WO2021080111A1 - Method and electronic device for estimating confidential information leakage - Google Patents

Abstract

The present invention relates to a method and an electronic device for estimating confidential information leakage. A method for estimating confidential information leakage, according to one embodiment of the present invention, as a method by which an electronic device estimates confidential information leakage by generating a confidential information leakage possibility index for a member or an event comprises: a setting step of setting the weights and grades of a plurality of first classification items for the member or of a plurality of second classification items for the event; and a calculation step of calculating the confidential information leakage possibility index for the member or the event on the basis of the set weights and grades of the respective classification items, wherein the event includes operations of file transmission through a network or file export to another storage medium.

Description

Confidential leak estimation method and electronic device

The present invention relates to a method for estimating confidential leakage and an electronic device, and more particularly, by indicating and presenting the possibility of leakage of confidentiality of an organization in an IT (Information Technology) environment, making it easier to audit during the detection and control of confidential leakage of an organization. It relates to a method and an electronic device enabling selection of a target candidate.

Conventional confidential leakage prevention technology (hereinafter, referred to as “conventional technology”) can detect confidential leakage by examining whether various predefined information patterns are leaked from within the organization to the outside. In particular, the prior art may perform a function of allowing or blocking a confidential export set according to a security management policy and leaving a log thereof. In addition, the prior art also provides a function of encryption and access control in which transmission information is encrypted, but the information is received only from an authorized destination and decrypted.

However, in the case of such a conventional technology, only a log according to whether or not to block or allow information to be exported is provided, and the possibility of an organization's confidential leakage cannot be specifically indexed and provided. That is, the prior art has a limitation in that it is not possible to provide data that can be the basis for the identification of an organization member or a candidate to be audited for a task in the organization during the detection and control of confidential leakage of an organization.

In order to solve the problems of the prior art as described above, the present invention provides an indicator of the possibility of leakage of organizational confidentiality in the IT (Information Technology) environment. It is an object of the present invention to provide a method and an electronic device for estimating confidential leakage that enables selection.

However, the problem to be solved by the present invention is not limited to the problems mentioned above, and other problems that are not mentioned can be clearly understood by those of ordinary skill in the art from the following description. There will be.

The method of estimating confidential leakage according to an embodiment of the present invention for solving the above problems is performed by an electronic device, and is a method of estimating confidential leakage through generation of a confidential leakage probability index for an organization member or event, ( 1) A setting step of setting the weight and grade of a plurality of first classification items for an organization member or a plurality of second classification items for an event, (2) And a calculation step for calculating an indicator of the likelihood of a confidential leak.

The event may include a file transfer operation through a network or a file export operation to another storage medium.

The method of estimating confidential leakage according to an embodiment of the present invention may further include selecting an organization member or event of the corresponding index as a candidate for audit when the calculated confidential leakage probability index deviates from the reference index.

The weight of each classification item or the reference index may be set using a machine learning technique.

The first category may include a department, a job title, a task, a working period, a time and attendance status, or a possibility of a turnover.

The setting step may include, in the first category, setting the current status of attendance or job turnover as a greater proportion than the department, position, job, or working period, but setting the working period as the smallest proportion.

In the setting step, in the first category, as the handling information according to the department, position, or job of an organization member requires higher confidentiality, a higher grade is set for the first category item of the department, position, or job, and the number of years of service is The longer the work period is, the lower the level is set for the first category of the working period, and the higher the number of late, unexcused, overtime, or holiday work within the latest period, the higher the level of the first category of attendance status is set. can do.

The second classification item may include information confidentiality, information value, security measures, information destination, information transmission location, information transmission time, frequency of occurrence of a member of the present organization, or frequency of occurrence of other members of the organization.

In the setting step, in the second category, information value, security measures, or information destination are set to be less than information confidentiality, information transmission location, information transmission time, frequency of occurrence of the member of the organization, or frequency of occurrence of other members of the organization, but information confidentiality. It may include the step of setting the highest specific gravity.

In the setting step, in the second classification item, the higher the information confidentiality, information value, or security measure is, the higher the rating is set for the second classification item, and as the information destination or information transmission place is a destination or place other than designated, the second It includes setting a higher grade for the classification item, setting a higher grade for the second classification item when the information transmission time is outside business hours, and setting a lower grade for the higher frequency of occurrence of other members of the organization. can do.

The calculation step includes calculating an individual classification score for each classification item set using the following [Equation 1] and [Equation 2], and then deriving a confidential leak probability index using the sum of the individual classification scores. I can.

[Equation 1]

(However, i is a natural number, G _i is the i-th category, W _i is the weight of the i-th category, W _S is the sum of the highest ratings of each set category, and C is a constant)

[Equation 2]

(However, S _i is the individual classification score _{of the i-th classification item, R i} is the set grade of the i-th classification item)

An electronic device according to an embodiment of the present invention is an electronic device for estimating confidential leakage by generating a confidential leakage probability indicator for an organization member or event, and includes (1) a plurality of first classification items or events for an organization member. And an input unit for setting the weight and grade of the second classification items, and (2) a control unit for controlling to calculate a confidential leak probability index for an organization member or event based on the weight and grade of each classified item.

The event may include a file transfer operation through a network or a file export operation to another storage medium.

The control unit may set the weight of each classification item or the reference index using a machine learning technique.

When the calculated confidential leak probability index deviates from the standard index, the control unit may select an organization member or event of the corresponding index as a candidate for auditing.

The weight of each classification item or the reference index may be set using a machine learning technique.

The first category may include a department, a job title, a task, a working period, a time and attendance status, or a possibility of a turnover.

In the first category, the control unit may set the T&A status or job turnover as a greater proportion than the department, position, job, or working period, but may set the working period as the smallest proportion.

In the first category, the control unit sets a higher grade for the first category of department, position, or job as the handling information according to the department, position, or task of the member of the organization requires higher confidentiality, and the longer the number of years of service is A lower grade is set for the first category item of the working period, and a higher grade may be set for the first category item of the T&A status as the number of late, unexcused absences, overtime or holiday work within a certain latest period increases.

The second classification item may include information confidentiality, information value, security measures, information destination, information transmission location, information transmission time, frequency of occurrence of a member of the present organization, or frequency of occurrence of other members of the organization.

In the second category, the control unit sets the information value, security measures, or destination to be less than the information confidentiality, information transmission location, information transmission time, frequency of occurrence of the member of the organization, or frequency of occurrence of other members of the organization, but the information confidentiality is the most. It can be set to a large weight.

