WO2019017550A1 - Système et procédé de commande intégrée pour des produits de sécurité d'informations personnelles - Google Patents

Système et procédé de commande intégrée pour des produits de sécurité d'informations personnelles Download PDF

Info

Publication number
WO2019017550A1
WO2019017550A1 PCT/KR2018/002350 KR2018002350W WO2019017550A1 WO 2019017550 A1 WO2019017550 A1 WO 2019017550A1 KR 2018002350 W KR2018002350 W KR 2018002350W WO 2019017550 A1 WO2019017550 A1 WO 2019017550A1
Authority
WO
WIPO (PCT)
Prior art keywords
task
business
cluster
data
user
Prior art date
Application number
PCT/KR2018/002350
Other languages
English (en)
Korean (ko)
Inventor
김현철
Original Assignee
주식회사 삼오씨엔에스
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from KR1020170091386A external-priority patent/KR101810860B1/ko
Priority claimed from KR1020170169516A external-priority patent/KR101933712B1/ko
Application filed by 주식회사 삼오씨엔에스 filed Critical 주식회사 삼오씨엔에스
Publication of WO2019017550A1 publication Critical patent/WO2019017550A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules

Definitions

  • the present invention relates to a monitoring system and method for monitoring a personal information use record of a user accessing personal information data, and more particularly, And to a system and method for integrating and controlling personal information security products capable of judging whether or not the information is leaked.
  • a plurality of execution servers connected through a wired / wireless communication network such as the Internet and a wireless network are constructed in a government agency, a corporation, a bank, a research institute, or a school. Respectively. These plurality of execution servers are connected to the security system.
  • log information about the security system is analyzed to prevent information leakage. For example, if the log of the heterogeneous security system is integrated and the simple lookup and behavior conforms to the predefined definition, it is determined to be a normal behavior pattern. Otherwise, the abnormal behavior pattern is determined.
  • Korean Patent Laid-Open Publication No. 10-2014-0088712 includes a monitoring unit for monitoring an access status of personal information and detecting an abnormal transaction; A monitoring unit that receives the output of the monitoring unit and monitors the status of personal information access in real time; And a control unit for controlling the monitoring unit, the monitoring unit, and the log management unit.
  • the control unit controls the monitoring unit, the monitoring unit, and the log management unit to analyze and track the path of the application accessing the personal information from the personal information access status output through the monitoring unit.
  • QCL separation index
  • Korean Patent Registration No. 10-0980117 discloses a data collection step of collecting data on individual behaviors of a person to be evaluated; A user data warehouse establishing step of performing user standardization and storing the result; A data mart constructing step of constructing a data mart by grasping an individual commerce behavior, an abandonment behavior exceeding a normal behavior, an abnormal behavior by a person, and a relationship of a personal network according to a security risk assessment item; A step of analyzing and calculating a personal action security risk by assigning a security step weight assigned to each action to a user defined action built in the data mart; Personal networking security risk analysis and calculation step that gives personal network security risk; Discloses an internal information leakage threat analysis method comprising an individual personnel security risk analysis and calculation step for assigning individual personnel security risk and an individual security risk analysis and calculation step for calculating individual security risks by combining the above three security risks.
  • Korean Patent Laid-Open Publication No. 10-2014-0035146 (Prior Art 3) includes a log information collection unit for collecting log information for each of a plurality of users; A standardization database for integrating log information and user information for each user to construct an integrated database; Discloses an information security apparatus including a pattern extracting unit for extracting a pattern for each user and defining a normal pattern from a pattern for each user, and a pattern analyzing unit for comparing a pattern for each user with a normal pattern to determine whether or not a security risk exists.
  • Korean Patent Laid-Open Publication No. 10-2010-0121896 includes a step of acquiring a plurality of user situation information; Applying each of the user context information to individual rules of the individual rule database to deduce a prediction result according to each user context information; Generating a prediction pattern according to user context information from the inferred prediction result;
  • a pattern-based prediction method comprising the steps of: searching for a pattern matching a predictive pattern among a correct answer pattern or an incorrect answer pattern stored in a pattern database; and predicting the next situation to be experienced by the user according to the search result.
  • Korean Patent Registration No. 10-1462608 discloses a data collection unit for collecting user data; A big data DB accumulating collected user data; A data mining unit for analyzing data on the big data to pattern user-specific data, determining a characteristic type for each behavior type of a user-specific pattern, and setting an abnormal symptom patterning criterion through the identified behavior type characteristic selection; A modeling unit for setting an abnormality symptom judgment reference using a sagittal symptom patterning criterion; There is disclosed an adaptive big data processing based abnormality symptom detection system including a data collection state in which an abnormal symptom judgment criterion set by a modeling unit is applied to user data provided by a data collecting unit to determine an abnormal symptom in a context adaptive manner.
  • the systems disclosed in the prior arts detect a user's abnormal behavior pattern on the basis of a predetermined normal pattern based on the statistical number, which makes it difficult to trace intelligent personal information leakage.
  • the prior art causes a problem in that, when new data is generated or a standard of action is changed, a new rule can be defined to define it.
  • the present invention has been proposed in order to solve the conventional problems as described above, and it is an object of the present invention to provide a system and method for integrating a personal information security product, have.
  • Another object of the present invention is to provide a personal information security product integration control system capable of reducing the ratio of false positive or false negative that can be caused by using a statistical rule-based analysis method for fixing an anomaly pattern in advance System and method.
