How to detect personal information from unstructured data and measure the risk of exposure

Abstract

To provide a method for detecting private information from unstructured data and measuring the risk of exposure of private information, using an entity-name recognition technology.SOLUTION: A method comprises the steps of: using an artificial intelligence modeler which provides learning data to a preset private information detection algorithm to build a private information detection model; using the private information detection model which receives unstructured data to detect private information; using a risk analysis unit which clusters the private information detected by target of private information based on the detected private information and corresponding target information; and quantifying the risk of exposure of private information for each cluster.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a method for detecting personal information from non-standard data and measuring the risk of personal information exposure, and more particularly, to a method for clustering personal information by target based on personal information and corresponding target information using a personal information detection model generated through machine learning, and quantifying the risk of personal information exposure for each cluster. [Background technology]

[0002] In today's highly advanced society, the importance of personal information is gradually increasing, and hacking techniques to steal personal information are becoming more sophisticated. In the case of standardized data, it is relatively clear that personal information is included, so it is easy to apply preventive measures to protect standardized data from hacking, but it is not easy to determine whether personal information is present in unstandardized data. Here, unstandardized data is data that is difficult to search for specific data because it does not have a specific schema or can be data in various formats, and can refer to text data including mobile messengers such as KakaoTalk, Line, and NateOn, and SNS posts and comments such as Instagram, Facebook, and Naver Cafe. In particular, as users become more sensitive to the infringement of personal information, there has been a rapid increase in cases where personal information is modified in various ways when it is entered in mobile messengers and social media posts and comments, such as ``Gong1Gong-1234-O6Chil8'' and ``O1O-(1)234-5Yuk78'', where numbers are replaced with Hangul, English, special characters, etc. Existing personal information detection technologies are mainly based on rule-based detection, making it difficult to detect personal information, especially in mobile messengers and social media posts and comments, where text is frequently transformed and abbreviated. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Korean Patent No. 10-1727139 (Registration Date: April 10, 2017) [Patent Document 2] Korean Patent No. 10-2196508 (Registration Date: December 22, 2020) Summary of the Invention [Problem to be solved by the invention]

[0004] The present invention has been devised to improve the above-mentioned problems, and an objective of the present invention is to provide a method for detecting personal information from non-standard data and measuring the exposure risk by utilizing individual name recognition technology.

[0005] In addition, according to an embodiment of the present invention, it is an object to provide improved personal information detection performance by considering both speaker and speech act information.

[0006] Another object of the present invention is to provide a method for measuring the degree of risk of personal information exposure by taking into account the object to which each identified personal information refers. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, a method for detecting personal information from unstructured data and measuring a risk of exposure according to one embodiment of the present invention is characterized by including a step of constructing a personal information detection model by an artificial intelligence modeler by providing learning data to a pre-set personal information detection algorithm, a step of receiving input of unstructured data and detecting personal information by the personal information detection model, a step of clustering the detected personal information by target of personal information based on the detected personal information and corresponding target information by a risk analysis unit, and a step of quantifying a risk of personal information exposure for each cluster by the risk analysis unit.

[0008] According to one embodiment, the step of constructing the personal information detection model by the artificial intelligence modeler includes a learning data construction step of collecting text data including personal information and performing preprocessing, a step of setting the pre-set personal information detection algorithm to initially set the personal information detection model, a step of providing the learning data to the personal information detection model to perform learning, a model testing step of testing the learned personal information detection model, a model tuning step of analyzing test results in the model testing step and tuning at least one of a plurality of parameters of the personal information detection model, and a model verification step of providing verification data to the tuned personal information detection model to evaluate the accuracy of the detected personal information.

[0009] According to one embodiment, the learning data construction step is characterized in that personal information individual name tagging is performed from the collected text data, and the text data containing personal information is text data containing personal information or a transformed form of personal information.

[0010] According to one embodiment, when performing personal information individual name tagging from the collected text data in the learning data construction step, object information of the corresponding personal information is also labeled.