In the second classification item, the control unit sets a higher rating for the second classification item as the information confidentiality, information value, or security measure is greater, and the second classification as the information destination or information transmission place is a destination or place other than designated. A higher grade is set for the item, and the lower the grade is set for the second category item when the information is transmitted outside business hours, and the lower grade is set as the frequency of occurrence of the member of the organization or of other members of the organization is large. Can be set.

After calculating the individual classification score for each classification item set using the following [Equation 1] and [Equation 2], the control unit may derive a confidential leak probability index using the sum of the individual classification scores.

[Equation 1]

(However, i is a natural number, G _i is the i-th category, W _i is the weight of the i-th category, W _S is the sum of the highest ratings of each set category, and C is a constant)

[Equation 2]

(However, S _i is the individual classification score _{of the i-th classification item, R i} is the set grade of the i-th classification item)

The present invention constituted as described above has the advantage of enabling easier selection of audit target candidates in the case of the organization's confidential leakage detection and control work by indicating and presenting the possibility of leakage of organizational confidentiality in the IT environment.

That is, the present invention provides a method of calculating an index for selecting an organization member or event that may be estimated to have a high probability of confidential leakage, and through this, the difficulty in selecting candidates for audit is solved, so that confidential leakage audit activities are actually confidential. It allows you to focus on members or events that are likely to be leaked.

In addition, the present invention applies a machine learning technique by reflecting the calculated leak probability index and the previously performed audit result for confidential leak (conventional audit result), thereby establishing a standard for leak probability index for selecting candidates for audit. Through this, there is an advantage that each classification item for calculating a confidential leak probability index can be modified to suit the organization and applied to better reflect the actual leak probability.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those of ordinary skill in the art from the following description. will be.

1 is a block diagram of an electronic device 100 according to an embodiment of the present invention.

2 is a flowchart of a method for estimating confidential leakage according to an embodiment of the present invention.

[Explanation of code]

100: terminal 110: input unit

120: storage unit 130: communication unit

140: display unit 150: control unit

The above objects and means of the present invention and effects thereof will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, those of ordinary skill in the technical field to which the present invention pertains to facilitate the technical idea of the present invention. I will be able to do it. In addition, in describing the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted.

Unless otherwise defined, all terms used in the present specification may be used with meanings that can be commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not interpreted ideally or excessively unless explicitly defined specifically.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 shows a configuration diagram of an electronic device 100 according to an embodiment of the present invention.

The electronic device 100 (hereinafter, referred to as "the electronic device") according to an embodiment of the present invention is a'organization member' belonging to a certain organization (for example, a company, etc.) or a'event' performed by the member. It can be estimated whether or not the confidentiality of the organization is leaked. In particular, the electronic device 100 may present the possibility of whether or not the confidentiality of the organization is leaked by generating an index calculated in the form of a score called a'confidential leakage probability index'. In other words, it is possible to estimate whether or not the confidentiality of the organization is leaked. In particular, the electronic device 100 may select candidates for auditing related to confidentiality leakage using an indicator of possible confidentiality leakage, or provide the corresponding indicator to the management department of the organization, so that the management department can select candidates for auditing. have. That is, the electronic device 100 may contribute to more easily selecting an audit target when performing a confidential leak detection and control task within an organization.

For example, the electronic device 100 is a desktop personal computer (PC), a laptop personal computer (PC), a tablet personal computer (PC), a netbook computer, a workstation, and a personal digital assistant (PDA). digital assistant), a smart phone, a smart pad, or a mobile phone, but is not limited thereto.

In the present invention,'confidential' may refer to information that is allowed only for a specific department, position, task, or organization member within an organization, and not otherwise. In addition,'leakage' may refer to a case of abnormally transmitting or carrying out confidentiality. In this case, the information may refer to a physical file (document) as well as an electronic file (eg, a computer file).

The transmission type of information including confidential information can be'online transmission type' through a network, and'offline exportation' that is stored in another storage medium (ie, a storage medium other than the storage unit 120 in the storage device 100). It can also be a form'. The online transmission form may be shortened to be referred to as'transmission', and offline export form transmission may be shortened to be referred to as'export', but the two terms may be used interchangeably or interchangeably.

For example, the online transmission form may include e-mail transmission, web transmission, cloud transmission, chat transmission, or peer to peer (P2P) transmission, and the offline export type is export to portable memory, export to external hard drive, CD /Export to DVD or to a memory of another electronic device may be included, but is not limited thereto. In this case, the portable memory may include a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a Mini SD card, or a Micro SD card, and the memory of another electronic device is a USB port of the electronic device 100. It may be an internal memory or an external memory of another electronic device such as a tablet personal computer (PC), a personal digital assistant (PDA), a smartphone, a smartpad, or a mobile phone connected through a tablet PC (tablet personal computer), a personal digital assistant (PDA), a smartphone, or a mobile phone. However, it is not limited thereto.

The management department of the organization can manage confidentiality through the electronic device 100, and at this time, a classification system can be established by assigning a confidentiality level according to the degree of confidentiality, and this can be used to select candidates for auditing related to confidentiality leakage. I can. At this time, current and former members of the organization may be candidates for auditing, and an event, that is, an individual activity by the member of the organization, that is, each activity in the form of online transmission or offline transmission may be the candidate for auditing.

Specifically, the electronic device 100 may include an input unit 110, a storage unit 120, a communication unit 130, a display unit 140, a control unit 150, and the like, as shown in FIG. 1. .

The input unit 110 is a component that receives various types of information. That is, the input unit 110 generates input data in response to a user's input. The input unit 110 may include at least one input means. In particular, the input unit 110 may receive a selection of a plurality of classification items, setting of a weight and a grade of each selected classification item, etc. from a manager belonging to the management department of the organization. For example, the input unit 110 is a keyboard (key board), a keypad (key pad), a dome switch (dome switch), a touch panel (touch panel), a touch key (touch key), a mouse (mouse), or a menu button (menu button) may be included, but is not limited thereto.

The storage unit 120 is a component that stores various types of information. That is, the storage unit 120 may store various types of information and software necessary for the operation of the electronic device 100. In particular, the storage unit 120 may store an organization member, a classification item, selection information on a plurality of classification items, setting information on the weight and grade of each selected classification item, information for calculating a confidential leak probability index, and the like. For example, the storage unit 120 may have a hard disk type, a magnetic media type, a compact disc read only memory (CD-ROM), an optical recording medium type according to its type. type), Sagneto-optical media type, multimedia card micro type, flash memory type, read only memory type, or RAM type ( random access memory type), but is not limited thereto. In addition, the storage unit 120 may be a cache, a buffer, a main memory device, an auxiliary memory device, or a storage system separately provided depending on its purpose/location, but is not limited thereto.