  • Another object of the present invention is to provide a personal information security product integrated control system capable of reducing the ratio of positive or negative errors by analyzing a user's business behavior with respect to logs generated and collected without fixing an abnormal pattern in advance There is.
  • a personal information security product integrated control system converts personal information utilization data using personal information into business behavior list data through a log of a security product generated in a user's business behavior
  • a task-based data conversion unit for extracting a business behavior list obtained by the data conversion unit by a user, a task-based vector conversion unit for vectorizing a business behavior list extracted for each user, Based clustering processing unit for forming a task-based cluster by clustering using a K-means algorithm and a task-based threshold calculation unit for calculating a distance value threshold between the center and elements of the task-based cluster using a t-digest algorithm ,
  • An abnormal pattern judgment for judging whether an abnormal behavior is made by comparing the analysis distance value of the cluster obtained from the business behavior list used for personal information through the log of the security product generated by the user's subsequent business action and the task based
  • the abnormal pattern analysis module further includes an analysis data conversion unit, an analysis vector conversion unit, an analysis clustering processing unit, an analysis distance value calculation unit, and a task-based cluster loading unit.
  • the method of integrating a personal information security product includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow;
  • a business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user;
  • a task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm;
  • a clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a column
  • the analysis target distance value between the center of the analysis target cluster and the elements is converted into an analysis target business behavior list by data generated as the analysis target business behavior of the user who uses the personal information at a later time through the log of the security product
  • An analysis target data conversion step An analysis target vector conversion step of vectorizing the analysis target business behavior list generated in the analysis target data conversion step;
  • An analysis object clustering processing step of forming a analysis object cluster by clustering an analysis target business action list vectorized in the analysis object vector conversion step using a K-means algorithm; and a target distance value calculation step of calculating a target distance value between the center of the target cluster and the elements formed in the target clustering processing step using the t-digest algorithm.
  • the integrated information security product integrated control system and method analyze a business activity of a user who uses personal information through a log of a security product generated by a user's business activity without fixing an abnormal pattern in advance, The ratio of errors can be reduced.
  • FIG. 1 is a block diagram of a personal information security product integrated control system according to the present invention.
  • FIG. 2 is a flowchart illustrating an operation state of a profiling cluster storage module of a personal information security product integrated control system according to the present invention.
  • FIG. 3 is a flowchart illustrating an operation state of an abnormal pattern analysis module of the integrated personal information security product control system according to the present invention.
  • the personal information security product integrated control system includes a task-based data conversion unit for converting personal information utilization data using personal information into business activity list data through a log of a security product generated by a business activity of a user, A task-based vector conversion unit for vectorizing a business behavior list extracted for each user; a vector-based business behavior list, which uses a K-average algorithm; A task-based clustering processor for clustering the task-based clusters to form a task-based cluster, a task-based threshold calculator for calculating a distance value threshold between the center and elements of the task-based cluster using a t-digest algorithm, The value threshold is stored in a column-type datapo A profiling cluster storage module configured with a clustering storage unit for storing the data; An abnormal pattern judgment for judging whether an abnormal behavior is made by comparing the analysis distance value of the cluster obtained from the business behavior list used for personal information through the log of the security product generated by the user's subsequent business action and the task based distance value threshold obtained from the storage module And an abnormal
  • the method of integrating a personal information security product includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow;
  • a business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user;
  • a task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm;
  • a clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a column
  • the personal information security product integrated control system includes a task-based data conversion unit 111 for converting data using personal information into business behavior list data through a log of a security product generated in a business action of a user, A business-based data extracting unit 112 for extracting a business behavior list obtained by the data converting unit 111 for each user, a business-based vector converting unit 113 for vectorizing a business behavior list extracted for each user, A task-based clustering processor 114 for forming a task-based cluster by clustering lists using a K-means algorithm, and a task calculating unit 114 for calculating a distance value threshold between the center and the elements of the task- Based threshold value calculation unit 115, a cluster of the task list in a column-format data format It comprises a profiled cluster storage module configured to store service-based clustering unit 116 to store.
  • the task-based data conversion unit 111 can generate task list data by defining and sorting data using personal information through a log of a security product generated by a user's business activity, with an index centering on a business activity. For example, when configured as 'business behavior 1', 'business behavior 2', and 'business behavior 3' on the basis of the business behavior of the user, the data conversion unit 111 converts these indices into '0' 1 ', and' 2 ', respectively. If there are three cases in which the user uses the personal information through the 'business behavior 1', the data conversion unit 111 converts the business behavior list into 'business behavior 1: 3'.
