KR101011456B1 - Information leakage audit method, a computer-readable recording medium storing a program for performing the same and a system for performing the same - Google Patents

Abstract

Disclosed is a method for auditing information leakage using log information of an in-house information system, a computer-readable recording medium storing a program for performing the same, and a system for performing the same. The information leakage audit system includes a log information collection module for collecting log information from a log file storing system usage history of each user, an ID standardization module for extracting IDs for each log stored in a code table DB, and standardizing corresponding logs; An event extraction module for extracting log information standardized by the module for each event, a weight setting module for setting weights for the log information for each event extracted by the event extraction module, and setting a threshold value by receiving an initial threshold value for each event A threshold setting module configured to analyze the log information corresponding to the weighted event has exceeded a threshold and a threshold analysis module for linking the monitoring items and the evaluation items corresponding to each event or log to each other. Based on the analysis module and the information analyzed by the linked analysis module It includes a security risk index calculation module that calculates a security risk index for each user or event. Accordingly, the efficiency of auditing can be improved by calculating the individual security risk index and auditing the use of abnormal information and adjusting the threshold.

Description

Information leakage audit method, a computer-readable recording medium storing a program for performing the same, and a system for performing the same. }

The present invention relates to an information leakage auditing method, a computer-readable recording medium storing a program for performing the same, and a system for performing the same. More specifically, the information leakage auditing method using log information of an in-house information system and performing the same A computer-readable recording medium having a program stored therein and a system for performing the same.

In recent years, with the rapid development of electronic and computer technologies, information collection, exchange and transmission have become active. Information consisting of texts, voices, images, videos, etc. can all be created and edited in the form of files used on computers. It is done. Recently, the use of mobile computers such as laptop computers and personal digital assistants (PDAs), which have advantages in terms of portability and mobility compared to existing desktop computers fixed in a fixed place, has been activated. .

However, as information is easily collected, exchanged, and transmitted, the risk of leaking internal information stored in a mobile computer increases, and the amount of damages caused by the leakage of internal information continues to increase. As a result, many companies are working to protect and secure their internal information.

The conventional security solution (Solution) for preventing the leakage of information stored in the mobile computer is composed of an agent (Agent) installed in the mobile computer and a server for managing the agent. The server is connected to a mobile computer through the corporate internal network and manages agents installed on the mobile computer. The agent monitors and blocks the leakage path of information stored in the mobile computer to prevent the leakage of internal information.

However, even in such security measures, internal information may be leaked in various ways using a computer.

In recent years, there has been a rapid increase in information security incidents over a limited network of managed companies, including in-house or branch offices of general companies, as well as information security incidents across the entire network currently in operation worldwide. Losses related to disaster recovery (eg, web server, DB server, etc.) are increasing.

Accordingly, the technical problem of the present invention is to solve such a conventional problem, and the object of the present invention is to secure a single purpose in an in-house information system, but the individual security solution does not exist to audit the distribution of information of the entire organization. It provides a function to audit the behavior of using abnormal information by calculating the individual security risk index by using the function, and to provide an information leakage audit method using log information to increase the efficiency of the audit by adjusting the threshold.

Another object of the present invention is to provide a computer-readable recording medium having stored thereon a program for performing the information leakage auditing method.

Another object of the present invention is to provide an information leakage audit system for performing the information leakage audit method described above.

In order to realize the object of the present invention, an information leakage auditing method according to an embodiment includes: (a) standardizing and linking and analyzing an event for each log information based on log information extracted from a log file in which user-specific system usage history is stored; Performing and extracting a standardization event; (b) if the extracted standardized event is included in an evaluation item corresponding to the information leakage audit, counting the event for each evaluation item and classifying the monitoring item for each activity using the user's system; (c) assigning the weight to the monitoring item for each event as the weight is set by the security manager; (d) assigning the threshold value to the event-specific monitoring item as a threshold value is set; And (e) performing a trend analysis and statistical analysis for each system use item for each user in response to the information leakage audit, and checking the security risk index, if checked by the security manager as a request for setting the security risk index. The log file in which the usage history is stored includes web access information, job and general mail sending information, KMS information of storage and printing, EDMS information of storage and printing, drawing management information of storage and printing, USB storage information and decryption according to job search activities. It includes at least one of the information.