The communication unit 130 is a component that communicates with the server 20 and the like. In this case, the communication unit 130 may include a wired/wireless communication module of various communication methods. In particular, the communication unit 130 may receive selection of a plurality of classification items, setting of the weight and grade of each selected classification item, etc. from other terminals or servers such as an administrator belonging to the management department of the organization. For example, the communication unit 130 is 5G (5th generation communication), LTE-A (long term evolution-advanced), LTE (long term evolution), Bluetooth, BLE (bluetooth low energe), or NFC (near field communication) Wireless communication such as, etc. may be performed, and wired communication such as cable communication may be performed, but is not limited thereto.

The display unit 140 is a component that displays display data according to an operation of the electronic device 100. For example, the display unit 140 includes a liquid crystal display (LCD), a light emitting diode (LED) display, an organic light emitting diode (OLED) display, and a microelectromechanical system (MEMS). electro mechanical systems) display, or electronic paper display, but is not limited thereto. In addition, the display unit 140 may be combined with the input unit 110 to be implemented as a touch screen or the like.

The control unit 150 is a component that controls the input unit 110, the storage unit 120, the communication unit 130, the display unit 140, etc. In particular, the control unit 150 controls the execution of a confidentiality estimation method to be described later. That is, the control unit 150 may control a function of estimating confidential leakage by generating a confidential leakage probability index, which may be performed through software (program) installed in the storage unit 120. For example, the controller 150 may be a processor such as a CUP, or software (program) executed by the processor, but is not limited thereto.

Hereinafter, a method for estimating confidential leakage according to an embodiment of the present invention will be described.

2 is a flowchart of a method for estimating confidential leakage according to an embodiment of the present invention.

The method for estimating confidential leakage according to an embodiment of the present invention (hereinafter referred to as “this method”) may include S100 to S400, as shown in FIG. 2, but S400 is not an essential configuration and is selectively performed. It could be.

That is, S100 is a step of selecting a plurality of classification items, and S200 is a step of setting the weight and grade for each classification item selected in S100. However, the selection information according to S100 or the setting information according to S200 is received from the administrator through the input unit 110 (hereinafter referred to as “first example”) or received through the communication unit 130 (hereinafter, “second example”). In addition, the controller 150 may arbitrarily select (hereinafter, referred to as “third example”) for application of a machine learning technique to be described later. However, the active expression or passive expression for S100 or S200 in the following description or claims may mean including at least one of the operations of the first to third examples. However, even if the operation of the third example is performed, it may be preferable that the selection information according to the initial S100 or the setting information according to the S200 is selected and set according to the operation of the first example or the second example.

In addition, S300 is a step of calculating a confidential leak probability index for an organization member or event based on the weight and grade of each classification item set in S200. In addition, S400 is a step of selecting an organization member or event of the corresponding indicator as a candidate for audit when the confidential leak probability indicator calculated in S300 deviates from the standard indicator.

The execution of these S100 to S400 may be controlled by the controller 150 of the electronic device 100. In this case, the controller 150 may control the execution of S100 to S400 by using dedicated software (program) installed in the electronic device 100.

Hereinafter, the process of performing S100 to S400 will be described in more detail.

That is, in the case of generating a confidential leak probability index for an organization member, a plurality of first classification items may be selected in S100. Likewise, in order to generate a confidential leak probability index for an event, a plurality of second classification items may be selected in S200. Of course, in the case of generating a confidential leak probability index for an organization member and an event, a plurality of first classification items and a plurality of second classification items may be selected together in S100. In this case, a confidential leak probability indicator for an organization member and a confidential leak probability indicator for an event may be respectively generated, but the present invention is not limited thereto, and one confidential leak probability indicator for an organization member and an event may be generated.

The first classification item is an item divided according to the classification system for organizational members, and the second classification item is an item divided according to the classification system for organizational members. That is, the first classification item is an item for classifying an organization member in more detail, and the second classification item is an item for classifying an event in more detail.

When a plurality of first classification items or second classification items are selected in S100, the weight and grade of each classification item are then set and set in S200. At this time, the weight refers to the degree of importance (score) occupied by the corresponding classification item compared to the selected other classification items, and the grade refers to the degree (score) applied to the member or event in the corresponding classification item. At this time, the specific gravity and grade may be set as a number (score), and the greater the specific gravity and grade, the higher the number (score) may be set. In particular, for ease of setting, the ratings of each category item selected may all be set within the same range. For example, the grade of each selected classification item may be set in the range of 1 to 10. However, if a specific classification item is selected in S100, but the classification item is not related to the member of the organization or the event, or the setting of the grade is difficult or ambiguous, the grade is not specified in S200 and a value outside the range (for example, It can also be set to a value such as 0).

Meanwhile, the specific gravity may be set by dividing the first classification item and the second classification item. That is, the weight of the selected first classification item may be determined according to the degree of importance occupied among the selected plurality of first classification items, and the weight of the selected second classification item is selected from the plurality of second classification items. It may be determined according to the degree of importance occupied among the items, but is not limited thereto.

After selecting a plurality of classification items according to S100 and S200 and setting the weight and grade for each selected classification item, in S300, an individual classification score for each classification item using the following [Equation 1] and [Equation 2] May be calculated, and then, in S300, a confidential leak probability index may be derived using the sum of the calculated individual classification scores.

[Equation 1]

In [Equation 1], i is a natural number, G _i is the i-th classification item, W _i is the weight of the i-th classification item, W _S is the sum of the highest grade of each set classification item, and C is a constant.

[Equation 2]

In [Equation 2], S _i denotes an individual classification score _{of the i-th classification item, and R i} denotes a set grade of the i-th classification item.

Thereafter, in S400, when the confidentiality leak probability index calculated in S300 deviates from the standard index, an organization member of the index may be selected as a candidate for audit. In this case, the reference indicator may be a specific value for the confidential leak probability indicator.

For example, the reference indicator can be set using a machine learning technique. That is, a learning model may be generated by learning a plurality of training data according to a machine learning technique, and a reference index may be obtained using the generated learning model. At this time, each learning data has a data pair of an input value and an output value, and the value of the confidential leak probability index may correspond to the input value, and whether the organization member or event of the corresponding confidential leak probability index corresponds to an actual confidential leak. (Reflection of the previous audit result) may correspond to the output value.