  • the task-based data extraction unit 112 extracts a task behavior list generated by the task-based data conversion unit 111 for each user. For example, if the user A is using three pieces of personal information through 'business behavior 1', the data extraction unit 112 extracts the business behavior list of the user A as 'business behavior 1: 3' If four pieces of personal information are used through 'business behavior 2', the data extraction unit 112 extracts the business behavior list of the user B as 'business behavior 2: 4'.
  • the task-based vector conversion unit 113 vectors the data of a general table structure into a sparse vector format that is efficient for clustering calculation. For example, when the data of one column is composed of values of 1, 0, 0, 0, 0, 0 and 5, the vector conversion unit 113 converts the data into (7, [0, 6] , 5]), which means that there is a value of [1,5] in the position of size 7 and index [0,6].
  • the task-based clustering processing unit 114 uses a K-means algorithm to group the given data into K clusters based on tasks.
  • the task-based threshold value calculation unit 115 calculates a threshold value of the center value of the cluster obtained by the clustering processing unit 114 and the distance value between the elements.
  • the task-based clustering storage unit 116 stores the task-based threshold value obtained by the threshold value calculation unit 115 for each cluster unit.
  • the personal information security product integrated control system may include an analysis distance value of an analysis cluster obtained from data using personal information through a log of a security product generated by a user's subsequent business action, And an abnormal pattern determination module 126 that compares the obtained task-based distance value thresholds to determine whether the personal information accessing behavior is an abnormal pattern or a normal pattern.
  • the abnormal pattern analysis module includes an analysis data conversion unit 121 for generating an analysis action behavior list from data using personal information through a log of a security product generated by a user's subsequent business action, An analysis clustering processor 123 for forming an analysis cluster by using a K-average algorithm and a t-digest algorithm for computing a vectorized business behavior list; And an analysis distance value calculation unit 124 for calculating an analysis distance value between the center of the analysis cluster and the elements of the analysis cluster and a task for loading a threshold value of the task based cluster stored in the task based cluster storage unit of the profiling cluster storage module Based cluster loading unit 125.
  • the method of integrating a personal information security product includes a task-based data conversion step of converting data generated by a user's business activity using personal information through a log of a security product into data of a business activity list, Wow;
  • a business-based data extracting step of extracting a business behavior list obtained in the business-based data conversion step for each user;
  • a task-based threshold value calculation step of calculating a task-based distance value threshold between the center of the task-based cluster formed in the task-based clustering processing step and the elements using the t-digest algorithm;
  • a clustering storage step of storing the distance value thresholds calculated in the task-based cluster and the task-based threshold calculation step formed in the task-based clustering process step in a column
  • the task-based data conversion unit 111 defines and arranges indexes based on the business behavior of the data using the personal information by the user to generate business behavior list data (See step 211). For example, the task-based data conversion unit 111 defines 'business behavior 1', 'business behavior 2' and 'business behavior 3' as indices of '0', '1', and '2' do.
  • the task-based data extraction unit 112 may extract a task behavior list for each user as illustrated in Table 3 below.
  • Table 3 shows that U001 uses personal information through work behavior 1, U002 uses personal information through work behavior 1 and work behavior 2, and U003 uses personal information through work behavior 1 and work behavior 3. .
  • the task-based vector conversion unit 113 vectorizes the task behavior list extracted for each user as shown in Table 4 below.
  • the first value is the length of the log entire business activity index
  • the second value is the user business activity index
  • the third value is the number of personal information utilization per user business index.
  • step 214 the task-based clustering processor 114 forms a task-based cluster using the K-means algorithm as illustrated in Table 5 below.
  • the task-based threshold calculation unit 115 calculates a distance value between the center of the user-specific cluster and the elements using the t-digest algorithm as illustrated in Table 6 below and calculates a threshold value.
  • Table 6 since the users U001 and U003 have the same task-based cluster, the distance from the center of the two users to the center of the cluster is calculated as 0.25, and the center of the user U002 is calculated as 0.0 because the user U002 is a single cluster.
  • the task-based clustering storage unit stores the task-based threshold value of the distance value for each cluster unit in the form of Table 7 below.
  • the task-based distance threshold value of the task-based cluster is obtained through the above-described process, if data using the personal information is newly input through the log of the security product that is caught by the action of the specific user, Calculate the analytical clusters and calculate the analytical distance. The calculated analysis distance value is compared with the task-based threshold value to determine whether the personal information use behavior of the specific user is abnormal pattern or normal pattern.
  • step 311 the analysis data conversion unit 121 converts the new personal information use count data into the business behavior list data through the log of the security product generated by the business activity of the specific user.
  • the analysis vector conversion unit 122 converts the business behavior list of a specific user into a vector.
  • step 312 the analysis clustering processing unit 123 forms a vectorized business behavior list of a specific user into an analysis cluster using a K-means algorithm, and the analysis distance value calculation unit 124 calculates the distance between the center of the analysis cluster and the elements Calculate the analytical distance value.
  • the task-based cluster loading unit 125 of the abnormal pattern analysis module loads the corresponding cluster stored in the cluster storage unit 116 and extracts a task-based threshold value (see steps 313 and 314).
  • the abnormal pattern determination unit 127 compares the extracted task-based threshold value with the analysis distance value, and determines whether the personal information use behavior of the specific user is an abnormal pattern or a normal pattern. For example, if the analytical distance value is larger than the threshold value, it is determined as an abnormal pattern, and if it is the opposite, it is determined as a normal pattern.

