KR20080029602A - Method and device for preventing the leakage of confidential documents - Google Patents

Abstract

The present invention relates to a method and a device for preventing the leakage of confidential documents, the process of collecting documents from all the supporting monitoring group, and to acquire the knowledge of confidential documents for recognizing whether or not confidential documents for both registered and unregistered documents And monitoring and determining the confidential document based on the confidentiality detection algorithm according to the acquisition of the knowledge of the confidential document, and blocking the determined confidential document. Spreading data (unregistered confidential documents) that could not be monitored can also be monitored and blocked in real time.

Description

METHOD AND APPARATUS FOR PREVENTING CONFIDENTIAL INFORMATION LEAK}

1 is a block diagram showing a system structure for preventing the leakage of confidential documents according to an embodiment of the present invention,

2 is a block diagram showing a structure of a leak prevention apparatus for confidential documents according to an embodiment of the present invention;

3 is a flowchart illustrating a process of acquiring knowledge about confidential data in an apparatus for preventing leakage of confidential documents according to an embodiment of the present invention;

4A and 4B are block diagrams showing application points of an automatic confidentiality determination algorithm in a confidential document leakage prevention apparatus according to an embodiment of the present invention;

5 is a flowchart illustrating a language-based confidential document determination process in the apparatus for preventing the leakage of confidential documents according to an embodiment of the present invention;

6 is a flowchart illustrating a non-language-based confidential document determination process in a confidential document leakage prevention apparatus according to an embodiment of the present invention;

7 is a flowchart illustrating an application process of two confidential document determination algorithms in a confidential document leakage prevention apparatus according to an embodiment of the present invention.

The present invention relates to a system for preventing leakage of confidential documents in a network of a government, a company, and the like, and particularly, a method and apparatus for preventing leakage of confidential documents using machine learning (language based) and finger printing (non-language based) in a confidential document leakage prevention system. It is about.

At present, serious information leakage is feared because personal information of a customer or confidential information of a company is indiscriminately distributed through e-mail, instant messaging service, P2P, etc. intentionally or inadvertently.

In general, among the various types of losses, the economic loss due to the leakage of confidential documents is the largest, and this economic loss is increasing every year.

Recently, industrial espionage cases of information leaks in Korea have been increasing rapidly since 2003. A total of 61 cases were caught from 2003 to December 2005, and the industry estimated loss of about 82.327 trillion won. As the leak pattern is seen in the recent semiconductor technology leakage incidents from the past livelihoods, it is being enlarged by foreign government linkages and enterprise-type incidents. The technique is also mobilizing all means such as buying key personnel, scouting, establishing a camouflage company, and cutting off and hacking.

Conventional techniques for preventing such confidential document leakage focused on static document security methods such as DRM. However, the document security method using the DRM is vulnerable to information leakage of the modified document or the document in operation when viewing the document security operating system. In particular, document security using such DRM requires the user to manually register a confidential document. That is, the conventional technology protects only confidential documents designated by users. However, if the insider wants to leak the information he / she has written or modified, it is difficult to block it in real time. In order to prevent such internal information leakage, a person who does not know the contents of the document should be prevented. In addition, the conventional technology does not respond to the DRM method even when the insider directly inputs or partially copies the contents of the confidential document in a new document file without directly copying or printing the confidential document file even for the registered document. impossible.

In addition, in the conventional system for preventing the leakage of confidential documents, it is impossible to automatically determine confidential documents, thereby making the data input / output itself impossible or monitoring only by keyword comparison, thereby restricting the use of computers unconditionally.

Accordingly, an object of the present invention is to provide a method and apparatus for preventing leakage of confidential documents by automatically determining whether a confidential document is not registered by a user and blocking the confidential document.

Another object of the present invention is a method and apparatus for preventing leakage of confidential documents for blocking in real time by automatically monitoring and confidential leak determination of all data at all possible leak points according to the state of data using linguistic and non-verbal methods. In providing.

The method for preventing the leakage of confidential documents for achieving the object of the present invention, the process of collecting documents from all the monitoring unit to support, whether the registered document and the non-registered documents in both of the collected confidential documents whether Acquiring confidential document knowledge for recognition, monitoring and determining the confidential document based on the corresponding secret detection algorithm according to the acquisition of the confidential document knowledge, and blocking the determined confidential document. It features.

