System and method for control of personal information misuse

Abstract

A system and method for controlling misuse of personal information through AI-based anomaly detection are disclosed. A system for controlling misuse of personal information according to an embodiment of the present invention comprises: an access log generation unit that generates an access log for a personal information handler; an access log storage unit that structures and records the access log at a first time point; an access log analysis unit that outputs abnormal behavior information including behavior pattern deviation values ​​and behavior risk levels for the personal information handler's behavior based on an AI (Artificial Intelligence) learning result for at least one field of the structured access log at a second time point; and an access blocking unit that outputs an access blocking signal for the personal information handler based on the abnormal behavior information.

Description

Technology Field

[0001] The present invention relates to a system and method for preventing misuse of personal information, and more specifically, to a system and method for controlling misuse of personal information through AI-based anomaly detection. Background Technology

[0002] Personal information, a core asset of today's digital economy, is processed, managed, and stored through various information systems. Accordingly, governments around the world protect the rights of data subjects through strong regulations such as personal information protection laws, and mandate that companies and public institutions implement technical and administrative protective measures for the entire process of personal information processing.

[0003] To ensure compliance with these regulations and enhance internal security, most companies and public institutions operate systems that generate and store access logs—records of all activities performed by personal information handlers accessing personal information processing systems.

[0004] Existing methods for managing access logs are largely limited to reactive approaches that analyze logs to identify causes and track down responsibilities after abnormal behavior occurs. Consequently, it can be difficult for administrators or systems to review the vast amount of logs—hundreds of millions generated daily in large-scale systems—in real time to identify threats and respond immediately. The problem to be solved

[0005] The problem that the present invention aims to solve is to provide a personal information misuse control system and method that, by linking with a system handling personal information, can detect abnormal signs in real-time or near-time based on AI (Artificial Intelligence) and immediately process personal information misuse.

[0006] The problem that the present invention aims to solve is to provide a personal information misuse control system and method that, by linking with a system handling personal information, can increase the accuracy of detecting risks of personal information misuse through AI-based anomaly detection and minimize false positives or false negatives.

[0007] The problem that the present invention aims to solve is to provide a personal information misuse control system and method that can minimize manual intervention by administrators, implement a rapid and consistent security response system, and enhance the management efficiency of a personal information protection system by automating a series of threat response processes ranging from abnormal behavior detection, request for explanation, blocking decision, and execution.

[0008] The problems that the present invention aims to solve are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art to which the present invention pertains from the description below. means of solving the problem

[0009] A personal information misuse control system according to an embodiment of the present invention comprises: a connection log generation unit that generates a connection log for a personal information handler; a connection log storage unit that structures and records the connection log at a first time point; a connection log analysis unit that outputs abnormal behavior information including a behavior pattern deviation value and a behavior risk level for the personal information handler's behavior based on an Artificial Intelligence (AI) learning result for at least one field of the structured connection log at a first time point; and a connection blocking unit that outputs a connection blocking signal for the personal information handler based on the abnormal behavior information.

[0010] The above connection log generation unit can generate the connection log by inserting dynamic code into an application executed by a personal information handler when a class is loaded due to a specific action of the personal information handler.

[0011] The above connection log storage unit can index and distribute the connection log in real time and process search requests for the connection log received from the connection log analysis unit in parallel.

[0012] The above access log storage unit can structure the access log with at least one of an action subject field, an action time field, an action location field, and an action type field for identifying the action of a personal information handler, and an action object field.

[0013] The above access log analysis unit calculates the behavior pattern deviation value by AI learning the correlation between at least one of the behavior subject field, the behavior time field, the behavior location field, and the behavior type field and the behavior object field, and can process the behavior risk level as a first stage if the behavior pattern deviation value is greater than or equal to a first value.

[0014] The above access log analysis unit can process the behavior risk level to the first stage regardless of the calculation of the behavior pattern deviation value if the handler attribute of the personal information handler included in the above behavior subject field does not match the behavior type of the above behavior type field.

[0015] The above access log analysis unit may include: a first vector extractor that quantifies some or all fields of the structured access log to extract a multidimensional current behavior vector for a personal information handler; a second vector extractor that collects and analyzes the current behavior vector during a first period to extract a reference behavior vector for a personal information handler; and a deviation value calculator that calculates the distance or similarity between the current behavior vector and the reference behavior vector as the behavior pattern deviation value.

[0016] The above personal information misuse control system may further include an explanation processing unit that outputs an explanation request corresponding to the above abnormal behavior information, receives explanation information corresponding to the above explanation request, and generates a judgment signal regarding whether the explanation information complies with the personal information protection policy.

[0017] The above connection blocking unit can output the connection blocking signal in response to the above determination signal.

[0018] The above personal information misuse control system may further include an integrated managing unit that sets or updates AI learning parameters in the access log analysis unit in response to the personal information protection policy applied to the personal information handler, and generates an access report in a first cycle that includes the status and statistics of the access log, the abnormal behavior information, and the access blocking signal.

[0019] The above access log analysis unit calculates the behavior pattern deviation value by including a probability-based judgment on the probability distribution of possible events based on a learned event sequence and a Top-K based judgment on the top K (K is a positive integer) candidate groups with a high probability of occurrence among predicted event candidates, and can calculate the behavior risk level based on the context and cause of the abnormal behavior corresponding to the behavior pattern deviation value.

[0020] A personal information misuse control system according to an embodiment of the present invention comprises: a security agent installed on a user system accessed by a personal information handler, which generates and collects access logs regarding the personal information handler's actions by inserting dynamic code into an application on a business server, and performs access blocking for the personal information handler in response to an access blocking signal upon detection of abnormal signs; a security platform that structures, stores, and manages the access logs generated by the security agent; and a security analyzer that analyzes abnormal signs regarding the personal information handler's actions based on AI learning results of the structured access logs, calculates an action pattern deviation value and an action risk level regarding the personal information handler's actions, and generates the access blocking signal.

[0021] The above personal information misuse control system may further include a security manager that provides a dashboard for visualizing and displaying statistical information regarding at least one of the collected access logs, the analyzed abnormal signs, and the generated access blocking signals, and generates a security report in a first cycle for recording and managing the access rights history of personal information handlers.

[0022] The above personal information misuse control system may further include an explanation processing manager that, when the behavior pattern deviation value and the behavior risk level are greater than or equal to a second value, transmits an explanation request to a business server and receives explanation information regarding the explanation request to determine compliance with the personal information protection policy.

[0023] The security platform may include: a log collector that collects large-scale access logs streamed in real-time from a plurality of security agents; a log structuring module that structures the access logs of the log collector in parallel; a distributed data processing engine that stores the structured access logs in a distributed manner; and a log search engine that processes search requests for the distributed structured access logs in parallel.

[0024] A method for controlling misuse of personal information according to an embodiment of the present invention comprises: a step of generating an access log for a personal information handler; a step of structuring and recording the access log; a step of outputting abnormal behavior information including a behavior pattern deviation value and a behavior risk level for the personal information handler's behavior based on an AI learning result for at least one field of the structured access log; and a step of outputting an access blocking signal for the personal information handler based on the abnormal behavior information. Effects of the invention

[0025] According to the personal information misuse control system and method of the embodiment of the present invention, by automatically executing access blocking measures simultaneously with or in close proximity to AI-based anomaly detection, preemptive prevention and response can be achieved before threatening behavior leads to actual damage.

[0026] According to the personal information misuse control system and method of the embodiment of the present invention, even for insiders with normal authority, potential threatening behaviors by insiders suspected of misusing authority, such as viewing or downloading information different from a normal profile, can be identified at an early stage, and additional system access by the user can be immediately blocked, thereby securing substantial control over the leakage of internal information.

[0027] According to the personal information misuse control system and method of the embodiment of the present invention, unnecessary alarms are reduced through clarification processing, thereby alleviating the operational burden on the administrator, and the entire series of response processes from threat detection to access blocking can be automated and recorded as a clear history.