Abstract

La présente invention se rapporte à un système et à un procédé de commande intégrée pour des produits de sécurité d'informations personnelles, et qui comprennent : un module de stockage de groupe de profilage comprenant une unité de conversion de données basée sur le travail destinée à convertir des données, qui résultent de comportements de travail d'utilisateurs à l'aide d'informations personnelles, en données de liste de comportements de travail, une unité d'extraction de données basée sur le travail destinée à extraire des listes de comportements de travail, acquises de l'unité de conversion de données, selon des utilisateurs, une unité de conversion de vecteur basée sur le travail destinée à vectoriser les listes de comportements de travail extraites selon des utilisateurs, une unité de regroupement basée sur le travail destinée à former un groupe basé sur le travail par regroupement des listes de comportements de travail vectorisées en utilisant l'algorithme des k-moyennes, une unité de calcul de valeur de seuil basée sur le travail destinée à calculer une valeur de seuil de distance pour des distances entre le centre du groupe basé sur le travail et des éléments de ce dernier en utilisant l'algorithme de t prétraitements, une unité de stockage de regroupement destinée à stocker le groupe basé sur le travail et la valeur de seuil de distance dans un format de données de type colonne ; et un module d'analyse de motif anormal comprenant une unité de détermination de motif anormal destinée à déterminer si un comportement d'accès ultérieur d'un utilisateur à des informations personnelles est un comportement anormal, en comparant une valeur de distance de groupe analysée dérivée du comportement d'accès ultérieur avec la valeur de seuil de distance basée sur le travail acquise du module de stockage. Par conséquent, il est possible de réduire le taux faux positif ou le taux faux négatif en analysant un comportement de travail d'un utilisateur par le biais de journaux créés et collectés sans fixer à l'avance des motifs anormaux.
PCT/KR2018/002350 2017-07-19 2018-02-27 Système et procédé de commande intégrée pour des produits de sécurité d'informations personnelles WO2019017550A1 (fr)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
KR10-2017-0091386 2017-07-19
KR1020170091386A KR101810860B1 (ko) 2017-07-19 2017-07-19 개인정보 보안제품 통합관제 시스템
KR10-2017-0169516 2017-07-19
KR1020170169516A KR101933712B1 (ko) 2017-07-19 2017-12-11 개인정보 보안제품 통합관제 방법

Publications (1)

Publication Number Publication Date
WO2019017550A1 true WO2019017550A1 (fr) 2019-01-24