Confidential document leakage prevention device for achieving the object of the present invention, the document collection unit for collecting documents from all the monitoring unit to support, whether the document is a confidential document for both registered and unregistered documents among the collected confidential documents; A control unit for acquiring a confidential document knowledge for recognizing a secret document, and determining whether the confidential document is based on the secret detection algorithm according to the acquisition of the secret document knowledge; And a storage unit for monitoring and blocking the confidential document determined by the control unit, and a storage unit for storing information about the information and the model generated according to the acquired confidential document knowledge and the confidential document knowledge. It features.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals have the same reference numerals as much as possible even if displayed on different drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In the embodiment of the present invention, all data leaked from the network and the input / output (I / O) of the desktop using a linguistic method (machine learning) and non-verbal method (finger print) to detect the leakage of confidential documents. Automatically monitor and block in real time if it is determined to be a confidential leak.

The machine learning method based on the language information is based on taxonomy defined in biology. For example, if a pharmaceutical company's confidential document needs to be determined, the confidential document is likely to contain words related to pharmaceuticals. As such, the document may be classified by field based on the words including the words representing the respective fields. Based on this, we can expect a fairly high level of decision rate when machine learning the classification of pharmaceutical documents and those that do not. To date, linguistic taxonomy is not a classification of documents in all fields, but a detection rate that is practical for the classification of documents in a specific field.

Non-verbal methods, on the other hand, employ hash theory used in cryptography through code-based algorithms to collect unique documents and generate unique keys for each document. The keys generated are unique to each confidential document and can be compared to a person's fingerprint or DNA. Such a key concept is generally applied in encryption, and since only one key is generated for the original text, only one document can be identified. However, in the embodiment of the present invention, the generated key is modified according to the similarity of the document. In your case, make sure that the same key is generated. That is, the deformation of the confidential document can be detected. In the case of such a code-based algorithm, since the code at the binary file level is used as the key information rather than the language information, once the system is built, the security system can be built independently of the language.

Next, a structure of a confidential document leakage prevention system according to an embodiment of the present invention for preventing leakage by monitoring and blocking the leakage of confidential documents using the language-based and code-based algorithm will be described with reference to the accompanying drawings. .

1 is a block diagram showing a system structure for preventing the leakage of confidential documents according to an embodiment of the present invention.

Referring to FIG. 1, the information leakage prevention system is largely based on language-based (machine learning) and non-verbal code-based (finger print) confidential recognition technology, and includes a plurality of PCs 101a to 101n in a network. And a confidential document leakage prevention apparatus 110 for interlocking and monitoring confidential documents of each of the PCs 101a to 101n and blocking leaked confidential documents. The confidential document leakage prevention apparatus will be described in detail with reference to FIG. 2.

The confidential document leakage prevention apparatus includes a transmission / reception unit 111, a monitoring and blocking unit 112, a control unit 113, a storage unit 114, and an information collecting unit 115.

The transmission / reception unit 111 transmits / receives all information related to the prevention of confidential leakage such as confidential documents, network transmission information, and input / output (I / O) information of each of the PCs 101a to 101n.

The monitoring and blocking unit 112 monitors in real time the documents input / output to all the I / O terminals of the network, for example, all the PCs 101a to 101n, and checks the documents determined as confidential documents. Block confidential documents for

The controller 113 checks the information of the documents received through the transmitter / receiver 111 to determine whether it is a confidential document, and uses knowledge for recognizing whether it is a confidential document using language-based and non-language-based algorithms. Acquire and generate related models. In this case, the control unit 113 determines not only the documents that are 100% matched through the eigenfunctions but also the changed documents such as partial deletion and position correction when determining by using a non-language-based algorithm.

The storage unit 114 manages the information of the documents manually registered and received, and stores the acquired knowledge and the related model generated for the confidential document. In addition, the storage unit 114 stores information on dictionary and confidential document fingerprints in the corresponding field.

The information collecting unit 115 collects information of newly generated files in each of the PCs 101a to 101n and transmits the collected information to the control unit 113.

In the confidential document leakage prevention apparatus having such a structure, a method for preventing the leakage of the confidential document through acquiring knowledge of the confidential data and determining the confidential document will be described in detail.