[0011] According to one embodiment, in the step of detecting personal information by receiving unstructured data using the personal information detection model, speech act information is analyzed from the unstructured data to determine the possibility of the unstructured data containing personal information.

[0012] According to one embodiment, the step of clustering the detected personal information by the risk analysis unit based on the detected personal information and the corresponding target information, is characterized by including a step of classifying the detected personal information based on a personal identification risk level and a step of defining an attribute relationship between personal information classes.

[0013] According to an embodiment, the attribute relationship between the personal information classes includes at least one of a causal relationship, an inclusion relationship, and a direct / indirect relationship.

[0014] According to an embodiment, the personal information exposure risk is calculated as a score or a grade. Effect of the Invention

[0015] A method for detecting personal information from unstructured data and measuring the risk of exposure according to one embodiment of the present invention can detect personal information in a deformed form that deviates from a typical form by utilizing individual name recognition technology.

[0016] In addition, the embodiment of the present invention can calculate the risk of personal information being exposed for each subject of personal information by combining each piece of personal information that has a low possibility of identifying an individual. [Brief description of the drawings]

[0017] [Figure 1] 1 is a flowchart illustrating a method for detecting personal information from unstructured data and measuring an exposure risk according to an embodiment of the present invention. [Diagram 2] 4 is a flowchart illustrating in more detail a personal information detection model construction step according to an embodiment of the present invention. [Diagram 3] 4 is a flowchart illustrating a step of clustering personal information by subjects in accordance with an embodiment of the present invention in more detail. [Figure 4] 1 is a diagram illustrating a system for detecting personal information from unstructured data and measuring a risk of exposure according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a block diagram illustrating components of a server according to one embodiment of the present invention. [Figure 6] 1 is a diagram illustrating an example of personal information individual name tagging according to an embodiment of the present invention. [Figure 7] 1 is a diagram showing items and definitions of speech act information according to an embodiment of the present invention. [Figure 8]1 is a diagram visually illustrating an example of clustering personal information and calculating a risk of personal information exposure according to an embodiment of the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] The above-mentioned present invention will now be described in detail with reference to the accompanying drawings and examples.

[0019] It should be noted that the technical terms used in the present invention are merely used to describe a specific embodiment and are not intended to limit the present invention. In addition, unless otherwise defined in the present invention, the technical terms used in the present invention should be interpreted in a way that is generally understood by a person having ordinary knowledge in the technical field to which the present invention belongs, and should not be interpreted in an overly comprehensive or overly narrow sense. In addition, when the technical terms used in the present invention are incorrect technical terms that cannot accurately express the idea of ​​the present invention, they should be replaced and understood by technical terms that can be correctly understood by a person skilled in the art. In addition, the general terms used in the present invention should be interpreted according to the definition in a dictionary or in the context, and should not be interpreted in an overly narrow sense.

[0020] In addition, singular expressions used in the present invention include plural expressions unless the context clearly indicates otherwise. In the present invention, the terms "comprise" or "include" should not be interpreted as including all of the various components or steps described in the invention, but should be interpreted as including some of the components or steps not included, or as including additional components or steps.

[0021] In addition, terms including ordinal numbers such as "first" and "second" may be used in the present invention to describe elements, but elements should not be limited by the terms. Terms are used only for the purpose of distinguishing one element from another element. For example, a first element may be named a second element, and similarly, a second element may be named a first element, without departing from the scope of the present invention.

[0022] Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the attached drawings. Regardless of the drawing numbers, the same or similar components will be given the same reference numbers and redundant descriptions thereof will be omitted.

[0023] In addition, in describing the present invention, if it is determined that a detailed description of related prior art may obscure the gist of the present invention, the detailed description will be omitted. Also, please note that the attached drawings are merely for the purpose of making the concept of the present invention easier to understand, and the concept of the present invention should not be construed as being limited by the attached drawings.

[0024] In the following description, the term "a system for performing a method for detecting personal information from unstructured data and measuring the exposure risk" of the present invention may be abbreviated to "system" for convenience of explanation.