In an embodiment of the present invention, the information leakage audit method may further include the step of (f) reflecting the threshold adjusted for each evaluation item after the threshold adjustment by the security manager is requested, and then feeding back to step (d). Can be.

In an embodiment of the present invention, the security risk index is bias information, office security violation information, computer security software installation information, employment site visit history information, resume transmission information, business unit request information, partner information, security program bypasser information The information may be calculated based on at least one of information leaker information, department security information, prospective retiree information, and personnel disciplinary information.

delete

delete

In order to realize the above object of the present invention, a computer-readable recording medium storing a program for performing the information leakage auditing method according to an embodiment of the present invention may be (a) extracted from a log file in which user-specific system usage history is stored. Performing event standardization and linkage analysis for each log information based on log information and extracting a standardized event; (b) if the extracted standardized event is included in an evaluation item corresponding to the information leakage audit, classifying the event for each evaluation item and classifying the monitoring item for each activity using the user's system; (c) assigning the weight to the monitoring item for each event as the weight is set; (d) assigning the threshold value to the monitoring item for each event as the threshold value is set; And (e) performing a trend analysis and statistical analysis for each system use item for each user in response to the information leakage audit, and checking the security risk index if checked by the security manager for the request for setting the security risk index. The log file in which the usage history is stored includes web access information, job and general mail sending information, KMS information of storage and printing, EDMS information of storage and printing, drawing management information of storage and printing, USB storage information and decryption according to job search activities. It includes at least one of the information.

In order to realize the above object of the present invention, an information leakage audit system according to an embodiment includes a log information collection module for collecting log information from a log file in which system usage history for each user is stored, and for each log stored in a code table DB. An ID standardization module for extracting IDs to standardize corresponding logs, an event extraction module for extracting log information standardized by the ID standardization module for each event, and setting weights for event information log information extracted by the event extraction module A weight setting module configured to receive an initial threshold value for each event, a threshold setting module configured to set a threshold value, a threshold value analysis module for analyzing whether log information corresponding to the weighted event exceeds a threshold value, and an event; Link monitoring items by star or log with corresponding evaluation items The linkage analysis module includes a security risk index calculation module for calculating a security risk index for each user or event based on the information analyzed by the linkage analysis module. Here, the log file in which the usage history is stored may include web access information, job and general mail sending information, KMS information for storing and printing, EDMS information for storing and printing, drawing management information for storing and printing, and USB storage information according to job search activities. And at least one of decryption information.

In an embodiment of the present invention, the information leakage audit system analyzes the information corresponding to the security risk index by user or by event, date or time, and displays a trend analysis module for displaying in a graph or table form to be recognized by the security manager. It may further include.

In an embodiment of the present invention, the information leakage audit system matches the threshold value based on the information corresponding to the security risk index analyzed by the trend analysis module so that the threshold value is provided to the threshold setting module. The module may further include.

According to the information leakage audit method, a computer-readable recording medium storing a program for performing the same, and a system for performing the same, the security event is standardized using the monitoring results of individual security products and defined using standardized data. Through the linkage analysis and basic statistical analysis of the collected monitoring items and evaluation items, the security risk index is applied to the processed basic data by applying the threshold value and the security risk weight of each item, and the trend value used for the calculation is analyzed and This can be adjusted by tracking changes in variables.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described in more detail with reference to the accompanying drawings. As the inventive concept allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to the specific disclosed form, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Like reference numerals are used for like elements in describing each drawing. The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, action, or combination thereof described on the specification, but one or more other features or numbers, step, It is to be understood that it does not exclude in advance the possibility of the presence or the addition of an operation, a component, a part, or a combination thereof.

1 is a block diagram illustrating an operation of an information leakage audit system using log information according to an embodiment of the present invention.

Referring to Figure 1, the information leakage audit system using the log information according to an embodiment of the present invention 100 log information extracted from the user-specific log DB (200) for storing the log information obtained in the company information system Based on the security risk index, the security audit is performed by adjusting the information usage pattern without intervention by the security manager by adjusting the threshold required for the calculation. Is programmed to store.