Of course, the learning model can also estimate (classify) whether or not the confidentiality is leaked with respect to the newly calculated confidentiality leak probability index. At this time, the efficiency of the audit can be further increased by selecting the relevant organization member or event of the indicator of the possibility of confidential leakage, which is estimated to be confidential, as an audit target candidate.

That is, the present invention applies a machine learning technique by reflecting the calculated leak probability index and the audit result (conventional audit result) for the previously performed confidential leak, thereby establishing the criteria for the leak probability index for selecting candidates for audit. I can. Through this, each classification item for calculating the confidentiality leakage probability index can be modified to suit the organization and applied to better reflect the actual leakage probability.

In addition, when the machine learning technique is applied, it is possible to select a combination that can further estimate confidential leakage by learning using various combinations of learning data adjusted for each classification item and its weight, and accordingly, an efficient confidential leakage probability index can be determined. Can be created.

In this case, in S100 and S200, the classification items of a specific combination and their weight are set as an input value, and whether or not an organization member or event of the corresponding association actually corresponds to a confidential leak (reflecting the result of the previous audit) as a result value. It is possible to generate training data from a pair of data. After that, if the performance of the learning model trained using these learning data (for example, Precision, Recall, or Accuracy) is evaluated and exceeds the criteria, the classification item corresponding to a specific combination of the learning data used for learning the learning model Fields and their weights may be used when calculating an indicator of the possibility of confidential leakage of a corresponding member of the organization or event in the future, or a guide for using such a combination may be displayed on the display unit 140. Of course, when the performance of the learning model is less than the standard, the above-described process may be performed by setting classification items of other specific combinations and their weight. This process may be repeated until a learning model with more than the standard performance is derived.

Summarizing the above-described application of the machine learning miracle, a standard index for a confidential leak probability index or an appropriate weight value of each classification item may be set using a machine learning technique.

For example, machine learning techniques are supervised learning techniques, such as Artificial neural network, Boosting, Bayesian statistics, Decision tree, Gaussian process regression, Nearest neighbor algorithm, Support vector machine, Random forests, Symbolic machine learning, Ensembles of It may be a technique such as classifiers or deep learning, but is not limited thereto.

Hereinafter, an example of generating a confidential leak probability index for an organization member and an example of generating a confidential leak probability index for an event will be described.

<Example of creation of an indicator of possibility of leaking confidentiality to members of the organization>

For example, for the creation of an indicator of the possibility of confidential leakage for an organization member, the first category items that can be selected in S100 are [Department], [Title], [Work], [Work Period], [T&A], [ The possibility of job change], or [other content] may be included, but is not limited thereto.

The first category of [Department] is an item that evaluates the degree of confidentiality according to the information handled by the department to which the member belongs in the organization. In other words, it reflects the tendency that the confidentiality of handled information is inevitably different depending on the department. Therefore, a higher grade (score) can be set as the department of an organization member handles information requiring higher confidentiality. For example, when [department] is selected in S100, the grade is set within the range of 1 to 10 in S200, but may be set closer to 10 as the handling information of the department to which the organization member belongs requires higher confidentiality. . However, if it is not specified, the level of [Department] may be set to 0.

The first category of [Title] is an item that evaluates the degree of the position assigned by the member of the organization, such as the head of a division, a team leader, and a team member. In other words, the higher the position of the member of the organization, the higher the level of access to information and the level of decision-making, which reflects the tendency to handle higher levels of confidentiality. Therefore, the higher the position of the member of the organization, the higher the grade (score) may be set. For example, when [position] is selected in S100, the grade is set in the range of 1 to 10 in S200, but the higher the position of the member of the organization, the closer to 10 may be set. However, if not specified, the grade of [position] may be set to 0.

The first category of [Task] is an item that evaluates the confidentiality of information handled according to the task assigned to an organization member. In other words, it reflects the tendency that the confidentiality of handled information is inevitably different depending on the job. Therefore, a higher grade (score) may be set as the work of an organization member handles information requiring higher confidentiality. For example, when [task] is selected in S100, the grade is set in the range of 1 to 10 in S200, but it may be set closer to 10 as the handling information of the task assigned to an organization member requires higher confidentiality. . However, if not specified, 0 may be set for the class of [task].

The first category of [Work Period] is an item that evaluates the degree of loyalty to the organization according to the employee's working period. That is, the longer the number of years of service is, the higher the loyalty of the organization member to the organization is, and thus reflects the tendency that the possibility of confidential leakage is low. Therefore, a lower grade (score) may be set as the number of years of service of an employee is longer. For example, when [work period] is selected in S100, the grade is set in the range of 1 to 10 in S200, but may be set closer to 1 as the number of years of service increases. However, if not specified, 0 may be set for the [work period] level.

The first category item of [T&A] is an item that evaluates the status of T&A within a certain latest period (eg, the last month, etc.) of an organization member. That is, during the latest period of time, the worse the T&A index, which is the sum of the poor indicators such as lateness and unexcused absence, and the overwork indicators such as overtime and holiday work, is worse (i.e., the number of times or the total score The larger) the item reflects the high probability of confidential leakage. Therefore, the worse the T&A status, the lower the grade (score) may be set. For example, when [T&A] is selected in S100, the grade is set in the range of 1 to 10 in S200, but the worse the T&A index, the closer to 10 may be set. However, if not specified, the grade of [T&A] may be set to 0.

The first category of [Possibility of Turnover] is the item that the head of the department of the organization member or the head of the higher department observes and evaluates the member. In other words, the more suspicious behavior of an organization member, the higher the likelihood of job turnover, and the higher the possibility of confidential leakage. Accordingly, the higher the likelihood of a job change due to a suspicious behavior, as a result of periodic observations of the member of the organization member's department or the manager of the upper level department, the higher the grade (score) may be set. For example, when [possible turnover] is selected in S100, the grade may be set in the range of 1 to 10 in S200, and may be set closer to 10 as the probability of turnover increases. However, if not specified, the level of [possibility of turning over] may be set to 0.

The first category of [Other Contents] is items that can be added in addition to [Department], [Title], [Work], [Work Period], [T&A] and [Possibility of Turnover]. This is an item on the content that may correspond to information that is important for the estimation of confidential leakage. For example, when [other content] is selected in S100, the grade is set in the range of 1 to 10 in S200, but may be set closer to 10 as the importance of confidentiality increases. However, if not specified, the level of [In-flight Content] may be set to 0.