[0025] Hereinafter, a method for detecting personal information from unstructured data and measuring a risk of exposure according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

[0026] FIG. 1 is a flowchart showing a method for detecting personal information from unstructured data and measuring the risk of exposure according to one embodiment of the present invention, FIG. 2 is a flowchart showing the personal information detection model construction step (S110) in more detail according to one embodiment of the present invention, FIG. 3 is a flowchart showing the personal information clustering step (S130) for each subject according to one embodiment of the present invention in more detail, FIG. 4 is a diagram showing a system for performing a method for detecting personal information from unstructured data and measuring the risk of exposure according to one embodiment of the present invention, FIG. 5 is a block diagram showing components of a server 100 according to one embodiment of the present invention, FIG. 6 is a diagram showing an example of personal information individual name tagging according to one embodiment of the present invention, FIG. 7 is a diagram showing items and definitions of speech act information according to one embodiment of the present invention, and FIG. 8 is a diagram visually showing an example of personal information clustering and calculating the risk of personal information exposure according to one embodiment of the present invention.

[0027] Referring first to FIG. 4, the system according to the embodiment of the present invention may be implemented in the form of a user terminal 200 and a server 100 .

[0028] The user terminal 200 can provide unstructured data and receive the risk of personal information exposure from the server 100 and display it to the user. Here, unstructured data refers to conversational text data. Examples of conversational text data include text data of messengers or text messages, posts or comments on social media or internet cafes, etc.

[0029] Mobile messengers, social media, and internet cafe postings and comments often contain personal information that is modified in various ways, such as substituting Hangul, English, or special characters for numbers, such as “Gong1Gong-1234-O6Chil8” or “O1O-(1)234-5Yuk78.” Therefore, the artificial intelligence modeler 110 can provide such modified data to the personal information detection model 120 by including it as learning data.

[0030] According to one embodiment, the unstructured data can include photos and images. Photos and images attached to messenger, text messages, social media, and internet cafe posts and comments can be saved, and personal information can be detected based on text recognized on personal documents such as identification cards, such as resident registration cards, academic transcripts, and graduation certificates through OCR (Optical Character Recognition) for the photos and images.

[0031] The user terminal 200 includes wireless communication devices that can be carried by a user, such as a smartphone, a smartpad, a tablet PC, a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular system (PDC), a personal handyphone system (PHS), a personal digital assistant (PDA), an international mobile telecommunication (IMT)-2000, a code division multiple access (CDMA)-2000, a W-code division multiple access (W-CDMA), a wireless broadband internet (Wibro) terminal, and a portable computing device, such as a desktop PC or a notebook computer.

[0032] The server 100 communicates with the user terminal 200 to exchange information and data with each other, and is responsible for detecting personal information, measuring the degree of exposure risk, and providing the degree of exposure risk. The server 100 has the same hardware configuration as a typical web server 100, and can include program modules that are implemented using various languages ​​such as C, C++, Java, Visual Basic, Visual C, etc., and perform various functions, in terms of software. In addition, the server 100 can be implemented on the general server 100 hardware using various web server 100 programs provided by operating systems such as DOS, Windows, Linux, Unix, Macintosh, Android, and iOS.

[0033] An example of the network communication connecting the user terminal 200 and the server 100 in this embodiment may include, but is not limited to, a mobile communication network built according to a technical standard or communication method for mobile communication (e.g., GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), CDMA2000 (Code Division Multi Access 2000), EV-DO (Enhanced Voice-Data Optimized or Enhanced Voice-Data Only), WCDMA (registered trademark) (Wideband CDMA), HSDPA (High Speed ​​Downlink Packet Access), HSUPA (High Speed ​​Uplink Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution-Advanced), 5G, etc.). Furthermore, examples of wired communication networks may be closed networks such as LAN (Local Area Network) and WAN (Wide Area Network), and preferably an open network such as the Internet.The Internet refers to a worldwide open computer network structure that provides the TCP / IP protocol and various services that exist at its higher layers, namely HTTP (HyperText Transfer Protocol), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), SNMP (Simple Network Management Protocol), NFS (Network File Service), and NIS (Network Information Service).