The internal information system may include an enterprise security management system (ESM), a system resource management system (SMS), a network management system (network management system), and the like. The in-house information system may be designed such that an authenticated user PC 600 is accessible.

The user-specific log DB 200 may be made by a log file collector 400. That is, the log file collection unit 400 is connected to the gateway 500, which may be included in the in-house information system, and as the user PC 600 accesses the in-house information system, or visits another site through the Internet or the like. Collecting log information according to a series of operations, such as sending and receiving mail, and stores the collected log information in the user-specific log DB (200).

In the present invention, a log file used for auditing information leakage stores a record of all operations performed through the in-house information system or the gateway. When the user PC 600 accesses the in-house information system, all operations after the connection remain in the form of a log file at a predetermined location of the in-house information system. That is, the log file includes information on the work performed by the in-house information system. These include not only a specific task request and success, but also information about the solution if that specific task fails.

That is, a plurality of log lines are stored in the log file, and information such as a visitor's access Internet Protocol (IP), a visit date and time, a visit page information, and a visit status are stored in the log line. When it is necessary to check the log line information along with the statistics, the original log line found is stored in another file. Accordingly, the discovery frequency and the log line on which the discovery frequency is based can be checked together. This information is a necessary process in the field of security that requires clear evidence as well as the trends of visitors to the website.

As described above, the information leakage audit system 100 using log information according to the present invention performs a security audit operation by calculating and learning a security risk index. According to such a security audit operation, the security risk index can be audited through the security risk index for attempts to violate security policies that cannot be identified with a single security system, attempts to leak information assets, and bypass security systems.

In addition, the result of monitoring activities can be used to prevent security accidents through security awareness raising activities such as policy violation warnings. In addition, it is possible to prevent the occurrence of the same type of security incident in the future by tracking the security incident and auditing the cause of the security incident.

FIG. 2A is a block diagram illustrating the user-specific log DB 200 shown in FIG. 1. FIG. 2B is a block diagram illustrating the information leakage audit system 100 shown in FIG. 1.

2A and 2B, the user-specific log DB 200 may include a personnel DB 210, a mail use DB 220, a web use DB 230, a PC use DB 240, and a VPN use DB 250. It may include an anti-virus DB 260, messenger DB 270, information management DB 280 and the output DB (290). In FIG. 2A, for convenience of explanation, the log DB 200 for each user is logically divided, but not divided in hardware.

The personnel DB 210 stores the personnel record information for each user. The personnel record information includes whether or not the core personnel, the expected date of leaving the company, the date of leaving the company, the reason for leaving the company. For example, in the case of being listed as a key personnel or personnel records indicating the expected date of leaving the company, the management of the user's various networks may be the target. The personnel DB 210 may be stored with the user's consent. That is, even if the use of the in-house system, even if the subject of management may include a consent form, etc. that do not pose a problem according to the privacy of the individual.

The mail use DB 220 may store various information according to mail use for each user. For example, a mail sent through an in-house information system, a gateway, or the like, a file attached to the mail, or the like may be stored in the mail use DB 220.

The web use DB 230 may store various types of information for surfing the Internet for each user. That is, the information may include visited site information according to the use of the Internet, information visited by visiting a specific site, and the like.

The PC use DB 240 may store a variety of information according to the user's personal PC use, VPN use DB 250 may store a variety of information according to the user's VPN use, the anti-virus DB 260 is It can save various information according to user's antivirus use or release.

The messenger DB 270 may store various kinds of information according to the use of messenger for each user, and the information management DB 280 may store various kinds of information according to risk factor access for each user or access of an unauthorized office.

The output DB 290 may store various types of information, such as printing a user, and storing various kinds of information such as storing files in a removable, computer-readable recording medium such as a USB memory.

The information leakage audit system 100, as shown in Figure 2b, log information collection module 110, ID standardization module 115, code table DB 120, event extraction module 125, weight setting module ( 130), including the threshold setting module 135, threshold analysis module 140, linked analysis module 145 and security risk index calculation module 150, to prevent information leakage that may occur in the company system For this purpose, the security risk index is reflected based on the log file where the system usage history by user is stored. In FIG. 2B, the information leakage audit system 100 is logically divided for convenience of description, and is not hardwarely divided.