[0028] According to the personal information misuse control system and method of the embodiment of the present invention, by individually processing fields required for processing or distributed log processing, it is possible to effectively perform personal information protection while minimizing system resources and improving system expansion flexibility.

[0029] According to the personal information misuse control system and method of the embodiments of the present invention, the effects are not limited to those mentioned above, and other unmentioned effects can be clearly derived and understood by a person skilled in the art to which the embodiments of the present invention belong (hereinafter referred to as "person skilled in the art") from the description below. That is, unintended effects resulting from the implementation of the embodiments of the present invention can also be derived by a person skilled in the art. Brief explanation of the drawing

[0030] FIG. 1 is a diagram showing a personal information misuse control system according to an embodiment of the present invention. FIG. 2 is a flowchart illustrating a method for controlling misuse of personal information according to an embodiment of the present invention. FIG. 3 is a drawing showing a connection log storage unit according to an embodiment of the present invention. FIG. 4 is a diagram showing a structured connection log according to an embodiment of the present invention. FIG. 5 is a diagram showing a connection log analysis unit according to an embodiment of the present invention. FIG. 6 is a diagram illustrating a method for calculating a behavior pattern deviation value according to an embodiment of the present invention. FIG. 7 is a diagram illustrating the AI ​​anomaly detection process according to an embodiment of the present invention. FIGS. 8 to 10 are drawings illustrating a personal information misuse control system according to an embodiment of the present invention. Specific details for implementing the invention

[0031] Hereinafter, embodiments of the present disclosure are described in detail with reference to the drawings so that those skilled in the art can easily practice them. However, the present disclosure may be embodied in various different forms and is not limited to the embodiments described herein. In relation to the description of the drawings, the same or similar reference numerals may be used for identical or similar components. Furthermore, in the drawings and related descriptions, descriptions of well-known functions and configurations may be omitted for clarity and brevity.

[0032] FIG. 1 is a diagram showing a personal information misuse control system (100) according to an embodiment of the present invention, and FIG. 2 is a flowchart showing a personal information misuse control method (200) according to an embodiment of the present invention.

[0033] Referring to FIGS. 1 and 2, the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention control the misuse of personal information stored in a database (DB) in a user system (10) accessed by a personal information handler in relation to work, etc. To this end, the personal information misuse control system (100) or the personal information misuse control method (200) can generate a connection log (LOG) through a connection log generation unit (110) (S220), structure and store the generated connection log (LOG) through a connection log storage unit (120) (S240), analyze the structured connection log (LOG') through a connection log analysis unit (130) (S260), and output a connection blocking signal (XBK) for a personal information handler for whom an abnormal sign has been detected through a connection blocking unit (140) (S280).

[0034] The personal information misuse control system (100) according to an embodiment of the present invention may be replaced or added by a method other than the personal information misuse control method (200) of FIG. 2, and the personal information misuse control method (200) according to an embodiment of the present invention may operate in a system other than the personal information misuse control system (100) of FIG. 1.

[0035] In the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention, the personal information handler is not limited to a legal or dictionary definition and may be used as a concept encompassing all entities capable of accessing the user system (10) to process personal information. In one embodiment, the personal information handler may include not only internal employees of the organization but also all external personnel who are granted temporary or permanent access rights due to business needs, such as personnel from external contractors for maintenance and development, employees of partner companies, and dispatched workers. Furthermore, automated systems or processes that process personal information without direct human intervention, such as batch programs that operate according to a set schedule and API (Application Programming Interface) clients that link data with other systems, may also be included in the category of personal information handlers according to an embodiment of the present invention.

[0036] In one embodiment, the user system (10) may be a concept encompassing all types of applications or information systems used by a personal information handler to access and process personal information. As illustrated in FIG. 1, the user system (10) may act as a medium that receives a request (REQ1) from a personal information handler, converts it into a query (e.g., SQL) that a database (DB) can understand, transmits it, and provides the result (Result Set) back to the handler in the form of a response (RSP). In one embodiment, the user system (10) may be implemented as a web-based business system running on a web application server (WAS).

[0037] In one embodiment, the user system (10) may be a civil complaint processing system, tax system, disease management system (e.g., the Disease Control and Prevention Agency's Integrated Information System for Disease Control and Prevention), mobile ID issuance system, etc. used by a national or public institution. In one embodiment, the user system (10) may be a bank core system or customer management system of a financial institution, an enterprise resource planning (ERP) system, human resource management system, call center consultation system, or customer relationship management (CRM) system of an enterprise, and may also be business software or platforms that handle personal information, such as a reservation and ticketing system of an airline or railway company, a travel product management system of a travel agency, or an academic management system of a university.

[0038] In the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention, the misuse of personal information may be a concept that includes not only unauthorized access to personal information, but also acts exceeding authorized authority, use of personal information outside the scope of business purposes, acts of viewing, printing, storing, downloading, and deleting an abnormal amount of data, attempts to access at abnormal times or unauthorized places, as well as all acts that may be considered potential insider threats such as account hijacking or privilege escalation, and processing of information that does not comply with laws or internal management plans.

[0039] In the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention, controlling personal information misuse may be a concept that includes misuse, abuse, loss, theft, leakage, forgery, alteration, or damage of personal information. In one embodiment, the control of personal information misuse may be a collective concept of a series of prevention, detection, response, and post-management activities, such as preventing misuse acts in advance, detecting and monitoring them in real time when they occur, analyzing and evaluating the risk level of the detected acts based on AI, performing response measures such as automatically issuing warnings, blocking, or requesting an explanation from the perpetrator according to the results, and supporting post-audits by tracking and recording the history of all abnormal acts that occurred and reporting them to an administrator.

[0040] In the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention, the blocking of access to a personal information handler is not limited to the act of blocking the personal information handler's next access or immediately disconnecting the network connection, but may be a concept that encompasses all technical measures to control access to personal information in a stepwise and diverse manner according to the risk level of abnormal behavior and the organization's security policy. In one embodiment, the blocking of access may mean control at the network level. This may include a method in which network security equipment, such as a firewall or an intrusion prevention system (IPS), blocks access to the handler's IP address or a specific port in response to a connection blocking signal (XBK). In one embodiment, the blocking of access may mean control at the application level. This may include a method in which a web application server (WAS) of a user system receives a connection blocking signal (XBK) and forcibly terminates the handler's active session or temporarily disables the account to prevent re-login.

[0041] In one embodiment, blocking the connection may mean granular control over the behavior itself, and may include methods such as selectively blocking only the execution of specific functions (e.g., download, modification) determined to be high-risk behavior, or suspending the execution of queries. For example, when a large amount of data is detected, instead of terminating the entire session, only the relevant query may be treated as a failure and a warning message may be displayed to the handler.

[0042] In one embodiment, blocking access may include all kinds of automated response measures to mitigate risk. This concept may be interpreted to include not only the aforementioned network and application controls, but also measures such as sending immediate warning notifications to a privacy officer (administrator) or transmitting the relevant activity to a security information and event management system to initiate additional analysis and response procedures.

[0043] Below, a structure and method according to an embodiment of the present invention are described in more detail to proactively prevent the misuse of personal information, minimize damage caused by the misuse of personal information, or maximize management efficiency regarding the misuse of personal information. However, for the convenience of explanation, a personal information misuse control system (100) is described, but the same can be applied to a personal information misuse control method (200).

[0044] The connection log generation unit (110) generates a connection log (LOG) in relation to an action (REQ1) regarding the user system (10) of the personal information handler. In one embodiment, the generated connection log (LOG) may be in the form of raw data including SQL query statements, method call information, HTTP request / response data, etc. In one embodiment, the connection log generation unit (110) may be implemented in the form of an agent installed in an application, such as a web application of the user system (10).

[0045] In one embodiment, the connection log generation unit (110) can generate a connection log (LOG) by inserting dynamic code into an application executed by a personal information handler when a class is loaded due to a specific action of the personal information handler. In this way, by generating a connection log (LOG) by interrupting the connection action by inserting dynamic code at the time the class is loaded without modifying the source code of the existing system, the system load can be minimized while ensuring the stability of system operation by generating connection records without omission.