[0034] According to the above-described structure, the system of the embodiment of the present invention can receive unformatted data from the user terminal 200, detect personal information, measure the risk of exposure, and provide the exposure risk in a numerical form to the user terminal 200.

[0035] Referring to FIG. 5, a server 100 according to an embodiment of the present invention may include an artificial intelligence modeler 110, a personal information detection model 120, and a risk analysis unit .

[0036] The artificial intelligence modeler 110 provides learning data to a preset personal information detection algorithm to construct a personal information detection model 120 .

[0037] More specifically, the AI ​​modeler 110 constructs the personal information detection model 120. First, the AI ​​modeler 110 collects text data including personal information and performs preprocessing. To this end, the AI ​​modeler 110 can collect text data through text mining.

[0038] In this process, when text data is collected, the AI ​​modeler 110 performs data pre-processing such as data normalization, data separation, morphological analysis (tokenization), individual name recognition, original form restoration, stop word removal, and word frequency analysis.

[0039] Data normalization is the process of integrating words that are expressed differently. For example, if the same expression contains typos, it is processed as the same word. "I'm happy" and "I'm happy" can be processed as the same word through data normalization.

[0040] Data separation can proceed if data needs to be separated by characteristics.

[0041] Morphological analysis (tokenization) is the process of converting text into the smallest unit of language that has a certain meaning, also known as part-of-speech tagging. Tokenization can be based on words, characters, phrases, sentences, paragraphs, etc.

[0042] Next, individual name recognition refers to recognizing a specific word as an individual having a name. The artificial intelligence modeler 110 performs personal information individual name tagging from collected text data. Personal information individual name tagging is tagging data that can indicate personal information from collected text data, and as shown in FIG. 6, personal information individual name can include name, nickname / nickname, date of birth, age, sex, height, weight, blood type, religion, nationality, club / club, address, building name, medical insurance number, resident registration number, alien number, passport number, driver's license number, mobile phone number, regular phone / fax number, card number, account number, email address, vehicle number, workplace name, department name, job responsibility / job rank, school name, grade, major, ID, URL, IP information, identification tag, working unit, etc., and it can be seen that each individual name tag is composed of an abbreviation of the English alphabet and an underscore, etc.

[0043] The artificial intelligence modeler 110 can perform individual name recognition by incorporating a transformer-based individual name recognition device.

[0044] Original form restoration involves changing the original form of an adjective or verb, or converting a stem or ending into an original form. For example, "I want to rest" and "I want to rest" can be changed to "rest," and "see," "see" and "see" can be changed to "see-."

[0045] Stop word removal is the process of removing particles and suffixes such as te, ni, o, and ha.

[0046] Word frequency analysis determines whether stop words and frequent words should be removed and verifies whether the desired words have been correctly extracted.

[0047] Next, a preset personal information detection algorithm is set to initially set the personal information detection model 120 .

[0048] Here, the pre-set personal information detection algorithm is an artificial neural network learning model that can be applied to the personal information detection model 120, and may be any one or a combination of a recurrent neural network (RNN) model, a convolutional neural network (CNN), and a Bidirectional Encoder Representations from Transformers (BERT).

[0049] Thereafter, the artificial intelligence modeler 110 provides the learning data to the personal information detection model 120 to perform learning.

[0050] Thereafter, the artificial intelligence modeler 110 performs testing on the personal information detection model 120 that has completed the learning.

[0051] If the test results do not meet the preset accuracy, the artificial intelligence modeler 110 may tune at least one of the parameters of the personal information detection model 120 .

[0052] The personal information detection model 120 again performs learning through the learning data.

[0053] Thereafter, the artificial intelligence modeler 110 may retest the personal information detection model 120 with at least one of the multiple parameters tuned.