The log information collection module 110 collects system log information and provides it to the ID standardization module 115. The system log information may include various user or event log information stored in the user log DB 200. For example, the log file in which the usage history is stored may include web access information, job and general mail sending information, KMS (Knowledge Management System) information for storing and printing, EDMS (Electric Document Management) information for storing and printing, and the like. , Drawing management information of storage and printing, USB storage information, decryption information, and the like.

The ID standardization module 115 extracts IDs for each log stored in the code table DB 120 to normalize corresponding logs.

The event extraction module 125 extracts log information standardized by the ID standardization module 115 for each event.

The weight setting module 130 sets weights for the log information for each event extracted by the event extraction module 125. Here, the set weight may be changed in real time by the PC 50 of the security manager, or may be a value preset by the PC 50 of the security manager.

The threshold value setting module 135 receives an initial threshold value for each event and provides the threshold value analysis module 140.

The threshold analysis module 140 analyzes whether log information corresponding to a weighted event exceeds a predetermined threshold.

The linkage analysis module 145 associates the monitoring items for each event or log and the evaluation items corresponding thereto.

The security risk index calculation module 150 calculates a security risk index for each user or event based on the information made by the linkage analysis module 145. Here, the security risk index is bias infection information, office security violation information, computer security software not installed information, employment site visit history information, resume transmission information, business unit request information, supplier information, security program bypass information, information leaker information, It can be calculated based on department security information, prospective retiree information and personnel disciplinary information.

The information leakage audit system 100 may further include a trend analysis module 155 and a threshold consistency analysis module 160.

The trend analysis module 155 analyzes the information corresponding to the security risk index by user or event, date or time, and displays it in the form of a graph or a table to be recognized by the security manager. Information corresponding to the displayed security risk index may be stored separately for each analyzed time.

The threshold consistency analysis module 160 matches the threshold value appropriately based on the information corresponding to the security risk index analyzed by the trend analysis module 155 and provides the threshold value to the threshold setting module. For example, when a user's security risk index is too low or high in response to a specific event, an operation of raising or lowering the threshold may be performed based on the average value. In addition, during a specific time period, an operation such as not setting or lowering a corresponding threshold value may be performed. Through this threshold matching process, it is possible to prevent problems such as unnecessarily strengthening information security by estimating the security risk index excessively high or excessively low.

Typically, individual security solutions do not have the capability to audit the entire organization's distribution of information to serve a single purpose. However, according to the present invention, while utilizing the log information for each user, by utilizing the function of each individual security product, by calculating the individual security risk index through the function and auditing the use of abnormal information by adjusting the threshold value Audit efficiency can be increased.

3 is a conceptual diagram illustrating a security risk index calculation process performed according to the present invention.

Referring to FIG. 3, after the event is extracted and the linkage analysis is performed, a classification operation for the monitoring item and the evaluation item is performed based on the linkage analysis information.

The monitoring item may include an operation according to an information collection activity, an operation according to an information transmission operation, an operation according to an export violation activity, and an operation according to a bypass activity.

Meanwhile, the operation according to the information collecting activity may include downloading, using a storage medium, and a network as shown in FIG. 4.

FIG. 4 is a table for explaining information gathering activity defined in the monitoring item of FIG. 3.

Referring to FIG. 4, the detailed item of the download item according to the information collection activity may include a definition item of a file to be protected and a download path management item in a main application program. In addition, the storage medium details according to the information collection activities may include file copying / storing items, file recording items, and the like. In addition, the storage medium detailed items according to the information collection activity may include a file copy / storage item.

Meanwhile, the operation according to the information transmission activity may include mail transmission, transmission through a network, and the like as shown in FIG. 5.

FIG. 5 is a table for describing information transmission activity defined in the monitoring item of FIG. 3.