[0046] In one embodiment, a specific act of a personal information handler may refer to an act performed by the personal information handler by accessing a DB in which personal information is stored through a user system (10). However, it is not limited thereto, and the access log generation unit (110) may also generate an access log (LOG) for other acts performed by the personal information handler on the user system (10), and the access log storage unit (120) may select and process the access logs (LOG) that are directly related to the handling of personal information.

[0047] In one embodiment, the connection log generation unit (110) can insert dynamic code using a Byte Code Instrumentation (BCI) method.

[0048] The connection log storage unit (120) receives the connection log (LOG) generated from the connection log generation unit (110) at a first point in time, structures it, records it, and manages it. In the present invention, the first point in time at which the connection log storage unit (120) operates can be set in various ways depending on the purpose and environment of the system. In one embodiment, the first point in time may refer to a point in time when the connection log (LOG) generated by the connection log generation unit (110) is processed in real-time or near real-time, or a point in time when the operation of the log collector (124) of FIG. 3 is activated. In one embodiment, the connection log storage unit (120) may be implemented as a big data platform and may use an encrypted communication channel to securely transmit the collected connection log (LOG).

[0049] FIG. 3 is a drawing showing a connection log storage unit (120) according to an embodiment of the present invention, and FIG. 4 is a drawing showing a structured connection log (LOG') according to an embodiment of the present invention.

[0050] Referring to FIGS. 1, 3, and 4, the access log storage unit (120) may include a log structuring module (122) that structures the generated access log (LOG) into a form optimized for accurate analysis and search. The structured access log (LOG') may include at least one of an action subject field, an action time field, an action location field, and an action type field for identifying the actions of a personal information handler, and an action object field.

[0051] In one embodiment, as illustrated in FIG. 4, the connection log storage unit (120) can structure the raw connection log (LOG) received as a data set of various formats into a data format defined as an action subject field, an action time field, an action location field, an action type field, and an action object field.

[0052] The structured connection log (LOG') contains various information to identify abnormal behavior in subsequent operations, and each field may include specific information such as the following.

[0053] The actor field may include information about the entity processing personal information, i.e., the personal information handler. In one embodiment, the actor field may include personnel information such as the personal information handler's login ID, employee number, name, department, and job title. In one embodiment, the actor field may further include status information capable of identifying whether the personal information handler's account is an account with normal access rights, an unauthorized account, or an account that has been inactive for a long time.

[0054] The action time field may include precise time information at which the corresponding action occurred. In one embodiment, the time information may include a timestamp in units of year, month, day, hour, minute, and second, and additional information may be recorded to distinguish whether the time is within normal business hours, before work hours, after work hours, early morning hours, or on weekends or holidays. In one embodiment, the action time field may further include information regarding the duration of the action, the number of times the action is repeated during any time interval, and the time interval between consecutive actions.

[0055] The action location field may include information about the logical or physical location where the action occurred. In one embodiment, the action location field may include information about the IP address or MAC address of the terminal accessed by the personal information handler, and information about whether the IP, etc. is a pre-registered authorized IP, an unauthorized IP, or an external public IP. Furthermore, URL (Uniform Resource Locator) information of the user system (10) to which the connection was made may also be recorded.

[0056] The behavior type field may include information indicating the type and characteristics of specific processing actions performed on personal information. In one embodiment, the behavior type field may include information regarding the viewing, creation, linking, integration, recording, storage, retention, processing, editing, searching, outputting, correction, recovery, use, disclosure, destruction, downloading, sharing, etc., of personal information. In one embodiment, the behavior type field may also include security-related event types, such as unauthorized privilege escalation attempts or access attempts via bypass paths. In one embodiment, the behavior type field may further include a status code indicating whether the corresponding action was successful, failed, or an error.

[0057] The log structuring module (122) may include some or all of the subject field, time of act, location of act, and type of act field that are included in the structured access log (LOG') corresponding to the privacy protection policy or privacy management policy and / or the system resources of the privacy misuse control system (100) applied to the user system (10).

[0058] The action object field may include information regarding the data subject or processed data that is the target of the action. In one embodiment, the action object field may include a unique identifier of the data subject, such as a resident registration number, passport number, membership number, or customer number; types of personal information items, such as name, gender, residential area, or contact information; the number of data items processed during a specific period, such as the number of views or downloads; and the size of the downloaded file.

[0059] In one embodiment, the log structuring module (122) can analyze SQL query statements and record 'SELECT' statements as 'query' and 'UPDATE' statements as 'modify' in the 'action type field', and analyze conditions of the 'WHERE' clause and record them in the 'action object field'. In one embodiment, the structured access log (LOG') may define actions in the user system (10) of a personal information handler, such as 'an action of downloading 10,000 pieces of customer information (action object) from an unauthorized IP (action location) on a day off (action time) with a former employee account (action subject) (action type)'.

[0060] In this way, by extracting multidimensional information from raw access logs and structuring each field, various situations regarding access to personal information are clearly described, and based on this, precise anomaly analysis can be performed in subsequent operations.

[0061] Referring further to FIGS. 1, 3 and 4, the connection log storage unit (120) according to an embodiment of the present invention can index and distribute structured connection logs (LOG') in real time and process search requests (REQ2) for them in parallel.

[0062] Generally, in user systems (10) operated by large-scale organizations such as finance, public sector, and medical institutions, a vast amount of access logs ranging from tens of millions to hundreds of millions can be generated in a single day. By implementing a distributed processing and parallel search architecture in an environment where a large volume of access logs are generated in real time, the access log storage unit (120) can maintain consistent high performance with limited system resources even as the amount of data increases.

[0063] To this end, the access log storage unit (120) may further include a log collector (124), a distributed processing engine (126), and a log search engine (128) together with the aforementioned log structuring module (122).

[0064] The log collector (122) can collect a large volume of connection logs (LOG) streamed from the connection log generation unit (110). The connection log generation unit (110) may be provided as a single unit for parallel processing or provided as a plurality for individual processing, thereby generating a large volume of connection logs (LOG) in multiple units at the same time.

[0065] At this time, the log structuring module (122) can also perform structuring of multiple connection logs (LOG) collected by the log collector (124) in parallel at a given time.

[0066] The distributed processing engine (126) can process the collected and structured access logs (LOG') in parallel and distribute them to multiple storage nodes for storage. In one embodiment, each storage node may be a unit that stores data physically or logically, and may be a physical server, a virtual machine (VM), or a computing instance in a cloud environment. In one embodiment, each storage node operates as an individual unit with independent CPU, memory, and disk resources, and multiple such storage nodes may be connected via a network to form a distributed file system that operates as one large storage.

[0067] In one embodiment, the distributed processing engine (126) can index the structured access log (LOG') and store it in a storage node. The indexing information can be shared with the log search engine (128).

[0068] The log search engine (128) can respond to a search request (REQ2) by sending queries in parallel to distributed storage nodes and quickly collecting and providing the results. The search request (REQ2) may be received from the access log analysis unit (130). However, it is not limited to this, and the search request (REQ2) may be received by the personal information manager of the user system (10), etc.

[0069] The result provided by the log search engine (128) in response to the search request (REQ2) may be a structured access log (LOG') stored in any storage node, or a part of the structured access log. In one embodiment, the log search engine (126) may analyze a query (e.g., 'Dae-ri Kim's download records from last weekend') on the received search request (REQ2) to extract keywords (e.g., 'Dae-ri Kim', 'weekend', 'download') corresponding to the search conditions, and then search for which storage node the access logs containing the corresponding keywords are stored by referring to indexing information.

[0070] In one embodiment, the log search engine (126) can simultaneously send queries to a plurality of storage nodes to search for connection logs that meet the conditions in parallel at each storage node. Upon receiving search results from each storage node, the log search engine (126) can aggregate them and sort them according to a requested sorting criterion (e.g., chronological order) to return a final search result (RSP2). The search result (RSP2) may be in the same form as or a different form from the structured connection log (LOG').