[0054] At this time, if the test result exceeds a preset accuracy, the AI ​​modeler 110 provides verification data to the personal information detection model 120 to verify the accuracy of the detected personal information.

[0055] Here, if the verification result does not reach a preset accuracy, the artificial intelligence modeler 110 may analyze the verification result and tune at least one of the parameters of the personal information detection model 120 again.

[0056] The personal information detection model 120 again performs learning through the learning data.

[0057] If the verification result exceeds a preset accuracy, it may be determined that the personal information detection model 120 is ready for substantial personal information detection.

[0058] The personal information detection model 120 receives input of non-standard data and detects personal information. At this time, the personal information detection model 120 can utilize an individual name recognition technology.

[0059] The risk analysis unit 130 may group the detected personal information by the target of the personal information based on the detected personal information and the corresponding target information, and may digitize the risk of personal information exposure for each group.

[0060] Referring to FIG. 1, a method for detecting personal information from unstructured data and measuring the risk of exposure according to an embodiment of the present invention may include a step (S110) of constructing a personal information detection model 120 by providing learning data to a pre-set personal information detection algorithm by an artificial intelligence modeler 110, a step (S120) of receiving input of unstructured data and detecting personal information by the personal information detection model 120, a step (S130) of clustering the detected personal information by target of personal information based on the detected personal information and corresponding target information by the risk analysis unit 130, and a step (S140) of quantifying the risk of personal information exposure for each cluster by the risk analysis unit 130.

[0061] In the step (S110) of constructing the personal information detection model 120 by providing learning data to a preset personal information detection algorithm by the AI ​​modeler 110, the AI ​​modeler 110 first collects text data including personal information and performs preprocessing. For this, the AI ​​modeler 110 can collect text data through text mining. In this process, when the text data is collected, the AI ​​modeler 110 performs data preprocessing such as data normalization, data separation, morphological analysis (tokenization), individual name recognition, original restoration, stop word removal, and word frequency analysis. The data preprocessing will be described later in the description of FIG. 2.

[0062] Next, a preset personal information detection algorithm is set to initially set the personal information detection model 120 .

[0063] Here, the pre-set personal information detection algorithm is an artificial neural network learning model that can be applied to the personal information detection model 120, and may be any one or a combination of a recurrent neural network (RNN) model, a convolution neural network (CNN), and a Bidirectional Encoder Representations from Transformers (BERT).

[0064] In the step of detecting personal information by receiving input of unstructured data using the personal information detection model 120 (S120), the personal information detection model 120 can detect personal information from the input unstructured data through individual name recognition.

[0065] A detailed description of the step (S130) of clustering the detected personal information by target of personal information based on the detected personal information and the corresponding target information by the risk analysis unit 130 and the step (S140) of quantifying the risk of personal information exposure for each cluster by the risk analysis unit 130 will be described later with reference to Figures 3 and 8.

[0066] Referring to FIG. 2, the step (S110) of constructing the personal information detection model 120 by the artificial intelligence modeler 110 can include a learning data construction step (S101) of collecting text data including personal information and performing preprocessing, a step (S102) of initially setting the personal information detection model 120 by setting the pre-defined personal information detection algorithm, a step (S103) of providing the learning data to the personal information detection model 120 to perform learning, a model testing step (S104) of testing the learned personal information detection model 120, a model tuning step (S105) of analyzing test results in the model testing step (S104) and tuning at least one of a plurality of parameters of the personal information detection model 120, and a model verification step (S106) of providing verification data to the tuned personal information detection model 120 to evaluate the accuracy of detected personal information.

[0067] In the learning data construction step (S110) of collecting text data including personal information and performing pre-processing, the AI ​​modeler 110 first collects text data including personal information and performs pre-processing. To this end, the AI ​​modeler 110 can collect text data through text mining.

[0068] In this process, when text data is collected, the AI ​​modeler 110 performs data pre-processing such as data normalization, data separation, morphological analysis (tokenization), individual name recognition, original form restoration, stop word removal, and word frequency analysis.