On the other hand, in S200, when setting the weight for [Department], [Title], [Task], [Work Period], [T&A], [Possibility of Turnover], or [Other Details], [T&A] or [Turnover] Possibility] may be set to a greater weight than [Department], [Title], [Task], or [Work Period], but [Work Period] may be set as the smallest share. Alternatively, a guide for performing such setting may be displayed on the display unit 140. In other words, [T&A] and [Possibility of Turnover] are items reflecting the latest status of employees, and therefore, it may be desirable to occupy a greater weight than other first category items. In addition, since there are often cases where confidentiality is leaked by an employee with a long service life, it may be desirable to occupy the smallest portion of the [work period].

For example, in S200, [Department], [Title], and [Task] are relatively medium or higher (second highest), and [Work period] is relatively less than medium (third highest), The [T&A] and [Possibility of Turnover] may be set to a relatively high (first highest) weight, respectively, or a guide for performing such setting may be displayed on the display unit 140.

_{[Table 1] below shows each of the first categories (G i} ) of [Department], [Title], [Task], [Work Period], [T&A] and [Possibility of Turnover] selected in S100 for any member of the organization. And, the values of the specific gravity (W _i ) and the grade (R _i ) for each of the first classification items (G _i ) set in S200 are shown.

No(i)	First category item (G i )	Specific gravity (W i )	Rating (R i )	Reference
One	Department	10	10	R 1 : Unspecified 0, Min 1 ~ Max 10
2	position	10	5	R 2 : Unspecified 0, Min 1 ~ Max 10
3	task	10	5	R 3 : Unspecified 0, Min 1 ~ Max 10
4	employment period	5	9	R 4 : Unspecified 0, Min 1 ~ Max 10
5	T&A status	10	0	R 5 : Unspecified 0, Min 1 ~ Max 10
6	Possible turnover	15	3	R 6 : Unspecified 0, Min 1 ~ Max 10

The following [Table 2] shows the individual classification score and leakage probability index for each first classification item calculated in S300 using the settings of [Table 1].

No(i)	Settings for the first category			Calculated value
	First category item (G i )	Specific gravity (W i )	Rating (R i )	Specific gravity indicator (G i )	Individual classification score (S i )
One	Department	10	10	10/50 × 10 = 2	10 × 2 = 20
2	position	10	5	10/50 × 10 = 2	5 × 2 = 10
3	task	10	5	10/50 × 10 = 2	5 × 2 = 10
4	Longevity	5	9	5/50 × 10 = 1	9 × 1 = 9
5	T&A status	10	0	-	-
6	Possible turnover	15	3	15/50 × 10 = 3	3 × 3 = 9
Sum				10	58 (Leak possibility indicator)

The contents of [Table 1] and [Table 2] are summarized as follows:-The first classification item selected in S100: The first classification item that affects the estimation of confidential leakage of the organization member-The first classification item selected in S100 The number of = 6- The number of first classification items (hereinafter referred to as “use first classification items”), which is not the case where the grade is not specified in S200 = 5

-Maximum score (W _S ): The sum of the maximum grades of all first category items whose grade is not 0 = 10 + 10 + 10 + 10 + 10 = 50

-Setting the weight for the first classification item used: Compared with the first classification items used, but _{given a weight value in consideration of the maximum score (W S} ) (however, the sum of the weight values of all the first classification items used is the maximum. Score)

-Specific gravity indicator (G _i ) = set specific gravity (W _i ) / maximum score (W _S ) × constant (C) (for example, C can be 10, etc.)

-Individual classification score (S _i ) = set grade (R _i ) × weight index (G _i ) = [20, 10, 10, 9, 9]

-Spillability index = sum of individual classification scores (S _i ) (however, the spill probability index value can be unspecified 0, or from a minimum of 1 to a maximum of 100) = 20 + 10 + 10 + 9 + 9 = 58

Through the above process, it is possible to derive an indicator of the likelihood of leakage for each member of the organization. However, the first classification items used to derive the first leakage probability indicator of the first organization member may be different from the first classification items used for the second leakage probability indicator of the second organization member.

Thereafter, in S400, when the confidentiality leak probability index calculated in S300 deviates from the standard index, an organization member of the index may be selected as a candidate for audit.

<Example of creating an indicator of the possibility of confidential leakage for an event>

For example, in order to generate a confidentiality leak probability indicator for an event, the second category items that can be selected in S100 are [Information Confidentiality], [Information Value], [Security Measures], [Information Destination], [Information Transmission Location], [information transmission time], [occurrence frequency of this member of the organization], or [occurrence frequency of other member of the organization], or [other contents], etc., but are not limited thereto.

The second category item of [Information Confidentiality] is an item for evaluating the degree of confidentiality of the subject information of the event. In other words, this item reflects the tendency that the degree of confidentiality of the subject information is inevitably different for each event. Accordingly, as the target information of the event is information requiring higher confidentiality, a higher grade (score) may be set. For example, when [information confidentiality] is selected in S100, the level is set within the range of 1 to 10 in S200, but the target information of the event may be set closer to 10 as the information requiring higher confidentiality is required. . However, if not specified, the level of [Information Confidentiality] may be set to 0.

The second category item of [information value] is an item that evaluates the degree of value of the target information of the event. In this case, the value may be not only a monetary value, but also a value due to damages caused by punishment (penalty fine, fine, or imprisonment, etc.) that may occur in case of non-compliance with laws such as the Personal Information Protection Act. In this case, it can be said that the greater the punishment, the greater the value of the target information of the event. In other words, it is an item that reflects the tendency that the degree of value of the target information is inevitably different for each event. Accordingly, as the target information of the event is information having a higher value, a higher grade (score) may be set. For example, when [information value] is selected in S100, the grade is set within a range of 1 to 10 in S200, but the target information of the event may be set closer to 10 as information having a higher value. However, if not specified, the level of [information value] may be set to 0.

The second category item in [Security Measures] is an item that evaluates the degree of security measures prepared for the target information of the event. In this case, the security measures may be a means for making it difficult to transmit or carry out the target information, or a means for making it difficult to actually use even if the target information is transmitted or exported. For example, security measures may include encryption application, access control application, and the like, but are not limited thereto. In other words, this item reflects the tendency that the degree of security measures for the target information is inevitably different for each event. Accordingly, a higher level (score) may be set as the level of security measures for event target information is higher. For example, when [security measures] is selected in S100, the level is set within the range of 1 to 10 in S200, but may be set closer to 10 as the level of security measures for the target information of the event is higher. . However, if not specified, the level of [security measures] may be set to 0.