[0071] As described above, the log search engine (126) may provide a function to output only some fields of the structured access log (LOG') as a search result (RSP2) in response to a search request (REQ2). When a search request (REQ2) for 'Manager Kim's download record from last weekend' is received as in the example described above, the log search engine (126) may extract only the values ​​of the corresponding fields, for example, the subject of the action field, the time of the action field, the type of action field, and the object of the action field, and include them in the search result (RSP2). This reduces network traffic and allows the administrator of the access log analysis unit (130) or the user system (10) to identify the desired information more quickly, thereby further improving the efficiency of analysis in a large-scale data environment.

[0072] In one embodiment, the log search engine (128) may include a distributed search and analysis engine such as Elasticsearch.

[0073] Thus, the access log storage unit (120) according to the embodiment of the present invention can increase data normalization and analysis efficiency by structuring the access log. In addition, by adopting a distributed architecture, the access log storage unit (120) can flexibly respond by expanding storage nodes even if log data increases exponentially, and can continue the service without data loss by maintaining data replicas on other storage nodes even if a failure occurs in a specific storage node. At this time, through a parallel search function for distributed data, log information necessary for analysis or management can be retrieved within a short period of time even for a large amount of log data. This can be effective in shortening the time required for cause analysis in the event of a security incident.

[0074] Referring again to FIG. 1, the access log analysis unit (130) analyzes the structured access log (LOG') stored by the access log storage unit (120). In one embodiment, the access log analysis unit (130) may output abnormal behavior information (IAN) based on the AI ​​learning result for at least one field of the structured access log (LOG') or the structured access log (LOG'). The abnormal behavior information (IAN) may include a behavior pattern deviation value (VPD) and a behavior risk level (LRS) for the behavior of the personal information handler.

[0075] The access log analysis unit (130) can be implemented as an analysis engine (Analyzer) equipped with a machine learning or deep learning model. This model can learn past normal access log data to generate a normal behavior profile for each personal information handler or group (e.g., average working hours, IP range mainly used, daily average data throughput, etc.). Subsequently, when a new access log occurs, it can calculate a behavior pattern deviation value (VPD) and behavior risk level (LRS) by comparing it with the normal profile and using techniques such as statistical outlier detection, time series analysis, and supervised / unsupervised learning.

[0076] Therefore, potential and sophisticated threats that are difficult to detect using only predefined rules can be effectively identified, and by providing threat levels as quantified indicators, false positives can be reduced and the accuracy and efficiency of follow-up actions can be enhanced. This will be explained in more detail.

[0077] FIG. 5 is a diagram showing a connection log analysis unit (130) according to an embodiment of the present invention, and FIG. 6 is a diagram showing a method for calculating a behavior pattern deviation value (VPD) according to an embodiment of the present invention.

[0078] Referring to FIGS. 1, 5 and 6, the connection log analysis unit (130) according to an embodiment of the present invention may include a deviation value calculation module (132) that calculates a behavior pattern deviation value (VPD) and a risk level calculation module (134) that calculates a behavior risk level (LRS).

[0079] The deviation value calculation module (132) can calculate a behavior pattern deviation value (VPD) by AI learning the correlation between at least one of the behavior subject field, behavior time field, behavior location field and behavior type field and the behavior object field. In one embodiment, the behavior pattern deviation value (VPD) may be a quantitative value indicating the difference between the current behavior of a personal information handler and the past behavior pattern.

[0080] In one embodiment, the past behavior pattern serving as the basis for calculating the Behavioral Pattern Deviation Value (VPD) may be a behavior pattern at a point in time that is set differently according to the field values ​​of the aforementioned Acting Subject field, Behavioral Type field, or Behavioral Object field. In one embodiment, the past behavior pattern serving as the basis for calculating the Behavioral Pattern Deviation Value (VPD) may be a behavior pattern from the previous day or one week prior from the present. In one embodiment, the past behavior pattern serving as the basis for calculating the Behavioral Pattern Deviation Value (VPD) may be a behavior pattern at least two points in time. In one embodiment, if the field value of the Behavioral Object field indicates a high required security level, the past behavior pattern serving as the basis for calculating the Behavioral Pattern Deviation Value (VPD) may include a behavior pattern from the previous day, a behavior pattern from one week prior, and a behavior pattern from one month prior.

[0081] In one embodiment, the connection log analysis unit (130) can convert each field of the structured connection log (LOG') into a multidimensional vector to calculate a behavior pattern deviation value (VPD). To this end, the deviation value calculation module (132) may include a first vector extractor (132-2), a second vector extractor (132-4), and a deviation value calculator (132-6).

[0082] The first vector extractor (132-2) can extract a multidimensional current behavior vector (V1) for a personal information handler by quantifying some or all fields of a structured access log (LOG'). In one embodiment, the first vector extractor (132-2) can normalize the access time for the behavior time field based on a 24-hour basis, or cluster the access IP addresses for the behavior location field based on geographical proximity and assign a unique number to each cluster (e.g., Headquarters IP range: 1, Home IP range: 2). In one embodiment, the first vector extractor (132-2) can apply one-hot encoding to the behavior type field (e.g., Lookup: [1, 0, 0]), or adjust the range of values ​​for the behavior object field by converting the number of processed data items to a log scale.

[0083] The second vector extractor (132-4) can extract a reference behavior vector (V2) for a personal information handler by collecting and analyzing the current behavior vector (V1) during a first period. In one embodiment, the second vector extractor (132-4) can generate a reference behavior vector (V2) representing the normal profile of the handler by statistically analyzing the current behavior vector (V1) of the personal information handler collected during a specific period. Multiple current behavior vectors (V1) can be calculated as average values ​​or median values ​​for each dimension. For example, the reference behavior vector (V2) of the personal information handler can be calculated as follows.

[0084] V2= [Time: 0.4, Location: 1, Type: [0.9, 0.1, 0], Throughput: 1.5]

[0085] The deviation value calculator (132-6) can calculate the distance or similarity between the current behavior vector (V1) and the reference behavior vector (V2) as the behavior pattern deviation value (VPD). When a new connection log is received, it is converted into the current behavior vector (V1). The deviation value calculator (132-6) can calculate the difference between the current behavior vector (V1) and the pre-generated reference behavior vector (V2) using methods such as Euclidean distance or cosine similarity and output it as the behavior pattern deviation value (VPD).

[0086] The calculated current behavior vector (V1) and reference behavior vector (V2) can be represented as shown in FIG. 6. In FIG. 6, one of the polygons in the chart (e.g., a polygon connecting behavior type 5, behavior object 2, behavior subject 3, behavior location 2, and behavior time 2) may be a visualization of the reference behavior vector (V2) generated through AI learning. This may represent the average behavior pattern of the corresponding handler. Other polygons (e.g., solid line polygons) may represent the current behavior vector (V1) for different access logs. In this case, the difference in shape and size between the polygon representing the reference behavior vector (V2) and the polygon representing the current behavior vector (V1) may be calculated as the behavior pattern deviation value (VPD).

[0087] The risk calculation module (134) can process the behavior risk level as a first stage when the behavior pattern deviation value (VPD) is greater than or equal to a first value. In one embodiment, when the behavior pattern deviation value (VPD) exceeds an arbitrary threshold, the risk calculation module (134) can determine the risk level of the corresponding behavior as a stage such as 'high', 'caution', 'warning', etc.

[0088] The operation of the ditch value calculation module (132) and the risk level calculation module (134) may be based on the AI ​​learning results. To this end, the access log analysis unit (130) according to an embodiment of the present invention may further include an AI learning module (136).

[0089] In one embodiment, the AI ​​learning module (136) can learn a pattern from a structured access log (LOG'), etc., such as 'Personal information handler A primarily queries customer information (action object) from an internal IP (action location) during business hours (action time) (action type).' If personal information handler A 'downloads a large amount of customer information (action object) from an external IP (action location) during the early morning hours (action time) (action type),' this can be calculated as a high behavior pattern deviation value (VPD) because the correlation with the learned normal pattern is very low.