[0069] Data normalization is the process of integrating words that are expressed differently. For example, if the same expression contains typos, it is possible to process them as the same word. "I'm happy" and "I'm happy" can be processed as the same word through data normalization.

[0070] Data separation can proceed if data needs to be separated by characteristics.

[0071] Morphological analysis (tokenization) is the process of converting text into the smallest unit of language that has a certain meaning, also known as part-of-speech tagging. Tokenization can be based on words, characters, phrases, sentences, paragraphs, etc.

[0072] Next, individual name recognition refers to recognizing a specific word as an individual having a name. The artificial intelligence modeler 110 performs personal information individual name tagging from collected text data. Personal information individual name tagging is tagging data that can indicate personal information among collected text data, and as shown in FIG. 6, personal information individual names can include name, nickname / nickname, date of birth, age, sex, height, weight, blood type, religion, nationality, club / club, address, building name, medical insurance number, resident registration number, alien number, passport number, driver's license number, mobile phone number, regular phone / fax number, card number, account number, email address, vehicle number, workplace name, department name, job responsibility / job rank, school name, grade, major, ID, URL, IP information, identification tag, working unit, etc., and it can be seen that each individual name tag is composed of an abbreviation of the English alphabet and an underscore, etc.

[0073] The artificial intelligence modeler 110 can perform individual name recognition by incorporating a transformer-based individual name recognition device.

[0074] Original form restoration involves changing the original form of an adjective or verb, or converting a stem or ending into an original form. For example, "I want to rest" and "I want to rest" can be changed to "rest," and "see," "see" and "see" can be changed to "see-."

[0075] Stop word removal is the process of removing particles and suffixes such as te, ni, o, and ha.

[0076] Word frequency analysis determines whether stop words and frequent words should be removed and verifies whether the desired words have been correctly extracted.

[0077] In the step (S102) of setting the preset personal information detection algorithm and initially setting the personal information detection model 120, the preset personal information detection algorithm is an artificial neural network learning model that can be applied to the personal information detection model 120, and may be any one or a combination of a recurrent neural network (RNN) model, a convolutional neural network (CNN), and a Bidirectional Encoder Representations from Transformers (BERT).

[0078] Next, a step of providing the learning data to the personal information detection model 120 to perform learning (S103) is performed.

[0079] In a model testing step (S104) of testing the learned personal information detection model 120, the AI ​​modeler 110 performs testing on the learned personal information detection model 120. Here, if the test result does not reach a preset accuracy, the AI ​​modeler 110 may proceed to a model tuning step (S105) of tuning at least one of a plurality of parameters of the personal information detection model 120. Thereafter, the personal information detection model 120 performs learning again through the learning data.

[0080] Thereafter, the process returns to the model testing step (S104) to test the personal information detection model 120 again by tuning at least one of the parameters.

[0081] At this time, if the test result exceeds a preset accuracy, the process proceeds to the next step.

[0082] In a model verification step (S106) of providing verification data to the tuned personal information detection model 120 to evaluate the accuracy of the detected personal information, if the verification result does not meet the preset accuracy, the artificial intelligence modeler 110 can analyze the verification result and re-tune at least one of the multiple parameters of the personal information detection model 120.

[0083] Thereafter, the personal information detection model 120 again performs learning through the learning data.

[0084] If the verification result exceeds a preset accuracy, it may be determined that the personal information detection model 120 is ready for substantial personal information detection.

[0085] Referring to FIG. 3, the step of clustering the detected personal information by personal information target based on the detected personal information and the corresponding target information (S130) can include a step of classifying the detected personal information based on the personal identification risk level and a step of defining attribute relationships between personal information classes.

[0086] In the step of classifying the detected personal information based on the personal identification risk (S131), the personal identification risk may be set in advance for each piece of personal information, with a score corresponding to the risk.

[0087] In the step of defining attribute relationships between personal information classes (S132), the attribute relationships between personal information classes may include at least one of a causal relationship, an inclusion relationship, and a direct / indirect relationship.