The second classification item of [Information Destination] is an item for evaluating the type of the object receiving the object information of the event. That is, the item reflects the tendency that the type of destination of the target information is inevitably different for each event. For example, the destination may be an internal, external, cooperative organization, customer, competitor, etc. of the organization, but is not limited thereto. Accordingly, a lower grade (score) may be set as the destination of the event is a designated destination, such as inside an organization. Conversely, a higher grade (score) may be set as the destination of the event is a destination other than a designated destination, such as outside an organization or a competitor. For example, when [information destination] is selected in S100, the grade may be set within a range of 1 to 10 in S200, but may be set closer to 10 as an event is received at a destination other than the designated destination. However, if not specified, the level of [information destination] may be set to 0.

The second category item of [Information Transmission Location] is an item for evaluating the type of location to which the target information of the event is transmitted or exported. That is, it is an item reflecting the tendency that the type of transmission location of the target information is inevitably different for each event. For example, the transmission location may be inside or outside the organization, a specific location, a home, a public location, etc., but is not limited thereto. Accordingly, a lower grade (score) may be set as the event transmission location is a designated transmission location, such as inside an organization. Conversely, a higher grade (score) may be set as the transmission location of the event is a transmission location other than designated, such as outside of an organization. For example, when [information transmission location] is selected in S100, the level is set within a range of 1 to 10 in S200, but may be set closer to 10 as an event is transmitted to a transmission location other than the designated location. However, if not specified, the level of [information transmission place] may be set to 0.

The second category item of [Information Transmission Time] is an item that evaluates the time to transmit or export the target information of the event. That is, the transmission time of the target information is inevitably different for each event, and this item reflects the tendency that the probability of leakage of confidentiality increases as the transmission time is outside working hours. For example, the transmission time may be working hours, hours outside working hours, holidays, vacations, etc., but is not limited thereto. Accordingly, a lower grade (score) may be set as the transmission time of the event is a designated time such as working hours. Conversely, a higher grade (score) may be set as the transmission time of the event is a time other than designated time, such as a time outside working hours, a holiday, or a vacation. For example, when [information transmission time] is selected in S100, the level is set within a range of 1 to 10 in S200, but may be set closer to 10 as an event is transmitted at a time other than specified. However, if not specified, the level of [information transmission time] may be set to 0.

The second category item in [The frequency of occurrence of this member of the organization] is an item that evaluates the degree to which the member of the organization repeatedly generates the event. In other words, it is an item that reflects the tendency that the possibility of leaking confidentiality is higher as the case that a specific member of the organization repeatedly generates a specific event. Therefore, a higher grade (score) may be set as the event is repeated by the member of the present organization. For example, when [the frequency of occurrence of this member of the organization] is selected in S100, the grade may be set within a range of 1 to 10 in S200, but may be set closer to 10 as the event is repeated. However, if not specified, 0 may be set as the grade of [occurrence frequency of members of this organization].

The second category item of [Occurrence Frequency of Other Members] is an item that evaluates the degree to which one or more members of the organization other than the main member of the organization generated the event. In other words, it is an item that reflects the tendency that the possibility of confidential leakage is lower when a large number of members of the organization generate for a specific event. Therefore, a lower grade (score) may be set as the number of corresponding events by other members of the organization increases. For example, when [frequency of occurrence of other members of the organization] is selected in S100, the grade is set within the range of 1 to 10 in S200, but the higher the number of occurrences of other members of the event, the closer to 10 may be set. have. However, if not specified, 0 may be set for the grade of [occurrence frequency of other members of the organization].

The second category of [Other Contents] is [Information Confidentiality], [Information Value], [Security Measures], [Information Destination], [Information Transmission Location], [Information Transmission Time], [The frequency of occurrence of this organization member. ] And [occurrence frequency of other members], which can be added to the event-related information, which may be important for estimating confidential leakage. For example, when [other content] is selected in S100, the grade is set in the range of 1 to 10 in S200, but may be set closer to 10 as the importance of confidentiality increases. However, if not specified, the level of [In-flight Content] may be set to 0.

Meanwhile, in S200, [information confidentiality], [information value], [security measures], [information destination], [information transmission place], [information transmission time], [occurrence frequency of the member of the organization], [occurrence of other members of the organization] Frequency], or [Other Contents], [Information Value], [Security Measures], or [Information Destination] is set to [Information Confidentiality], [Information Transmission Location], [Information Transmission Time], and Occurrence frequency], or [information confidentiality] may be set as the largest weight, while it is set to a weight less than [occurrence frequency of other members]. Alternatively, a guide for performing such setting may be displayed on the display unit 140. In other words, [information confidentiality], [information transmission place], [information transmission time], [occurrence frequency of this member of the organization] and [occurrence frequency of other member of the organization] are items that reflect the nature of the event related to confidentiality. It may be desirable to occupy a greater proportion than the item. In particular, since [information confidentiality] is an item that reflects the direct nature of the target information of the event, it may be desirable to occupy the largest weight.

For example, in S200, [information confidentiality] is the relatively most important (first highest) weight, [information value] is relatively medium or higher (third highest), and [security measures] is relatively medium. The proportion of degree (4th highest), [information destination] is relatively less than the middle (5th highest), [information transmission location], [information transmission time], [occurrence frequency of this organization member] and [others] The frequency of occurrence of the organization member] may be set to a relatively high (second highest) specific gravity, or a guide for performing such setting may be displayed on the display unit 140.

[Table 3] below shows [Information Confidentiality], [Information Value], [Security Measures], [Information Destination], [Information Transmission Location], [Information Transmission Time], and Frequency of occurrence] of each second classification item (G _i ), and values of the specific gravity (W _i ) and grade (R _i ) for each second classification item (G _{i) set in S200.}

No(i)	First category item (G i )	Specific gravity (W i )	Rating (R i )	Reference
One	Information confidentiality	20	7	R 1 : Unspecified 0, Min 1 ~ Max 10
2	Information value	10	0	R 2 : Unspecified 0, Min 1 ~ Max 10
3	Security measures	15	5	R 3 : Unspecified 0, Min 1 ~ Max 10
4	Information recipient	10	8	R 4 : Unspecified 0, Min 1 ~ Max 10
5	Where to send information	5	One	R 5 : Unspecified 0, Min 1 ~ Max 10
6	When information is transmitted	10	One	R 6 : Unspecified 0, Min 1 ~ Max 10
7	Frequency of occurrence of this member	5	0	R 7 : Unspecified 0, Min 1 ~ Max 10
8	Frequency of occurrence of other members of the organization	5	0	R 8 : Unspecified 0, Min 1 ~ Max 10

The following [Table 4] shows the individual classification score and leakage probability index for each second classification item calculated in S300 using the settings of [Table 3].