[0090] FIG. 5 illustrates that the AI ​​learning module (136) is included in the access log analysis unit (130), but is not limited thereto. The AI ​​learning module (136) may be provided outside the personal information misuse control system (100) according to an embodiment of the present invention.

[0091] In one embodiment, the access log analysis unit (130) may perform an analysis operation based on a privacy protection policy (STA) received from the user system (10). In one embodiment, the access log analysis unit (130) may process the behavior risk level (LRS) as a first step regardless of the calculation of the behavior pattern deviation value (VPD) when the handler attribute for the personal information handler included in the actor subject field and the behavior type of the behavior type field do not match, for example, in the case of obvious abuse of authority (e.g., an attempt by an HR team employee to change server settings).

[0092] In one embodiment, the access log analysis unit (130) may vary the influence or degree of reflection of the subject field, time field, location field, type field, or object field of the structured access log (LOG') for the behavior pattern deviation value (VPD) in conjunction with the privacy protection policy (STA).

[0093] In one embodiment, the access log analysis unit (130) may include a personal information handler in a separate risk pool if the value of the processed data in the behavior object field exceeds a certain data capacity. In calculating the behavior pattern deviation value (VPD) for a personal information handler included in the risk pool, the extraction criteria for the current behavior vector (V1) or the reference behavior vector (V2) may be set differently. Alternatively, the behavior risk level (LRS) for the same behavior pattern deviation value (VPD) for a personal information handler included in the risk pool may be set differently.

[0094] In one embodiment, the connection log analysis unit (130) can perform an analysis operation of the structured connection log (LOG') as described above at a second point in time. In the present invention, the second point in time at which the connection log analysis unit (130) operates can be set in various ways depending on the purpose and environment of the system. In one embodiment, the second point in time can be set in a periodic batch method or an event-driven method. In the former case, the connection log analysis unit (130) can process the structured connection log (LOG') or some field values ​​of the structured connection log (LOG') at intervals of 1 minute, 5 minutes, or 1 hour. In the latter case, the connection log analysis unit (130) can process the structured connection log (LOG') or some field values ​​of the structured connection log (LOG') when a specific type of predefined activity, such as a download, occurs.

[0095] In one embodiment, the access log analysis unit (130) can intelligently analyze the behavior of a personal information handler using AI technology such as deep learning, as described above. That is, by learning the context and sequence of continuous behavior over time, it may be possible to detect complex abnormal signs that deviate from normal patterns.

[0096] The configuration and operation of the AI ​​model applied to the access log analysis unit (130) described below correspond to the configuration and operation of the aforementioned stray value calculation module (132), risk calculation module (134), and AI learning module (136), or may include, combine, or replace all or part of the configuration and operation of the stray value calculation module (132), risk calculation module (134), and AI learning module (136).

[0097] In one embodiment, the AI ​​operation of the access log analysis unit (130) can be broadly divided into (1) a learning phase and (2) a detection phase, and the detected result can be generated as a comprehensive (3) abnormal behavior information (IAN).

[0098] 1. Learning Phase: Normal Behavior Pattern Modeling. The goal of the learning phase is to create a standard model for normal behavior for each personal information handler or group. In this phase, structured logs (LOG') accumulated in the access log storage unit (120) for a certain period (e.g., 30 days, 60 days) can be used as learning data. The learning data may include records of continuous behavior, such as the handler's access time, access location, tasks performed, and processing results. A deep learning model based on LSTM (Long Short-Term Memory) may be applied for this sequential data analysis. An unsupervised learning algorithm may be adopted that remembers the order of system logs and determines an anomaly when an abnormal order appears.

[0099] In one embodiment, the AI ​​model can be trained to predict the next event by remembering a sequence of past events. For example, a sequential pattern can be learned such that a 'main screen view' event usually follows a 'login success' event, and then a 'customer list view' event follows.

[0100] In one embodiment, the performance and characteristics of the AI ​​model of the access log storage unit (120) can be optimized through various hyperparameter settings. For example, the following parameters can be set.

[0101] - Window Size: Number of previous events to refer to in order to predict the next event (e.g., 10)

[0102] - Learning Rate, Batch Size, Epochs: Determines how fast and precisely the model learns

[0103] - Hidden Size, Layer Count: Determines the complexity of the LSTM neural network and influences the model's expressiveness.

[0104] Through the learning steps described above, a 'normal behavior sequence model' reflecting the unique work styles and habits of each personal information handler or group can be generated.

[0105] 2. Inference Phase: Detection of anomalies in real-time or near-delay. In the inference phase, a trained AI model is applied to determine in real-time whether newly occurring connection logs deviate from normal patterns.

[0106] FIG. 7 is a diagram illustrating an AI anomaly detection procedure according to an embodiment of the present invention.

[0107] Referring to FIGS. 1 and FIGS. 7, the connection log analysis unit (130) according to an embodiment of the present invention may use a combination of two or more of the following methods to increase the accuracy of the analysis.

[0108] (1) Probability-based judgment: When a new connection log occurs, the learned model of the connection log analysis unit (130) predicts the probability distribution of all possible events that may appear next based on the past event sequence.

[0109] At this point, the predicted probability (p) that the event actually occurred occupies in the probability distribution predicted by the model is checked. If the predicted probability (p) is lower than a pre-set threshold probability, it is determined that the event is unlikely to occur in that order and may be considered an anomaly. For example, when an operator who usually only performs inquiry tasks suddenly attempts to delete data, if the probability of the deletion behavior predicted by the model is p=0.002 and the threshold is 0.5% (0.005), since p is smaller than the threshold, this behavior can be detected as an anomaly.

[0110] (2) Top-K based judgment: Among the next event candidates predicted by the model of the access log analysis unit (130), the top K candidates with the highest probability (Top-K) can be selected. In other words, a list of next events that can normally occur can be generated. Afterward, it is checked whether the event that actually occurred is included in this Top-K candidate group. If the actual event is not included in the Top-K candidate group, it is detected as an abnormal behavior. In one embodiment, if the model of the access log analysis unit (130) predicted 'login success', 'session update', and 'cache miss' as Top-3 candidates for the next action, but the event that actually occurred is 'privilege escalation', this is not included in the Top-3 and can be judged as an abnormal behavior.

[0111] By using probability-based and Top-K-based judgments together, both cases where the model's confidence is low (low probability) and cases where the prediction itself is completely off (Top-K deviation) can be detected, thereby increasing the precision of detection.

[0112] FIG. 7 illustrates the derivation of a candidate group of abnormal behaviors through probability-based judgment and the confirmation of abnormal behaviors through Top-K judgment, but is not limited thereto. The two methods may be applied separately, and the results of each detection may be comprehensively considered to generate final abnormal behavior information (IAN). In one embodiment, the detection results of the two methods may be combined through logical operations. For example, the detection range may be expanded by determining the final abnormality when an abnormality is detected in the probability-based judgment or the Top-K-based judgment (OR operation), or the detection range may be expanded by determining only the final abnormality when an abnormality is detected in both the probability-based judgment and the Top-K-based judgment (AND operation), thereby reducing false positives and increasing the reliability of detection.

[0113] In one embodiment, the results of the two methods can be combined into a single comprehensive anomaly score through a weighted sum. For example, different weights (w1, w2) can be assigned to the outlier value calculated from the probability-based judgment (e.g., the predicted probability minus 1) and the outlier value calculated from the Top-K-based judgment (e.g., the difference between the actual rank and the K value), respectively, and then summed. If the comprehensive anomaly score exceeds a specific threshold, an Anomaly Information (IAN) identified as an anomaly can be generated. The personal information manager can manage the system to be more sensitive to specific types of anomalies by adjusting the weights according to policy.