[0088] In the step of quantifying the risk of personal information exposure for each crowd by the risk analysis unit (S140), it can be seen that a score of the risk of personal information exposure is preset for each type of detected personal information, as shown in Fig. 8. As shown in Fig. 8, the highest score of the personal information detected for each crowd can be set as the risk score of personal information exposure for the corresponding crowd. However, without being limited thereto, a weighted value can be added based on the number of personal information detected for each crowd and the possibility of identifying a person based on the combination of detected personal information to calculate the score, or a grade can be given for each score range.

[0089] Referring to FIG. 6, an example of performing personal information individual name tagging from the collected text data in the learning data construction step (S101) is shown.

[0090] Personal information individual names can include name, nickname / pet name, date of birth, age, gender, height, weight, blood type, religion, nationality, clubs / societies, address, building name, medical insurance number, resident registration number, alien number, passport number, driver's license number, mobile phone number, regular phone / fax number, card number, account number, email address, vehicle number, workplace name, department name, job responsibility / job rank, school name, grade, major, ID, URL, IP information, identification tag, and working unit, and it can be seen that each individual name tag consists of an abbreviation of the English alphabet and an underscore, etc.

[0091] Referring to FIG. 7, an example of defining speech act information is shown.

[0092] Here, a speech act is a linguistic act, i.e., an act performed through language, and is a concept derived from linguistic theory established in the 1960s. A speech act can be defined as a group interaction process in which an utterance produced unimpeded by one member of a group is accepted by other members as a specific function or act. Or, each turn of a conversation in a small group discourse or dialogue can be considered as a linguistic act, i.e., a speech act.

[0093] Speech act information can include Question, Inform, Answer, Request, Offer, Other, and None. Question is when the speaker wants to obtain specific information from the listener, Inform is when the speaker wants to convey information that constitutes semantic content to the listener (assuming the information is accurate), when the speaker conveys information to the listener, Answer is when the speaker wants to convey information that constitutes semantic content to the listener (assuming the information is accurate), i.e., when the speech act of the previous utterance is Question, Request is when the speaker wants the listener to perform a requested action, which is a directive act (command speech act), Offer is when the speaker wants the listener to do something in the way that the listener wants them to perform it (the speaker presents an option), which is a verbal promise act (promise speech act), Other is a speech act that does not belong to the above-mentioned speech acts, and None can be defined as an utterance in which no speech act appears.

[0094] Therefore, the AI ​​modeler 110 can set the personal information detection model 120 to determine that the utterance is highly likely to contain personal information if the speech act information is Inform, Answer, or Offer. Also, the AI ​​modeler 110 can set the personal information detection model 120 to determine that the utterance is less likely to contain personal information if the speech act information is Other or None.

[0095] Referring to FIG. 8, there is shown an example of personal information detected from chat (dialogue) data between two people, and the personal information is classified by subject, clustered, and quantified.

[0096] First, the following personal information can be identified from the conversation: pediatrician, dermatologist, Naju, national hospital, age 36, dentist, church, older brother. When clustering is performed for each of the relevant personal information, three clusters can be formed: cluster 1 (pediatrician), cluster 2 (dermatologist, Naju, national hospital, age 36), and cluster 3 (dentist, church, older brother).

[0097] A closer look at crowd 1 reveals that pediatricians (occupations) have a personal information exposure risk (personal information re-identification risk) of 0.2.

[0098] Looking closely at crowd 2, we can see that the scores for dermatologist (occupation), Naju National Hospital (workplace), and 36 years old (age) are 0.2, 0.6, and 0.8, respectively, indicating a personal information exposure risk (personal information re-identification risk) of 0.8.

[0099] Looking more closely at cluster 3, we can see that the values ​​for dentist (occupation), church (religion), and older brother (gender) are 0.2, 0.3, and 0.4, respectively, indicating a personal information exposure risk (personal information re-identification risk) of 0.4.

[0100] Here, we can see that the risk of personal information exposure is preset for each type of detected personal information: 0.2 for occupation, 0.3 for religion, 0.4 for gender, 0.6 for workplace, and 0.8 for age.

