the K-average algorithm in the task-based vector conversion step; A task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm; A clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a columnar data format; The analysis target distance value between the center of the analysis target cluster and the elements obtained from the data generated by the user in the analysis object business behavior of the user who uses the personal information through the log of the security product in the future and the business base distance value threshold stored in the clustering storage step And an abnormal pattern analysis step for determining whether or not an abnormal action is performed.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the configuration and operation of a personal information security product integrated control system and method according to the present invention will be described with reference to the accompanying drawings.

The personal information security product integrated control system according to the present invention includes a task-based data conversion unit 111 for converting data using personal information into business behavior list data through a log of a security product generated in a business action of a user, A business-based data extracting unit 112 for extracting a business behavior list obtained by the data converting unit 111 for each user, a business-based vector converting unit 113 for vectorizing a business behavior list extracted for each user, A task-based clustering processor 114 for forming a task-based cluster by clustering lists using a K-means algorithm, and a task calculating unit 114 for calculating a distance value threshold between the center and the elements of the task- Based threshold value calculation unit 115, a cluster of the task list in a column-format data format It comprises a profiled cluster storage module configured to store service-based clustering unit 116 to store.

The task-based data conversion unit 111 can generate task list data by defining and sorting data using personal information through a log of a security product generated by a user's business activity, with an index centering on a business activity. For example, when configured as 'business behavior 1', 'business behavior 2', and 'business behavior 3' on the basis of the business behavior of the user, the data conversion unit 111 converts these indices into '0' 1 ', and' 2 ', respectively. If there are three cases in which the user uses the personal information through the 'business behavior 1', the data conversion unit 111 converts the business behavior list into 'business behavior 1: 3'.

The task-based data extraction unit 112 extracts a task behavior list generated by the task-based data conversion unit 111 for each user. For example, if the user A is using three pieces of personal information through 'business behavior 1', the data extraction unit 112 extracts the business behavior list of the user A as 'business behavior 1: 3' If four pieces of personal information are used through 'business behavior 2', the data extraction unit 112 extracts the business behavior list of the user B as 'business behavior 2: 4'.

The task-based vector conversion unit 113 vectors the data of a general table structure into a sparse vector format that is efficient for clustering calculation. For example, when the data of one column is composed of values of 1, 0, 0, 0, 0, 0 and 5, the vector conversion unit 113 converts the data into (7, [0, 6] , 5]), which means that there is a value of [1,5] in the position of size 7 and index [0,6].

The task-based clustering processing unit 114 uses a K-means algorithm to group the given data into K clusters based on tasks.

The task-based threshold value calculation unit 115 calculates a threshold value of the center value of the cluster obtained by the clustering processing unit 114 and the distance value between the elements.

The task-based clustering storage unit 116 stores the task-based threshold value obtained by the threshold value calculation unit 115 for each cluster unit.

In addition, according to the present invention, the personal information security product integrated control system may include an analysis distance value of an analysis cluster obtained from data using personal information through a log of a security product generated by a user's subsequent business action, And an abnormal pattern determination module 126 that compares the obtained task-based distance value thresholds to determine whether the personal information accessing behavior is an abnormal pattern or a normal pattern.

The abnormal pattern analysis module includes an analysis data conversion unit 121 for generating an analysis action behavior list from data using personal information through a log of a security product generated by a user's subsequent business action, An analysis clustering processor 123 for forming an analysis cluster by using a K-average algorithm and a t-digest algorithm for computing a vectorized business behavior list; And an analysis distance value calculation unit 124 for calculating an analysis distance value between the center of the analysis cluster and the elements of the analysis cluster and a task for loading a threshold value of the task based cluster stored in the task based cluster storage unit of the profiling cluster storage module Based cluster loading unit 125.

Hereinafter, a method for integrating a personal information security product according to the present invention will be described with reference to FIG. 2 and FIG.

The method of integrating a personal information security product according to the present invention includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow; A business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user; A business-based vector conversion step of vectorizing a business behavior list extracted for each user in the business-based data extraction step; A task-based clustering processing step of forming a task-based cluster by clustering the vectorized business behavior list using the K-average algorithm in the task-based vector conversion step; A task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm; A clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a columnar data format; The analysis target distance value between the center of the analysis target cluster and the elements obtained from the data generated by the user in the analysis object business behavior of the user who uses the personal information through the log of the security product in the future and the business base distance value threshold stored in the clustering storage step And an abnormal pattern analysis step for determining whether or not an abnormal action is performed.

First, as shown in the following Table 1, it is exemplified that personal information is used through a log of security products generated by the business activities of three users (U001, U002, U003).

User ID	Business behavior list	Number of personal information use
U001	Business behavior 1	3
U002	Business Behavior 2	4
U003	Business behavior 3	One
U002	Business behavior 1	3
U003	Business behavior 1	3

In the profiling cluster storage module, as shown in Table 2 below, the task-based data conversion unit 111 defines and arranges indexes based on the business behavior of the data using the personal information by the user to generate business behavior list data (See step 211). For example, the task-based data conversion unit 111 defines 'business behavior 1', 'business behavior 2' and 'business behavior 3' as indices of '0', '1', and '2' do.

User ID	Business behavior list	Number of personal information use	index
U001	Business behavior 1	3	0
U002	Business Behavior 2	4	One
U003	Business behavior 3	One	2
U002	Business behavior 1	3	0
U003	Business behavior 1	3	0

In operation 212, the task-based data extraction unit 112 may extract a task behavior list for each user as illustrated in Table 3 below. Table 3 shows that U001 uses personal information through work behavior 1, U002 uses personal information through work behavior 1 and work behavior 2, and U003 uses personal information through work behavior 1 and work behavior 3. .