[0114] In one embodiment, the results of the two methods may be applied hierarchically or conditionally. For example, as shown in FIG. 7, Top-K based judgment may be performed only on candidate groups extracted by probability-based judgment. Conversely, an efficient multi-stage detection system may be established by first performing Top-K based judgment to rapidly detect obvious abnormal behavior that deviates significantly from the prediction range by a certain value, and then secondarily performing precise probability-based judgment only on behaviors included within the Top-K candidate group to further identify subtle abnormal signs.

[0115] As such, according to the personal information misuse control system (100) according to the embodiment of the present invention, by flexibly combining and utilizing various judgment methods, a scalable architecture can be provided that finds an optimal balance between the accuracy and speed of detection and the characteristics of the operating environment.

[0116] Referring again to FIGS. 1, FIGS. 5 and FIGS. 6, the third operation of the connection log analysis unit (130) is as follows.

[0117] 3. Anomaly Information Generation Step: Anomaly Information (IAN) is generated based on the aforementioned analysis results. Among the Anomaly Information (IAN), the Behavioral Pattern Deviation Value (VPD) is a quantitative figure indicating how much the detected behavior deviates from the normal pattern; it can be calculated based on the previously explained predicted probability (p) or the degree of deviation from the Top-K ranking. Among the Anomaly Information (IAN), the Behavioral Risk Level (LRS) is based on the previously calculated quantitative figure, the Behavioral Pattern Deviation Value (VPD), but it may be a comprehensive risk grade that determines the final level of risk (e.g., high, medium, low) by considering the context and cause of the deviation together. In this case, the risk of misuse is not automatically treated as personal information abuse simply because the Behavioral Pattern Deviation Value (VPD) exceeds a certain value; instead, the risk of misuse can be calculated differentially by additionally analyzing 'why' and 'how' the deviation occurred.

[0118] To this end, the access log analysis unit (130) can calculate the behavioral risk level (LRS) by linking the following analysis results with the behavioral pattern deviation value (VPD).

[0119] (1) Risk assessment associated with unlearned events: If a high behavioral pattern deviation value (VPD) is generated due to an unlearned event, this may be a clear threat signal. For example, if a new system command that was not present in past learning data appears and the behavioral pattern deviation value (VPD) increases rapidly, it may be determined that there is a very high probability of an unknown attack attempt or an insider attempting to gain abnormal privileges. In this case, the risk calculation module (134) of the access log analysis unit (130) can process the behavioral risk level (LRS) as the highest grade, 'severe'.

[0120] (2) Risk assessment associated with unfamiliar context: If individual events are normal but the sequence or combination of events is very unfamiliar, resulting in a high behavioral pattern deviation value (VPD), this may be a precursor to a potential threat. For example, if an operator who usually works in the order of 'inquiry → report generation' suddenly exhibits a behavioral sequence in an unfamiliar context, such as 'bulk deletion → inquiry → external transmission,' this may be a preliminary step for data destruction or leakage. In this case, the risk calculation module (134) of the access log analysis unit (130) may process the behavioral risk level (LRS) as 'caution' or 'warning' and require an immediate review by an administrator.

[0121] (3) Risk assessment linked to model uncertainty: Even if the behavior pattern deviation value (VPD) has not exceeded the threshold, if the model of the access log analysis unit (130) shows high uncertainty in predicting the next action, this may mean that the personal information handler is performing complex tasks that are different from usual and difficult to predict. For example, this could be a situation such as responding to a system failure or preparing for an irregular audit. In such cases, the behavioral risk level (LRS) can be classified as 'concern' and used as a basis for more intensively monitoring the subsequent actions of the personal information handler.

[0122] In one embodiment, risk assessment linked to model uncertainty may be applied to specific target groups with a high risk of information leakage, such as those scheduled for retirement. For handlers classified as scheduled for retirement, a separate dedicated model may be applied, or the threshold value serving as the criterion for detecting anomalies may be adjusted to be more sensitive. For example, even if the difference between the behavior of a personal information handler before being designated as scheduled for retirement and the behavior after retirement is decided is not significant, and the Behavioral Pattern Deviation Value (VPD) is within the threshold, the Behavioral Risk Level (LRS) may be raised to enable immediate warnings or measures.

[0123] Thus, the behavioral risk level (LRS) according to the embodiment of the present invention is calculated by combining a 'quantitative' indicator called the behavioral pattern deviation value (VPD) with the 'qualitative' analysis results that cause it, thereby providing an advanced risk management system that enables more precise judgment of the severity and urgency of threats and differential responses, and effectively responding to threats of insider information leakage that are difficult to predict.

[0124] Referring again to FIG. 1, the connection blocking unit (140) receives abnormal behavior information (IAN) from the connection log analysis unit (130) and can output a connection blocking signal (XBK) for the relevant personal information handler based on this.

[0125] The connection blocking unit (140) may operate according to a pre-set security policy. For example, it may be configured to generate a connection blocking signal (XBK) only when the behavioral risk level (LRS) exceeds a specific threshold. For minor abnormal behavior below the threshold, instead of blocking, it may send a warning notification to the administrator or initiate a procedure requiring the handler to explain the legitimacy of the behavior. The warning notification or explanation procedure will be described later.

[0126] The connection blocking signal (XBK) can be linked with network security equipment such as a firewall or an intrusion prevention system (IPS), or transmitted to a session management module of a user system (10) to perform actual blocking measures such as forcibly terminating the session of the handler or temporarily disabling the account.

[0127] Thus, according to the personal information misuse control system (100) according to the embodiment of the present invention, automated real-time response to detected high-risk abnormal behavior is possible, thereby blocking threats before security incidents such as information leakage become a reality. In addition, by automating security monitoring tasks, the effect of significantly shortening the incident response time can be realized.

[0128] FIGS. 8 and FIGS. 9 are drawings showing a personal information misuse control system (100) according to an embodiment of the present invention.

[0129] First, referring to FIG. 8, the personal information misuse control system (100) according to an embodiment of the present invention may include a connection log generation unit (110), a connection log storage unit (120), a connection log analysis unit (130), and a connection blocking unit (140), in the same way as the personal information misuse control system (100) of FIG. 1. Furthermore, the personal information misuse control system (100) of FIG. 8 may further include an explanation processing unit (150).

[0130] The explanation processing unit (150) can output an explanation request (REX) corresponding to abnormal behavior information (IAN) and receive explanation information (IEX) corresponding to the explanation request (REX) to generate a judgment signal (XDS) regarding whether the explanation information (IEX) complies with the personal information protection policy (STA). In other words, regarding the abnormal behavior information (IAN) detected by the access log analysis unit (130), it can perform the role of having the personal information handler or user system (10) verify the legitimacy of the relevant behavior through the personal information manager and reflecting the result in subsequent measures.

[0131] In one embodiment, when the explanation processing unit (150) receives abnormal behavior information (IAN) where the behavior risk level (LRS) corresponds to a reference value (e.g., 'caution' or 'warning' level), it may output an explanation request (REX) corresponding to the abnormal behavior information. In one embodiment, the explanation request (REX) may be transmitted to a personal information handler or personal information manager in the form of an email, an internal messenger, or a pop-up window of the user system (10), or may be delivered through a dashboard as described below. The explanation request (REX) includes detailed information on the abnormal behavior regarding 'when, where, and what action was taken,' and may be guided to enter a legitimate reason for performing the action.

[0132] The explanation processing unit (150) receives explanation information (IEX) from a personal information handler or personal information manager in response to an explanation request (REX), determines whether the explanation information (IEX) complies with a pre-set personal information protection policy, and can generate a judgment signal (XDS) based on the result of the determination. In one embodiment, the explanation processing unit (150) can generate a judgment signal (XDS) such as 'approval', 'rejection', or 'additional verification required' by considering the content of the explanation, the duties of the personal information handler, and the urgency of the action.