In order to prevent the leakage of confidential documents, the confidential document leakage prevention device must first generate the confidential document knowledge. The creation of the confidential document knowledge means the acquisition of knowledge that can recognize the confidential document for both structured and unstructured data. do. This process of acquiring knowledge of confidential documents will be described with reference to the accompanying drawings.

3 is a flowchart illustrating a process of acquiring knowledge about confidential data in the apparatus for preventing the leakage of confidential documents according to an embodiment of the present invention.

Referring to FIG. 3, in step 201, the confidential document leakage prevention apparatus collects documents from all PCs 101a through 101n in the enterprise network through the information collecting unit 115. Thereafter, in step 202, the confidential document leakage prevention apparatus classifies the collected documents according to document types (doc, pdf, hwp, etc.), and converts the classified files into ASCII codes (ex.doc-> txt) in step 203. . Then, in step 204, the data of the converted file is classified by field using document classification technology.

In operation 205, the apparatus for preventing the leakage of confidential documents checks whether the documents classified by the field are confidential documents, and proceeds to step 206 when the classified documents are confidential documents, and ends the operation.

Thereafter, the confidential document leakage prevention device generates and updates the models determined as the confidential document in a language-based or non-language-based manner, that is, using a language-based or non-language-based confidential detection algorithm. Therefore, in step 206, when the confidential document is a new confidential document and uses a language-based confidential detection algorithm, the confidential document extraction apparatus extracts a new word from the documents classified as the confidential document in step 207, and in step 208, After creating and updating the learning model, proceed to step 213.

On the other hand, if the language-based detection algorithm is not used in step 206, the confidential document leakage prevention device determines whether to use a non-language (code) -based confidential detection algorithm in step 209 to use a non-language-based detection algorithm In step 210 it is determined whether the registered confidential document. If the previously registered confidential document, the operation is terminated as it is, and if the previously unregistered confidential document, the fingerprint of the new confidential document is generated in step 211, and the fingerprint generated in step 212 is applied to the fingerprint printer model. In addition, the fingerprint model is updated.

Then, in step 213, the confidential document leakage prevention device periodically distributes the learning model and the fingerprint model to each monitoring group.

In the step 204 of the knowledge acquisition process, the data classification for each field may be, for example, as shown in Tables 1 to 3 below.

How to classify your data Explanation Structured data Files whose file organization is standardized, such as database files Unstructured data Files whose configuration is not qualified, such as normal document files Managed data File collected and managed on designated file server inside corporate network Interspersed data Unmanaged files scattered on each user's PC

As shown in Table 1, the data classification may be classified into structured data, unstructured data, managed data, and interspersed data. Herein, the structured data represents a file whose file structure is standardized, such as a database file, and the unstructured data represents a file whose structure is not standardized, such as a general document file. The managed data represents files collected and managed in a designated file server in an enterprise network, and the interspersed data represents unmanaged files scattered in each user PC.

File example Structured data Unstructured data Managed data 1) Company DB Data 2) Various documents of file server. Interspersed data 3) Personal DB Data 4) Documents of each PC

Security Difficulty (Legacy System) Structured data Unstructured data Managed data Most secure Existing DRM-based Security System Interspersed data Existing system security not supported Existing system security not supported

As shown in Table 2, the first managed data and structured data refers to enterprise DB data, and the second managed data and unstructured data refers to various documents of a file server. Third, the interspersed and structured data refers to personal DB data, and fourth, the interspersed and unstructured data refers to various documents of each PC. In this case, referring to <Table 3>, the security difficulty of the existing system is described. In the first case, the security is most easily possible. In the second case, the security is possible using the existing DRM-based security system. In the second case, security is not possible with the existing system.

On the other hand, the state of the data can be largely divided into data at rest, data in use, data in motion. This data in storage can be classified into managed data, and the remaining data in use and data in motion can be classified into interspersed data. Therefore, in the case of the existing DRM, it is possible to block the leakage of confidential documents, but the data in use and moving data cannot be blocked.

Therefore, it is necessary to monitor the leakage of confidential documents by monitoring not only the structured data but also the unstructured data, that is, the unregistered data. Therefore, the following describes a process of blocking leakage by determining whether to monitor and confidentially even the unregistered data according to an embodiment of the present invention. In addition, since the knowledge acquisition method described above also depends on language-based and non-language-based methods, confidential information detection methods will also be described using language-based confidential information detection algorithms and non-language-based confidential document detection algorithms.