[0101] In addition, in FIG. 8, it can be seen that the highest score among the personal information detected for each crowd is set as the personal information exposure risk (personal information re-identification risk).

[0102] However, without being limited thereto, the weighting value may be set in consideration of the number of personal information exposed for each crowd and the possibility of identifying a person from a combination of exposed personal information.

[0103] For example, since crowd 2's occupation, workplace, and age are exposed, it can be determined that there is a high possibility that they will be identified as certain people, and the risk of personal information exposure can be calculated by multiplying the sum of each score by a pre-set weighting value, such as 1.5. According to this example, the risk of personal information exposure for crowd 2 can be 2.4.

[0104] The risk of personal information exposure quantified in this way can be displayed not only as a score, but also by setting a grade for each score range. For example, 0 to 0.3 can be set as risk level 5, 0.3 to 0.5 as risk level 4, 0.6 to 1.0 as risk level 3, 1.1 to 1.5 as risk level 2, and 1.6 or above as risk level 1.

[0105] Although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the above embodiment, and various modifications may be made by anyone having ordinary skill in the art to which the present invention pertains without departing from the spirit and scope of the present invention as set forth in the appended claims. [Explanation of symbols]

[0106] 100:Server 110: Artificial Intelligence Modeler 120: Personal information detection model 130: Risk Analysis Department 200: User terminal

Claims

1. A method for detecting personal information from non-standard data and measuring the degree of exposure risk, The first step is to construct a personal information detection model by providing learning data to a pre-defined personal information detection algorithm by an artificial intelligence modeler; A second step of detecting personal information by receiving unstructured data according to the personal information detection model; A third step of clustering the detected personal information by the risk analysis unit according to the target of the personal information based on the detected personal information and the corresponding target information; and A fourth step of quantifying the risk of personal information exposure for each group by the risk analysis unit; The first stage comprises: A learning data construction stage in which text data containing personal information is collected and preprocessed; setting the preset personal information detection algorithm to initially set the personal information detection model; providing the learning data to the personal information detection model to perform learning; a model testing step of testing the learned personal information detection model; a model tuning step of tuning at least one of a plurality of parameters of the personal information detection model by analyzing a test result of the model testing step; and A model verification step of providing verification data to the tuned personal information detection model to evaluate the accuracy of the detected personal information; In the first stage, The speech act information includes at least a "Question" which is a speech act when a person desires to obtain specific information, a "Inform" which is a speech act when a person wishes to convey specific information, and a "Answer" which is a speech act when a person wishes to convey specific information when the immediately preceding speech act is a "Question", The artificial intelligence modeler sets a personal information detection model so that, when the speech act information is "Inform" or "Answer", it determines that the corresponding utterance is likely to contain personal information; In the second stage, The speech act information is analyzed from the unstructured data to determine whether it may contain personal information. A method for detecting personal information from non-standard data and measuring the degree of exposure risk, comprising:

2. The learning data construction step performs personal information individual name tagging from the collected text data, 2. The method of claim 1, wherein the text data containing personal information is personal information or text data containing personal information in a modified form.

3. The method for detecting personal information from unstructured data and measuring the risk of exposure according to claim 2, characterized in that when performing personal information individual name tagging from the collected text data in the learning data construction step, target information of the corresponding personal information is also labeled.

4. A third step of clustering the detected personal information by the risk analysis unit based on the detected personal information and the corresponding target information, classifying the detected personal information based on a personal identification risk level; and 2. The method of claim 1, further comprising: defining attribute relationships between personal information classes.

3. The method of claim 1, further comprising: defining attribute relationships between personal information classes.

5. 5. The method of claim 4, wherein the attribute relationships between the personal information classes include a causal relationship, an inclusion relationship, and a direct / indirect relationship.

6. 2. The method of claim 1, wherein the personal information exposure risk is calculated as a score or a grade.

7. 2. The method of claim 1, wherein the unstructured data is conversational text data.

Images