No(i)	Settings for the second category			Calculated value
	First category item (G i )	Specific gravity (W i )	Rating (R i )	Specific gravity indicator (G i )	Individual classification score (S i )
One	Information confidentiality	20	7	20/50 × 10 = 4	7 × 4 = 28
2	Information value	10	0	-	-
3	Security measures	5	5	5/50 × 10 = 1	5 × 1 = 5
4	Information recipient	10	8	10/50 × 10 = 2	8 × 2 = 16
5	Where to send information	5	One	5/50 × 10 = 1	1 × 1 = 1
6	When to transmit information	10	One	10/50 × 10 = 2	1 × 2 = 2
7	Frequency of occurrence of this member	5	0	-	-
8	Frequency of occurrence of other members of the organization	5	0	-	-
Sum				10	52 (Leak possibility indicator)

The contents of [Table 3] and [Table 4] are summarized as follows:-The second classification item selected in S100: The second classification item that affects the estimation of confidential leakage of the event-The first classification item selected in S100 The number of = 8- The number of second classification items (hereinafter referred to as “use second classification items”), which is not the case where the grade is not specified in S200 = 5

-Maximum score (W _S ): Sum of the maximum grades of all used second category items whose grade is not 0 = 10 + 10 + 10 + 10 + 10 = 50

-Setting the weight for the second classification item used: Compared with the second classification items used, but _{given a weight value in consideration of the maximum score (W S} ) (however, the sum of the weight values of all the second classification items used is the maximum. Score)

-Specific gravity indicator (G _i ) = set specific gravity (W _i ) / maximum score (W _S ) × constant (C) (for example, C can be 10, etc.)

-Individual classification score (S _i ) = set grade (R _i ) × weight index (G _i ) = [28, 5, 16, 1, 2]

-Spillability indicator = sum of individual classification scores (S _i ) (however, the spill probability indicator value can be unspecified 0, or from a minimum of 1 to a maximum of 100) = 28 + 5 + 16 + 1 + 2 = 52

Through the above process, it is possible to derive an indicator of the likelihood of leakage for each event performed by a member of the organization. However, the second classification items used to derive the first leakage probability indicator of the first event may be different from the second classification items used for the second leakage probability indicator of the second event.

Thereafter, in S400, when the confidential leakage probability index calculated in S300 deviates from the reference index, an event of the corresponding index may be selected as an audit target candidate.

In the present invention, the leak probability index calculated according to S300 may be, for example, a score from a minimum of 1 to a maximum of 100. In this case, the larger the value, the higher the possibility of leaking confidentiality, and accordingly, it may mean that a corresponding member or event may become a more promising audit target candidate. However, the score does not mean the percentage of confidential leaks that actually occurred. In other words, the value of the leak probability index of 100 does not mean that the confidential leak probability is 100%.

In the past, it has been quite difficult to provide an indicator for selecting candidates for auditing related to confidential leaks. However, in the case of the present invention, it is possible to select an audit target candidate that can be performed during a given audit period in consideration of the organization's ability to perform an audit. That is, it is possible to select as many organizational members or events as auditable candidates among them by sorting in the order of the probability of leakage.

According to the above, the present invention provides an index of the possibility of confidential leakage of an organization member or event in an IT (Information Technology) environment, so that it is easier to select candidates for auditing when the organization's confidential leakage detection and control work is performed. There are advantages to making this possible.

That is, the present invention provides a method of calculating an index for selecting an organization member or event that may be estimated to have a high probability of confidential leakage, and through this, the difficulty in selecting candidates for audit is solved, so that confidential leakage audit activities are actually confidential. It allows you to focus on members or events that are likely to be leaked.

In addition, the present invention applies a machine learning technique by reflecting the calculated leak probability index and the previously performed audit result for confidential leak (conventional audit result), thereby establishing a standard for leak probability index for selecting candidates for audit. Through this, there is an advantage that each classification item for calculating a confidential leak probability index can be modified to suit the organization and applied to better reflect the actual leak probability.

Although specific embodiments have been described in the detailed description of the present invention, various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention is not limited to the described embodiments, and should be defined by the claims to be described later and equivalents to the claims.

The present invention relates to a method and electronic device for estimating confidential leakage that enables easier selection of candidates for auditing during the detection and control of confidential leakage of an organization by indicating and presenting the possibility of leakage of confidentiality of an organization in an IT (Information Technology) environment. As it is about, it has industrial applicability.

Claims (6)

1. As a method of estimating confidential leakage for each member and event, performed by an electronic device, by generating a confidential leakage probability indicator for an organization member and generating a confidential leakage probability indicator for an event performed by an organization member,

   A setting step of setting weights and grades of a plurality of first classification items for an organization member, and setting weights and grades of a plurality of second classification items for an event;

   A calculation step of calculating a confidential leak probability index for each member of the organization and the event based on the weight and grade of each set classification item; And

   If the calculated confidentiality leak probability indicator for an organization member deviates from the standard indicator, the relevant organization member is selected as a candidate for audit, and if the confidential leak probability indicator for the calculated event deviates from the reference indicator, the event is selected as an audit candidate. Including;

   The first classification items are [Department], which is an item about the confidentiality of information handled by the department to which the member belongs, [Title], which is an item about the degree of the position assigned to the member, and according to the task assigned to the member. [Working], which is an item about the confidentiality of handling information, [Working Period], which is an item against the working period of an organization member, [T&A], which is an item about T&A within a certain latest period, and items about the possibility of employee turnover. Each includes [possible turnover],

   The second classification items include [information confidentiality], which is an item about the degree of confidentiality of the subject information of the event, and [information value], which is an item about the degree of monetary value or the degree of value due to damage of the subject information of the event, [Security measures], which are items about the degree of security measures prepared for the event target information, [information destination], which are items about the type of targets that receive the target information of the event, and transmit or export the target information of the event. [Information transmission location], which is an item for the type of place, [information transmission time], which is an item about the time to transmit or export the target information of the event, and [ It includes the frequency of occurrence of this member of the organization] and [frequency of occurrence of other members of the organization], which are items for the degree of repetitive occurrence of the event by members other than the corresponding member,

   The setting step,

   Regarding the first category, [T&A] and [Possibility of Turnover] are set to a greater proportion than [Department], [Title], [Task] and [Work Period], but [Work Period] is set to the smallest proportion. The higher the confidentiality of the information handled by the department to which the member belongs, the higher the grade is set for [Department], and the higher the position assigned to the member is, the higher the grade is set for [position], and The higher the confidentiality of the information handled according to the assigned job, the higher the grade is set for [Task], and the longer the employee's tenure is, the lower the grade is set for [Work Period], and the member is assigned a certain latest period. Including the step of setting a higher grade for [T&A] as the number of late, unexcused, overtime, or holiday work increases within the room.