Family

ID=65016202

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2018/002350 WO2019017550A1 (fr) 2017-07-19 2018-02-27 Système et procédé de commande intégrée pour des produits de sécurité d'informations personnelles

Country Status (1)

Country Link
WO (1) WO2019017550A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110493176A (zh) * 2019-07-02 2019-11-22 北京科东电力控制系统有限责任公司 一种基于非监督机器学习的用户可疑行为分析方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120070299A (ko) * 2010-12-21 2012-06-29 한국전자통신연구원 적응형 보안 모델 생성 장치 및 방법
KR101478233B1 (ko) * 2014-08-01 2015-01-06 (주)세이퍼존 적응형 빅데이타 처리 기반 업무자 평가 시스템
KR20150009798A (ko) * 2013-07-17 2015-01-27 채중석 개인 정보 상시 감시 시스템 및 그 상시 감시 방법
KR20160113826A (ko) * 2015-03-23 2016-10-04 목포대학교산학협력단 빅데이터 클러스터링을 위한 Ｋ-Ｍｅａｎｓ 초기 중심 선정 방법
KR101663288B1 (ko) * 2015-09-04 2016-10-07 (주)이지서티 개인정보 모니터링 시스템 및 방법

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120070299A (ko) * 2010-12-21 2012-06-29 한국전자통신연구원 적응형 보안 모델 생성 장치 및 방법
KR20150009798A (ko) * 2013-07-17 2015-01-27 채중석 개인 정보 상시 감시 시스템 및 그 상시 감시 방법
KR101478233B1 (ko) * 2014-08-01 2015-01-06 (주)세이퍼존 적응형 빅데이타 처리 기반 업무자 평가 시스템
KR20160113826A (ko) * 2015-03-23 2016-10-04 목포대학교산학협력단 빅데이터 클러스터링을 위한 Ｋ-Ｍｅａｎｓ 초기 중심 선정 방법
KR101663288B1 (ko) * 2015-09-04 2016-10-07 (주)이지서티 개인정보 모니터링 시스템 및 방법

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110493176A (zh) * 2019-07-02 2019-11-22 北京科东电力控制系统有限责任公司 一种基于非监督机器学习的用户可疑行为分析方法及系统

Similar Documents

Publication Publication Date Title
CN111475804B (zh) 一种告警预测方法及系统
Dasgupta et al. An immunity-based technique to characterize intrusions in computer networks
US8443443B2 (en) Security system and method for detecting intrusion in a computerized system
CN112491796B (zh) 一种基于卷积神经网络的入侵检测及语义决策树量化解释方法
CN109818798A (zh) 一种融合kpca和elm的无线传感器网络入侵检测系统及方法
WO2017155292A1 (fr) Procédé de détection d'anomalie et programme de détection d'anomalie
CN111614690A (zh) 一种异常行为检测方法及装置
CN111538741B (zh) 一种面向警情大数据的深度学习分析方法及系统
CN109547479A (zh) 一种工业环境中威胁情报整合系统和方法
WO2020122487A1 (fr) Système de prédiction de faillite d'une société et procédé de fonctionnement correspondant
CN104615936B (zh) 云平台vmm层行为监控方法
KR101810860B1 (ko) 개인정보 보안제품 통합관제 시스템
CN113706100B (zh) 配电网物联终端设备实时探测识别方法与系统
Oladimeji et al. Review on insider threat detection techniques
Lambert II Security analytics: Using deep learning to detect Cyber Attacks
CN110716957A (zh) 类案可疑对象智能挖掘分析方法
Arya et al. Ensemble Filter-based Feature Selection Model for Cyber Attack Detection in Industrial Internet of Things
WO2019017550A1 (fr) Système et procédé de commande intégrée pour des produits de sécurité d'informations personnelles
Sathya Ensemble Machine Learning Techniques for Attack Prediction in NIDS Environment
KR101933712B1 (ko) 개인정보 보안제품 통합관제 방법
CN116545679A (zh) 一种工业情境安全基础框架及网络攻击行为特征分析方法
Salek et al. Intrusion detection using neuarl networks trained by differential evaluation algorithm
KR102410151B1 (ko) 서버 시스템 로그를 이용한 머신러닝 기반의 관측레벨 측정 및 이에 따른 위험도 산출 방법, 장치 및 컴퓨터-판독 가능 기록 매체
CN116186759A (zh) 一种面向隐私计算的敏感数据识别与脱敏方法
CN113657443B (zh) 一种基于soinn网络的在线物联网设备识别方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18834820

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18834820

Country of ref document: EP

Kind code of ref document: A1