Referring to FIG. 5, the mail transmission item is a detailed item for transmitting information through an in-house mail, a detailed item for transmitting information using a web mail outside the company, and a detail for transmitting a mail through the company's Internet service homepage (group, etc.). Items may be included. Also, the network transmission item may include a detailed item attached to a file through a bulletin board, a detailed item transmitted using information from a web hard drive, a detailed file transfer monitoring item, and the like.

Meanwhile, the operation according to the export violation activity may include a storage medium, an output, an access control, a security violation, and ID theft as illustrated in FIG. 6.

FIG. 6 is a table describing the export violation activity defined in the monitoring item of FIG. 3.

Referring to FIG. 6, the media export item may include a detail item corresponding to a USB export, a detail item corresponding to a HDD export, a detail item corresponding to a CD / DVD media export, a detail item corresponding to a PC / laptop export, and the like. Can be. In addition, the entry and exit items may include details of unauthorized entry and exit, and details of entry and exit of office hours outside working hours.

Meanwhile, the operation according to the bypass activity may include PC security, storage, transmission, security control, file change, and the like as shown in FIG. 7.

FIG. 7 is a table for describing bypass activities defined in the monitoring item of FIG. 3.

Referring to FIG. 7, the PC bypass item may include a detailed item corresponding to a multi OS installation, a detailed item corresponding to a PC security process deletion attempt, a detailed item corresponding to a DOS use, and the like. In addition, the storage bypass items may include details corresponding to illegal software management, details corresponding to illegal software installation, details corresponding to important file name change, and the like.

Returning to the description of FIG. 3, the weights of the items are reflected on the classified information, and after the standardization of the scores of the items in which the weights are reflected, the security risk index is calculated.

8A and 8B are flowcharts illustrating an information leakage audit method using log information according to an embodiment of the present invention.

8A and 8B, an event is extracted from log information stored in a log DB for each user, and a standardized operation is performed on the extracted events (step S100).

Subsequently, a standardization operation is performed on the extracted events, and a linkage analysis operation is performed (step S102).

Then, a standardization event is extracted (step S104).

Then, it is checked whether the extracted standardized event is included in the evaluation item (step S106), and if it is checked that the extracted standardized event is not included in the evaluation item, detailed data is stored (step S108).

In step S106, if the extracted standardized event is checked to be included in the evaluation item, the event is counted for each evaluation item (step S110).

Subsequently, the monitoring item for each activity is classified (step S112), and it is checked whether a weight is set (step S114).

In step S114, if the weight is not set, the activity-specific aggregate data is stored (step S116).

In step S114, if the weight setting is checked, weights are assigned to the monitoring items for each event (step S118).

Then, it is checked whether or not the threshold is set (step S120).

In step S120, if it is not checked that the threshold is set, activity data is stored (step S122).

If it is checked in step S120 that the threshold value is set, a threshold value is assigned to the monitoring item for each event (step S124).

Then, it is checked whether the security risk index selection request by the security manager (step S126).

In step S126, if it is checked that the security risk index is not set, the aggregated data for each activity is stored (step S128).

In step S126, when checked as a request for setting the security risk index, trend analysis and statistical analysis for each user are performed, and the security risk index is calculated (step S130). The security risk index can be made through calculation of the final standard scores, for example. The calculation of the final standard score described above can be explained in the form of a table as shown in FIG. 9 below.

9 is a table for explaining the final standard score calculation applying the threshold and weight for each activity according to the present invention.

Referring to FIG. 9, a weight is set for each classified item, a threshold range is set, and the number of times according to the item is counted and scored. For example, it is desirable to increase the strength of information security because the user visits the job site because he or she intends to retire. It is desirable to further increase the strength of.

Therefore, in the case of visiting the job site, a weight of 2 is given, and in the case of visiting a competitor site, a weight of 3 is given. A certain threshold range was set for the weighted item, and a final standard score of 3 was calculated when an operation was made within the threshold range, and a final standard score of 5 was calculated when an operation outside the threshold range was made.

These standard scores for each item are accumulated by users in the future and can be used to calculate the information security risk index.

Returning to the description of FIG. 8, the calculation result of the security risk index calculated in step S130 is output to the security manager side (step S132). Here, the screen output to the security manager side may be displayed in the form of an image as shown in FIG.