In order to block the data in use, a complete host monitoring agent technology must be supported. This is because most of the information leakage is made by USB copy, CD copy, printing, etc. In the embodiment of the present invention, the operating system stage intercepts the USB, CD, print request, etc. and monitors the confidential document. In this case, the leaked file may be not only a registered confidential document but also a part or a modification of the document, and according to the exemplary embodiment of the present invention, whether the file is registered or not is determined as a confidential document. For this purpose, the location of all the monitoring units supported by the monitoring and blocking unit 112 in the confidential document leakage prevention apparatus will be described with reference to FIG. 4 (b).

The monitoring and blocking unit 112 installs a security agent on all PCs inside the enterprise in step 321, and monitors data leakage and inflow in all PCs in step 322. In more detail, as in steps 323 to 325, the CD storage process monitoring, the USB storage process monitoring, and the file storage process monitoring are performed. Then, through the monitoring result, the monitoring and blocking unit 112 blocks and records the session when determining the confidential document in step 326.

 Meanwhile, in order to block the moving data, a real time packet capturing technology and a high performance gateway type product may be provided. If a confidential document is leaked to the outside through a network such as email, web traffic, FTP, P2P, etc. in order to detect and block in real time, install a gateway at the ingress / egress stage of the corporate network, It is possible to determine whether or not the confidentiality of the file, and also to determine whether or not confidential files. For this purpose, the location of all the monitoring units supported by the monitoring and blocking unit 112 in the confidential document leakage prevention apparatus will be described with reference to FIG. 4 (a).

The monitoring and blocking unit 112 installs a gateway at an ingress / egress point in step 321. Accordingly, in step 312, data leakage of all network ends is monitored. In steps 313 to 315, the monitoring and blocking unit 112 analyzes data of all traffic up to Layer 7, analyzes various application traffic such as HTTP, FTP, and messenger, and analyzes attachments of email. Based on the analysis result, in step 316, the monitoring and blocking unit 112 performs blocking and recording of the corresponding session when determining a confidential document.

Then, the confidential document determination process according to the monitoring and analysis will be described with reference to the accompanying drawings by dividing into a language-based and a non-language-based manner.

5 is a flowchart illustrating a process of determining a language-based confidential document in the apparatus for preventing the leakage of confidential documents according to an embodiment of the present invention, and FIG. 6 is a non-language-based classified document determination in the apparatus for preventing the leakage of confidential documents according to an embodiment of the present invention. It is a flow chart showing the process.

First, the language-based method uses the principle of taxonomy to grasp the context of a document through a combination of words representative of each field, and to determine the field described by the document.

Referring to FIG. 5, in order to detect a confidential document based on the language, the apparatus for preventing the leakage of a confidential document collects an example of a confidential document of the corresponding company at the beginning of the system introduction in step 410. In addition, the confidential document leakage prevention device also collects non-confidential documents.

Then, in step 420, the confidential document leakage prevention device analyzes the collected documents to build a statistical dictionary, and in step 430, a word list is constructed of words frequently appearing in the confidential documents. In other words, it creates a unique dictionary in the field. For example, a pharmaceutical company may contain many disease names or pharmaceutical-related chemical names in a document, so the leak prevention device removes all the daily words contained in the general document. Then build a dictionary by selecting words that are used a lot in the company.

Thereafter, in step 440, the apparatus for preventing leakage of confidential documents generates a probability model (for example, TFIDF) capable of determining whether the confidential document is a confidential document based on the degree of the word included in the document using a machine learning algorithm. Then, in operation 450, the apparatus for preventing leakage of confidential documents determines whether a document to be transmitted is a confidential document when document transmission is detected at various I / O stages using the generated probability model. This probability model can be updated at the request of the user. For example, if a new product is developed and a lot of new terms are added, a new example document may be collected to update the dictionary, and a new machine learning process may be performed to update the probability model.

Next, the non-language-based scheme learns confidential documents in advance to secure fingerprints of confidential documents. These fingerprints are not based on language information, but based on binary code, and can recognize the same document regardless of the type of document such as adding, deleting, or repositioning a part of the content.