[0133] The determination signal (XDS) may be transmitted to the connection log analysis unit (130) or the connection blocking unit (140). The connection log analysis unit (130) may reset the abnormal behavior information (IAN) in response to the determination signal (XDS). Alternatively, without the analysis operation of the connection log analysis unit (130), the connection blocking unit (140) may output a connection blocking signal (XBK) in response to the determination signal (XDS). For example, if the individual handler does not submit an explanation or the submitted explanation is determined to be 'rejected', the explanation processing unit (150) transmits the corresponding determination signal (XDS) to the connection blocking unit (140), and in response thereto, the connection blocking unit (140) may generate a connection blocking signal (XBK).

[0134] Although the explanation operation described above is described as being processed retrospectively after the occurrence of the relevant act, it is not limited thereto. In one embodiment, the explanation processing unit (150) may receive explanation information (IEX) in advance from a personal information handler, etc., and generate a corresponding judgment signal (XDS).

[0135] In one embodiment, the explanation processing unit (150) may additionally perform an operation for verifying AI anomalies (see verification confirmation in FIG. 7). For example, the explanation processing unit (150) may provide verification information related to the verification of AI anomalies to the personal information manager (administrator). This enables the personal information manager (administrator) to take action based on objective and data-based grounds when determining the validity of the explanation information (IEX) submitted by the personal information handler.

[0136] In one embodiment, the verification information may include an anomaly rate indicating the proportion of anomalies determined to be anomalies among all actions during the period, an auxiliary dependency rate indicating the proportion of other rules, such as Top-K rules, used in addition to the probability threshold, an entropy indicating the uncertainty of the probability distribution of the next event predicted by the AI ​​model, a probability margin indicating how far the predicted probability of an actual event is from the threshold, an Unknown rate indicating the proportion of undefined events within the recent analysis window, and the number of events processed until one anomaly is detected.

[0137] In one embodiment, regarding employees scheduled for retirement or subject to personnel changes, comparative indicators for behavioral data during the period before and after the personnel change may be included as examples. The comparative indicators may include changes in access frequency, changes in the sensitivity of the accessed data, the rate of access outside business hours, changes in bulk viewing or download patterns, the rate of occurrence of external storage media or external transmission events, whether the actual access range is expanded compared to the access authority range, trends in the increase or decrease of behavioral pattern deviation values, temporal changes in risk scores, and corresponding threshold information.

[0138] In this way, by the explanation processing unit (150) providing detailed grounds for the AI's judgment, it is possible to facilitate the identification of the quantitative and qualitative characteristics of the detected abnormal behavior and ensure transparency and consistency in the processing process, such as the necessity of explanation.

[0139] Thus, the personal information misuse control system (100) according to the embodiment of the present invention can comply with policies or laws regarding personal information protection, and furthermore, by first granting an opportunity for explanation regarding minor abnormal behavior that does not require immediate blocking, it can minimize interference with normal business operations and increase the acceptability of the system.

[0140] Next, referring to FIG. 9, the personal information misuse control system (100) according to an embodiment of the present invention may include a connection log generation unit (110), a connection log storage unit (120), a connection log analysis unit (130), and a connection blocking unit (140), in the same way as the personal information misuse control system (100) of FIG. 1. Furthermore, the personal information misuse control system (100) of FIG. 9 may further include an integrated managing unit (160).

[0141] The integrated management unit (160) can set or update AI learning parameters in the access log analysis unit (130) in response to the privacy protection policy (STA) of the user system (10), and generate an access report (RPT) in the first cycle that includes the status and statistics of the access log (LOG), abnormal behavior information (IAN), and access blocking signal (XBK).

[0142] In one embodiment, the personal information protection policy (STA) may set or change standards for abnormal behavior, and accordingly, the AI ​​learning parameters may be dynamically managed, such as by instructing the AI ​​model of the access log analysis unit (130) to retrain to learn the personal information protection policy (STA) or by adjusting the weight of the behavior risk level (LRS). Accordingly, the personal information misuse control system (100) may provide a service that complies with the personal information protection policy (STA) of the user system (10).

[0143] In one embodiment, the first cycle can be set in various ways depending on the management purpose, such as daily, weekly, or monthly. In one embodiment, the Connection Report (RPT) may include the status and statistics of the overall connection logs, the status of detected abnormal behavior information (IAN) by type and / or risk level, and the occurrence status of connection blocking signals (XBK) for which actual action was taken. Additionally, the status of explanation processing (number of requests, approval and rejection rates, etc.) may also be included and provided. The Connection Report (RPT) may be provided in the form of a visual dashboard or generated in the form of a PDF or Excel file to be utilized as reporting and audit data.

[0144] The personal information misuse control system (100) according to an embodiment of the present invention can provide convenience and efficiency in management by providing an integrated interface to a personal information manager through an integrated managing unit (160), and can provide visibility for continuously measuring and improving the level of information protection.

[0145] FIG. 10 is a drawing showing a personal information misuse control system (100) according to an embodiment of the present invention.

[0146] Referring to FIG. 10, a personal information misuse control system (100) according to an embodiment of the present invention includes a security agent that is installed on a user system accessed by a personal information handler, generates and collects access logs regarding the personal information handler's actions by inserting dynamic code into an application of a business server, and performs access blocking for the personal information handler in response to an access blocking signal when an abnormal sign is detected; a security platform that structures, stores, and manages the access logs generated by the security agent; and a security analyzer that analyzes abnormal signs regarding the personal information handler's actions based on AI learning results of the structured access logs, calculates an action pattern deviation value and an action risk level regarding the personal information handler's actions, and generates the access blocking signal.

[0147] A personal information misuse control system (100) according to an embodiment of the present invention may further include a security manager that provides a dashboard for visualizing and displaying statistical information on at least one of collected access logs, analyzed abnormal signs, and generated access blocking signals, and generates a security report in a first cycle for recording and managing the access rights history of personal information handlers.

[0148] A personal information misuse control system (100) according to an embodiment of the present invention may further include an explanation processing manager (RHM) that, when the behavior pattern deviation value and the behavior risk level are greater than or equal to a second value, transmits an explanation request to a business server and receives explanation information regarding the explanation request to determine whether it complies with the personal information protection policy.

[0149] The user system may include a business system and a business server. The security agent, security platform, and security analyzer may correspond to all or part of the access log generation unit (110), access log storage unit (120), access log analysis unit (130), and access blocking unit (140) of FIG. 1. The appeal processing manager corresponds to the appeal processing unit (150) of FIG. 8, and the security manager may correspond to the integrated managing unit (160) of FIG. 9.

[0150] In one embodiment, unlike the explanation processing unit (150) of FIG. 8 which processes download activities in an integrated manner, the personal information misuse control system (100) of FIG. 10 can manage the reasons for downloading through a separate module rather than an explanation processing manager.

[0151] In one embodiment, when a personal information handler downloads personal information stored in a DB in the form of a file, the user system may be configured to require the personal information handler to pre-enter the reason for the download before performing the download. The reason for the download is transmitted to a personal information misuse control system (100) according to an embodiment of the present invention and can be used to analyze abnormal behavior or determine whether to block access, as described above.

[0152] In one embodiment, when a personal information handler downloads personal information via a URL method or an API call method, a security agent records the corresponding download event, and the reason for the download may be received retrospectively from the personal information handler or the administrator system after the download is performed. The retrospectively received reason for the download may be matched with the download event and used for anomaly analysis, behavioral risk calculation, or policy compliance determination.

[0153] Accordingly, according to an embodiment of the present invention, the timing of inputting the reason for downloading can be configured to be either prior or subsequent, allowing for flexible application to the security policy, operation policy, or relevant legal and regulatory requirements of the user system (10), and improving operational and management efficiency regarding the control of personal information downloads.