   Regarding the second category, [Information Value], [Security Measures] and [Information Recipient] are selected as [Information Confidentiality], [Information Transmission Location], [Information Transmission Time], [The frequency of occurrence of this organization member] and [others]. It is set to a smaller proportion than the frequency of occurrence of members of the organization], but [Information Confidentiality] is set as the largest proportion, and the higher the level of confidentiality of the target information of the event, the higher the level for [Information Confidentiality] is set, and the target information of the event is Branches set a higher rating for [Information Value] the greater the monetary value or value due to damage, and the higher the degree of security measures prepared for the target information of the event, the higher the rating for [Security Measures]. The higher the rating for [Information Destination] is set as the destination receiving the target information of the target is other than the specified destination, and the higher the rating for [Information Transmission Location] when the destination information of the event is transmitted or exported to a location other than the specified destination. When the time to transmit or export the target information of the event is outside of business hours, a higher level is set for [Information Transmission Time], and the higher the event occurrence frequency of the relevant member is, the higher the frequency of occurrence of the event is And setting a lower grade for [the frequency of occurrence of other members] as the frequency of occurrence of events of other members of the organization increases.
2. The method of claim 1,

   The weight or the reference index of each classification item is set using a machine learning technique.
3. The method of claim 1,

   The calculation step,

   A method comprising the step of calculating an individual classification score for each classification item set using the following [Equation 1] and [Equation 2], and then deriving a confidential leak probability index using the sum of the individual classification scores.

   [Equation 1]

   

   (However, i is a natural number, G _i is the i-th category, W _i is the weight of the i-th category, W _S is the sum of the highest ratings of each set category, and C is a constant)

   [Equation 2]

   

   (However, S _i is the individual classification score _{of the i-th classification item, R i} is the set grade of the i-th classification item)
4. As an electronic device that estimates confidential leakage for each member and event through the creation of a confidential leakage probability indicator for an organization member and a confidential leakage probability indicator for an event performed by an organization member,

   A storage unit that stores weights and grades of a plurality of first classification items for an organization member, and stores weights and grades of a plurality of second classification items for an event; And

   Based on the weight and grade of each category, the confidentiality leak probability index for each member and event is calculated, and if the calculated confidentiality leak probability index for the organization member deviates from the standard indicator, the relevant organization member is selected as a candidate for audit, Includes; a control unit that controls to select the event as an audit target candidate when the confidential leak probability index for the calculated event deviates from the reference index,

   The first classification items are [Department], which is an item about the confidentiality of information handled by the department to which the member belongs, [Title], which is an item about the degree of the position assigned to the member, and according to the task assigned to the member. [Working], which is an item about the confidentiality of handling information, [Working Period], which is an item against the working period of an organization member, [T&A], which is an item about T&A within a certain latest period, and items about the possibility of employee turnover. Each includes [possible turnover],

   The second classification items include [information confidentiality], which is an item about the degree of confidentiality of the subject information of the event, and [information value], which is an item about the degree of monetary value or the degree of value due to damage of the subject information of the event, [Security measures], which are items about the degree of security measures prepared for the event target information, [information destination], which are items about the type of targets that receive the target information of the event, and transmit or export the target information of the event. [Information transmission location], which is an item for the type of place, [information transmission time], which is an item about the time to transmit or export the target information of the event, and [ It includes the frequency of occurrence of this member of the organization] and [frequency of occurrence of other members of the organization], which are items for the degree of repetitive occurrence of the event by members other than the corresponding member,

   The control unit,

   Regarding the first category, [T&A] and [Possibility of Turnover] are set to a greater proportion than [Department], [Title], [Task] and [Work Period], but [Work Period] is set to the smallest proportion. The higher the confidentiality of the information handled by the department to which the member belongs, the higher the grade is set for [Department], and the higher the position assigned to the member is, the higher the grade is set for [position], and The higher the confidentiality of the information handled according to the assigned job, the higher the grade is set for [Task], and the longer the employee's tenure is, the lower the grade is set for [Work Period], and the member is assigned a certain latest period. The more tardy, absenteeism, overtime, or holiday work within the room, the higher the grade for [T&A] is set.

   Regarding the second category, [Information Value], [Security Measures] and [Information Recipient] are selected as [Information Confidentiality], [Information Transmission Location], [Information Transmission Time], [The frequency of occurrence of this organization member] and [others]. It is set to a smaller proportion than the frequency of occurrence of members of the organization], but [Information Confidentiality] is set as the largest proportion, and the higher the level of confidentiality of the target information of the event, the higher the level for [Information Confidentiality] is set, and the target information of the event is Branches set a higher rating for [Information Value] the greater the monetary value or value due to damage, and the higher the degree of security measures prepared for the target information of the event, the higher the rating for [Security Measures]. The higher the rating for [Information Destination] is set for the destination to receive the target information of the event other than the specified destination, and the higher the rating for [Information Transmission Location] when the destination for sending or exporting the target information of the event is a location other than the specified destination. When the time to transmit or export the target information of the event is outside of business hours, a higher level is set for [Information Transmission Time], and the higher the event occurrence frequency of the relevant member is, the higher the frequency of occurrence of the event is An electronic device that sets a higher rating for the group, and controls to set a lower rating for the [occurrence frequency of other members] as the frequency of events of other members of the organization increases.
5. The method of claim 4,

   An electronic device in which the weight of each classification item or the reference index is set using a machine learning technique.
6. The method of claim 4,

   The control unit,

   An electronic device that calculates an individual classification score for each classification item using the following [Equation 1] and [Equation 2], and then derives a confidential leak probability index using the sum of the individual classification scores.

   [Equation 1]

   

   (However, i is a natural number, G _i is the i-th category, W _i is the weight of the i-th category, W _S is the sum of the highest ratings of each set category, and C is a constant)

   [Equation 2]

   

   (However, S _i is the individual classification score _{of the i-th classification item, R i} is the set grade of the i-th classification item)

Images