10 is an example of the trend analysis pop-up screen of the user by the information leakage audit program according to the present invention.

Referring to FIG. 10, a graph of security trend analysis for a mail return event, a graph of security trend analysis for a file storage or printing, a graph of security trend analysis for a USB storage, and output or decryption of a PC document Corresponding security violation trend analysis graph is displayed.

Returning to the description of Fig. 8, after the calculation result of the security risk index is output to the security manager side, it is checked whether or not the threshold adjustment by the security manager is requested (step S134). In step S134, if it is not checked by adjustment of the threshold value, it ends, and when it is checked by adjustment of the threshold value, the threshold value adjusted for each evaluation item is reflected (step S136), and the process feeds back to step S120.

11 is an example of a result screen that is monitored by monitoring the information security activity of the core technical personnel by the information leakage audit program according to the present invention.

Referring to FIG. 11, Web access information, work and general mail sending information, KMS (Knowledge Management System) information of storage and printing, EDMS (Electric Document Management) information of storage and printing, and storing and printing according to job search activities for each user Drawing management information, USB storage information, decryption information, and the like are displayed.

The right column of the screen includes a button for trend analysis popup, a button for registering security violation indicators, and a check window for registering the security administrator's confirmation.

Although described above with reference to the embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below. I can understand.

As described above, according to the present invention, the security risk index can be calculated and the threshold required for the calculation can be adjusted to perform security audit through the function of adjusting the information usage pattern without the intervention of the security manager.

In particular, the security events are standardized by using the monitoring results of individual security products, and the thresholds and angles for the basic data processed through linkage analysis and basic statistical analysis on the defined monitoring items and evaluation items using the standardized data. The security risk index can be calculated by applying the security risk weight for each item, and the threshold used for the estimation can be adjusted through trend analysis and tracking of changes in variance.

1 is a block diagram illustrating an operation of an information leakage audit system using log information according to an embodiment of the present invention.

FIG. 2A is a block diagram illustrating a user-specific log DB shown in FIG. 1, and FIG. 2B is a block diagram illustrating an information leakage audit system shown in FIG. 1.

3 is a conceptual diagram illustrating a security risk index calculation process performed according to the present invention.

FIG. 4 is a table for explaining information gathering activity defined in the monitoring item of FIG. 3.

FIG. 5 is a table for describing information transmission activity defined in the monitoring item of FIG. 3.

FIG. 6 is a table describing the export violation activity defined in the monitoring item of FIG. 3.

FIG. 7 is a table for describing bypass activities defined in the monitoring item of FIG. 3.

8A and 8B are flowcharts illustrating an information leakage audit method using log information according to an embodiment of the present invention.

9 is a table for explaining the final standard score calculation applying the threshold and weight for each activity according to the present invention.

10 is an example of the trend analysis pop-up screen of the user by the information leakage audit program according to the present invention.

11 is an example of a result screen that is monitored by monitoring the information security activity of the core technical personnel by the information leakage audit program according to the present invention.

<Description of the symbols for the main parts of the drawings>

100: information leakage audit system 110: log information collection module

115: ID standardization module 120: code table DB

125: event extraction module 130: weight setting module

135: threshold setting module 140: threshold analysis module

145: linked analysis module 150: security risk index calculation module

200: user log DB 210: HR DB

220: Mail use DB 230: Web use DB

240: PC usage DB 250: VPN usage DB

260: anti-virus DB 270: messenger DB

280: Information management DB 290: Output DB

300: aggregation by activity DB 400: log file collection unit

500: Gateway 600: User PC

Claims (11)