[0154] According to the personal information misuse control system (100) and personal information misuse control method (200) according to the embodiment of the present invention described above, by automatically executing access blocking measures simultaneously with or in close proximity to AI-based anomaly detection, preemptive prevention and response can be achieved before threatening behavior leads to actual damage. Furthermore, according to the personal information misuse control system (100) and personal information misuse control method (200) according to the embodiment of the present invention, even for insiders with normal authority, potential threatening behaviors by insiders suspected of misusing authority, such as viewing or downloading information different from a normal profile, can be identified early, and additional system access by the user can be immediately blocked, thereby securing actual control over internal information leakage. Moreover, according to the personal information misuse control system (100) and personal information misuse control method (200) according to the embodiment of the present invention, unnecessary alarms can be reduced through explanation processing, thereby alleviating the operational burden on the administrator, and the entire series of response processes from threat detection to access blocking can be automated and recorded as a clear history. In addition, according to the personal information misuse control system (100) and personal information misuse control method (200) according to an embodiment of the present invention, it is possible to effectively perform personal information protection while minimizing system resources and improving system expansion flexibility.

[0155] The terms “part,” “block,” “logic,” or “module” used in various embodiments of the present invention may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. The “part,” “block,” “logic,” or “module” may be a component formed integrally, or a minimum unit of said component or a part thereof that performs one or more functions. For example, according to one embodiment, the “part,” “block,” “logic,” or “module” may be implemented in the form of an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).

[0156] A program executed in an embodiment of the present invention may be implemented as a hardware component, a software component, and / or a combination of a hardware component and a software component. The program may be executed by any system capable of executing computer-readable instructions.

[0157] Software may include computer programs, code, instructions, or a combination of one or more of these, and may configure a processing unit to operate as desired or command the processing unit independently or collectively. Software may be implemented as a computer program containing instructions stored on computer-readable storage media. Examples of computer-readable storage media include magnetic storage media (e.g., ROM (Read-Only Memory), RAM (Random-Access Memory), floppy disks, hard disks, etc.) and optical reading media (e.g., CD-ROMs, DVDs (Digital Versatile Discs)). Computer-readable storage media may be distributed across networked computer systems, allowing computer-readable code to be stored and executed in a distributed manner. Computer programs may be distributed online (e.g., download or upload) through an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily created on a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0158] According to various embodiments of the present invention, each component (e.g., module or program) of the components described above may include a singular or multiple entities, and some of the multiple entities may be separated and placed in other components. According to various embodiments, one or more of the components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Generally or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the components of the multiple components in the same or similar manner as those performed by the corresponding components among the multiple components prior to integration. According to various embodiments, operations performed by the module, program, or other components may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

[0159] Although representative embodiments of the present invention have been described above, those skilled in the art will understand that various modifications can be made to the above-described embodiments within the scope of the present invention. Explanation of the symbols

[0160] 10: User System 100: Personal Information Misuse Control System 110: Connection Log Generation Section 120: Connection log storage 130: Connection Log Analysis Department 140: Connection blocking section 200: Methods to Control Personal Information Misuse

Claims

Claim 1 A personal information misuse control system comprising: a connection log generation unit that generates a connection log for a personal information handler; a connection log storage unit that structures and records the connection log to include at least one of an action subject field, an action time field, an action location field, and an action type field, and an action object field, for identifying the action of the personal information handler at a first time point; a connection log analysis unit that calculates an action pattern deviation value by analyzing the correlation between at least one of the action subject field, the action time field, the action location field, and the action type field and the action object field at a second time point based on an Artificial Intelligence (AI) learning result for at least one field of the structured connection log, calculates an action risk level by combining a quantitative indicator corresponding to the action pattern deviation value and a qualitative analysis result corresponding to the cause of the calculation of the action pattern deviation value, and outputs abnormal behavior information including the action pattern deviation value and the action risk level; and a connection blocking unit that outputs a connection blocking signal for the personal information handler based on the abnormal behavior information. Claim 2 In claim 1, the access log generating unit generates the access log by inserting dynamic code into an application executed by a personal information handler at the time when a class is loaded according to a specific act of the personal information handler, thereby generating the access log. Claim 3 A personal information misuse control system according to claim 1, wherein the access log storage unit indexes the access log in real time and stores it in a distributed manner across a plurality of storage nodes, and processes search requests for the access log received from the access log analysis unit in parallel. Claim 4 A personal information misuse control system according to claim 1, wherein the access log analysis unit processes the behavior risk level into a pre-set risk level among a plurality of risk levels when the behavior pattern deviation value is greater than or equal to a first value, processes the behavior risk level into a severe level among the plurality of risk levels when the behavior pattern deviation value corresponds to an unlearned event, processes the behavior risk level into a caution or warning level among the plurality of risk levels when the behavior pattern deviation value corresponds to an abnormal order or combination of events, or processes the behavior risk level into a level of interest among the plurality of risk levels even if the behavior pattern deviation value is less than a threshold value but the prediction uncertainty regarding the behavior of the personal information handler is greater than or equal to a pre-set value. Claim 5 A personal information misuse control system according to claim 1, wherein the access log analysis unit processes the behavior risk level into a pre-set risk level among a plurality of risk levels regardless of the result of calculating the behavior pattern deviation value when the handler attribute of the personal information handler included in the behavior subject field and the behavior type included in the behavior type field do not correspond to a pre-set correspondence relationship. Claim 6 A personal information misuse control system according to claim 1, wherein the access log analysis unit comprises: a first vector extractor that quantifies a field of part or all of the structured access log to extract a multidimensional current behavior vector for a personal information handler; a second vector extractor that collects and analyzes the current behavior vector during a first period to extract a reference behavior vector for a personal information handler; and a deviation value calculator that calculates the distance or similarity between the current behavior vector and the reference behavior vector as the behavior pattern deviation value. Claim 7 A personal information misuse control system according to claim 1, wherein the access log analysis unit calculates the behavior pattern deviation value based on at least one of a probability-based judgment that calculates the probability distribution of possible events based on a learned event sequence and compares the predicted probability of an event that actually occurred with a pre-set probability threshold, and a Top-K based judgment that determines whether the event that actually occurred is included in a group of top K candidates (K is a positive integer) with a high probability of occurrence among predicted event candidates, and calculates the behavior risk level based on the context and cause of occurrence of the abnormal behavior corresponding to the behavior pattern deviation value. Claim 8 A personal information misuse control system according to claim 1, further comprising: an explanation processing unit that outputs an explanation request corresponding to the abnormal behavior information, receives explanation information corresponding to the explanation request, and generates a judgment signal indicating whether the explanation information complies with a personal information protection policy. Claim 9 A personal information misuse control system comprising: a security agent installed on a user system accessed by a personal information handler, which generates and collects access logs regarding the personal information handler's actions by inserting dynamic code into an application on a business server, and performs access blocking for the personal information handler in response to an access blocking signal; a security platform that stores and manages the access logs generated by the security agent by structuring them to include at least one of an action subject field, an action time field, an action location field, and an action type field, and an action object field to identify the actions of the personal information handler; and a security analyzer that calculates an action pattern deviation value by analyzing the correlation between at least one of the action subject field, the action time field, the action location field, and the action type field and the action object field based on AI learning results for the structured access logs, calculates an action risk level by combining a quantitative indicator corresponding to the action pattern deviation value and a qualitative analysis result corresponding to the cause of the calculation of the action pattern deviation value, and generates the access blocking signal based on the action pattern deviation value and the action risk level. Claim 10 A method for controlling misuse of personal information, comprising: a step of generating a access log for a personal information handler by means of an access log generation logic; a step of structuring and recording the access log by means of an access log storage logic to include at least one of an action subject field, an action time field, an action location field, and an action type field for identifying the action of the personal information handler, and an action object field; a step of calculating an action pattern deviation value by analyzing the correlation between at least one of the action subject field, the action time field, the action location field, and the action type field and the action object field based on an AI learning result for at least one field of the structured access log by means of an access log analysis logic, calculating an action risk level by combining a quantitative indicator corresponding to the action pattern deviation value and a qualitative analysis result corresponding to the cause of the calculation of the action pattern deviation value, and outputting abnormal behavior information including the action pattern deviation value and the action risk level; and a step of outputting an access blocking signal for the personal information handler based on the abnormal behavior information by means of an access blocking logic.

Images