User ID	Index list	Business behavior list
U001	[0]	Business behavior 1: 3
U002	[0,1]	Business Behavior 1: 3, Business Behavior 2: 4
U003	[0,2]	Business Behavior 1: 3, Business Behavior 3: 1

In step 213, the task-based vector conversion unit 113 vectorizes the task behavior list extracted for each user as shown in Table 4 below. In the vector values in Table 4, the first value is the length of the log entire business activity index, the second value is the user business activity index, and the third value is the number of personal information utilization per user business index.

User ID	Vector Value
U001	(3, [0], [3])
U002	(3, [0, 1], [3,4])
U003	(3, [0, 2], [3, 1]

In step 214, the task-based clustering processor 114 forms a task-based cluster using the K-means algorithm as illustrated in Table 5 below.

User ID	Vector Value	Business-based clusters
U001	(3, [0], [3])	0
U002	(3, [0, 1], [3,4])	One
U003	(3, [0, 2], [3, 1]	0

In step 215, the task-based threshold calculation unit 115 calculates a distance value between the center of the user-specific cluster and the elements using the t-digest algorithm as illustrated in Table 6 below and calculates a threshold value. In Table 6, since the users U001 and U003 have the same task-based cluster, the distance from the center of the two users to the center of the cluster is calculated as 0.25, and the center of the user U002 is calculated as 0.0 because the user U002 is a single cluster.

User ID	Vector Value	Business-based clusters	Distance value
U001	(3, [0], [3])	0	0.25
U002	(3, [0, 1], [3,4])	One	0.0
U003	(3, [0, 2], [3, 1]	0	0.25

In step 216, the task-based clustering storage unit stores the task-based threshold value of the distance value for each cluster unit in the form of Table 7 below.

Business-based clusters	Distance value threshold
0	[0.25, 0.25]
One	[0.0]

After the task-based distance threshold value of the task-based cluster is obtained through the above-described process, if data using the personal information is newly input through the log of the security product that is caught by the action of the specific user, Calculate the analytical clusters and calculate the analytical distance. The calculated analysis distance value is compared with the task-based threshold value to determine whether the personal information use behavior of the specific user is abnormal pattern or normal pattern.

That is, in step 311, the analysis data conversion unit 121 converts the new personal information use count data into the business behavior list data through the log of the security product generated by the business activity of the specific user. The analysis vector conversion unit 122 converts the business behavior list of a specific user into a vector.

In step 312, the analysis clustering processing unit 123 forms a vectorized business behavior list of a specific user into an analysis cluster using a K-means algorithm, and the analysis distance value calculation unit 124 calculates the distance between the center of the analysis cluster and the elements Calculate the analytical distance value.

The task-based cluster loading unit 125 of the abnormal pattern analysis module loads the corresponding cluster stored in the cluster storage unit 116 and extracts a task-based threshold value (see steps 313 and 314).

In step 315, the abnormal pattern determination unit 127 compares the extracted task-based threshold value with the analysis distance value, and determines whether the personal information use behavior of the specific user is an abnormal pattern or a normal pattern. For example, if the analytical distance value is larger than the threshold value, it is determined as an abnormal pattern, and if it is the opposite, it is determined as a normal pattern.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined by the appended claims. shall.

Claims (4)

1. A task-based data conversion unit for converting the personal information utilization data using the personal information into the business behavior list data through the log of the security product generated by the user's business behavior; A business-based vector conversion unit for vectorizing the business behavior list extracted for each user, and a task-based clustering unit for clustering the vectorized business behavior list using a K-means algorithm to form a task-based cluster A task-based threshold value calculation unit for calculating a distance value threshold between the center of the task-based cluster and the elements using a t-digest algorithm; a clustering unit for storing the task-based cluster and the distance value threshold in a column- Pro that consists of storage Filing cluster storage module;

   And an abnormal pattern determination unit for comparing the analysis distance value of the cluster obtained from the business behavior list using the personal information with the task based threshold value obtained in the storage module through the log of the security product generated by the user's subsequent business action And an abnormal pattern analyzing module for analyzing the abnormality of the personal information security product.
2. The method according to claim 1,

   Wherein the abnormal pattern analysis module further comprises an analysis data conversion unit, an analysis vector conversion unit, an analysis clustering processing unit, an analysis distance value calculation unit, and a task-based cluster loading unit.
3. A task-based data conversion step of converting data generated by a user's business activity using personal information through a log of the security product into data of the business activity list and listing the data;

   A business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user;

   A business-based vector conversion step of vectorizing a business behavior list extracted for each user in the business-based data extraction step;

   A task-based clustering processing step of forming a task-based cluster by clustering the vectorized business behavior list using the K-average algorithm in the task-based vector conversion step;

   A task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm;

   A clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a columnar data format;

   The analysis target distance value between the center of the analysis target cluster and the elements obtained from the data generated by the user in the analysis object business behavior of the user who uses the personal information through the log of the security product in the future and the business base distance value threshold stored in the clustering storage step And an abnormal pattern analysis step of determining whether the abnormal operation is performed by comparing the abnormal operation pattern with the abnormal operation pattern.
4. The method of claim 3,

   The analysis target distance value between the center of the cluster to be analyzed and the elements,

   An analysis object data conversion step of converting the data generated by the user into an analysis object business behavior list, the object business behavior analysis object of the user who uses the personal information at a later time through the log of the security product;

   An analysis target vector conversion step of vectorizing the analysis target business behavior list generated in the analysis target data conversion step;

   An analysis object clustering processing step of forming a analysis object cluster by clustering an analysis target business action list vectorized in the analysis object vector conversion step using a K-means algorithm;

   and calculating a distance to be analyzed between the center of the analysis target cluster and elements to be analyzed formed in the analysis target clustering processing step using the t-digest algorithm. Way.

Images