(a) Performing event standardization and linkage analysis for each log information based on log information extracted from a log file storing system usage history of each user for operations performed through an internal information system or a gateway to event standardized log information Extracting each star; (b) if the extracted standardized event is included in an evaluation item corresponding to the information leakage audit, counting the event for each evaluation item and classifying the monitoring item for each activity using the user's system; (c) assigning the weight to the monitoring item for each event as the weight is set by the security manager; (d) assigning the threshold value to the event-specific monitoring item as a threshold value is set; (e) if checked by the security manager as a request for setting the security risk index, performing trend analysis and statistical analysis for each system use item for each user in response to the information leakage audit, and calculating the security risk index; And (f) as the threshold adjustment by the security manager is requested, reflecting the adjusted threshold for each evaluation item, and then feeding back to step (d), The log file in which the usage history is stored includes web access information, job and general mail sending information, KMS information of storage and printing, EDMS information of storage and printing, drawing management information of storage and printing, USB storage information and decryption according to job search activities. At least one of the information, The security risk index includes virus infection information, office security violation information, computer security software installation information, employment site visit history information, resume transmission information, business unit request information, supplier information, security program bypass information, information leaker information, department security Based on at least one of information, prospective retiree information and personnel disciplinary information, The security risk index is made through the calculation of the final standard scores, the calculation of the final standard scores are set by weighting for each classified item, the threshold range is set, it is made by scoring the number of times according to the item is scored Information leak audit method using log information. delete delete delete delete (a) Performing event standardization and linkage analysis for each log information based on log information extracted from a log file storing system usage history of each user for operations performed through an internal information system or a gateway to event standardized log information Extraction process; (b) if the extracted standardized event is included in an evaluation item corresponding to the information leakage audit, classifying the event for each evaluation item and classifying the monitoring item for each activity using the user's system; (c) assigning the weight to the monitoring item for each event as the weight is set; (d) assigning the threshold value to the monitoring item for each event as the threshold value is set; (e) if checked by the security manager as a request for setting the security risk index, performing a trend analysis and statistical analysis for each user using the system in response to the information leakage audit, and calculating the security risk index; And (f) when the threshold adjustment by the security manager is requested, reflecting the threshold adjusted for each evaluation item, and then feeding back to process (d), The log file in which the usage history is stored includes web access information, job and general mail sending information, KMS information of storage and printing, EDMS information of storage and printing, drawing management information of storage and printing, USB storage information and decryption according to job search activities. At least one of the information, The security risk index includes virus infection information, office security violation information, computer security software installation information, employment site visit history information, resume transmission information, business unit request information, supplier information, security program bypass information, information leaker information, department security Based on at least one of information, prospective retiree information and personnel disciplinary information, The security risk index is made through the calculation of the final standard scores, the calculation of the final standard scores are set by weighting for each classified item, the threshold range is set, it is made by scoring the number of times according to the item is scored A computer-readable recording medium equipped with an information leakage audit method using log information. A log information collection module for collecting log information from a log file in which system usage history of each user for operations performed through an internal information system or a gateway is stored; ID standardization module for standardizing the log by extracting the ID for each log stored in the code table DB; An event extraction module for extracting log information standardized by the ID standardization module for each event; A weight setting module for setting a weight on the log information for each event extracted by the event extraction module; A threshold setting module configured to receive an initial threshold value for each event and set a threshold value; A threshold analysis module for analyzing whether log information corresponding to a weighted event has exceeded a threshold; A linkage analysis module for linking monitoring items for each event or log and evaluation items corresponding thereto; A security risk index calculation module for calculating a security risk index for each user or event based on the information analyzed by the linkage analysis module; A trend analysis module for analyzing the information corresponding to the security risk index by user or event, date or time, and displaying the data in a graph or table form to be recognized by the security manager; And And a threshold consistency analysis module that matches a threshold value based on information corresponding to the security risk index analyzed by the trend analysis module and provides the threshold value setting module to the threshold value setting module. The log file in which the usage history is stored includes web access information, job and general mail sending information, KMS information of storage and printing, EDMS information of storage and printing, drawing management information of storage and printing, USB storage information and decryption according to job search activities. At least one of the information, The security risk index includes virus infection information, office security violation information, computer security software installation information, employment site visit history information, resume transmission information, business unit request information, supplier information, security program bypass information, information leaker information, department security Based on at least one of information, prospective retiree information and personnel disciplinary information, The security risk index is made through the calculation of the final standard scores, the calculation of the final standard scores are set by weighting for each classified item, the threshold range is set, it is made by scoring the number of times according to the item is scored Information leak audit system using log information. delete delete delete delete

Images