Referring to FIG. 6, in operation 510, the apparatus for preventing the leakage of confidential documents collects confidential documents. Afterwards, the confidential document leakage prevention device should periodically perform hash key registration on the confidential document managed for non-verbal based secret document detection. Therefore, in operation 520, the apparatus for preventing leakage of confidential documents inputs a confidential document into a hash function, and returns a hash key corresponding to the confidential document in operation 530.

Then, in step 540, the apparatus for preventing the leakage of confidential documents generates a set file that collects hash keys of confidential documents, that is, a hash list, and periodically distributes them to each inspection unit. Check it.

Therefore, in this non-language-based approach, the confidential document leakage prevention device uses the fingerprint function (hash function) to recognize the same document only when it is 100% identical to the original document. You can recognize if it exists. For example, it is possible to detect whether a part of a document is deleted or if two parts of a document are changed in position, even if they are variations of the same document.

Next, a process in the case of using the above-described language-based method and a non-language-based method will be described with reference to the drawings.

7 is a flowchart illustrating an application process of two confidential document determination algorithms in the apparatus for preventing the leakage of confidential documents according to an embodiment of the present invention.

Referring to FIG. 7, in operation 601, the apparatus for preventing the leakage of confidential documents checks whether a confidential document file is performed in step 602 after performing a non-verbal based inspection as described in FIG. 6. As a result of the check, in the case of the confidential document file, the confidential document leakage prevention device blocks the operation in step 603, stores log information on the user's confidential document leakage behavior, and proceeds to step 607.

On the other hand, if the non-language-based confidential document file, in step 604, the confidential document leakage prevention device performs a language-based inspection, as described above in Figure 5 to determine whether the confidential document file in step 605. As a result of the check, if the file is not a confidential document, the process proceeds back to step 601 to maintain the standby state. On the other hand, in the case of a language-based confidential document file, in step 606, the confidential information leakage prevention device blocks a job and stores log information on the user's confidential document leakage behavior.

Then, in step 607, the confidential document leakage prevention apparatus transmits the newly detected confidential document file to the security server, and in step 608, the established dictionary and decision model are updated.

As such, the two language-based and non-language-based confidential detection algorithms can be used or mixed depending on the situation of the inspection team. For example, as in the first and second cases of <Table 2>, if the monitoring group is installed on the file server of the corporate internal network, only the non-language-based algorithm is applied because the stored files are all registered confidential documents. As in the case of general PC inspection team, there are scattered confidential documents, so both algorithms should be applied.

As described above, as the confidential document is monitored using two language-based and non-language-based confidential detection algorithms, the apparatus for preventing the leakage of the confidential document may recognize or determine the leakage of the confidential document. In order to recognize the confidential document leakage, the confidential document leakage prevention device performs inspection on a monitoring target in real time based on the knowledge obtained through the process of acquiring the confidential document knowledge as described above.

Therefore, such confidential document leakage monitoring can be performed in real time with minimal impact on the user's computing environment, and in the case of network traffic monitoring, it can show a constant performance regardless of the change in traffic volume.

In addition, in the embodiment of the present invention, it is possible to construct a policy-based security system that can achieve synergistic effects by organically combining the processes described in FIG. 5 to FIG. Furthermore, in the embodiment of the present invention, since a confidential document can be identified regardless of a language using a non-language-based detection algorithm, it is possible to construct a system using another language.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

As described above, the present invention enables the construction of a selective monitoring system for confirming the data content by applying language-based and non-language-based detection algorithms, and scattered data (unregistered confidential documents) that were not previously monitored. It has the effect of monitoring and blocking in real time.

In addition, the present invention can be used as a user without any inconvenience, without any post-tracking through the log file after unconditional prohibition measures or security incidents without any inconvenience, the security administrator can monitor and track in real time It has the effect of establishing a system.

Claims (20)

The process of collecting documents from all supporting watchdogs, Acquiring a confidential document knowledge for recognizing a confidential document for both registered and unregistered documents among the collected confidential documents; Monitoring and determining a confidential document based on the confidentiality detection algorithm according to the acquisition of the confidential document knowledge; Method of preventing the leakage of confidential documents comprising the step of blocking the determined confidential document. The method of claim 1, wherein the monitoring and determining of the confidential document comprises: If all files stored in the monitoring target according to the acquisition of the confidential document knowledge is a registered document, a confidential document leakage prevention method characterized in that for monitoring and determining the confidential document using a non-language-based secret detection algorithm. The method of claim 1, wherein the monitoring and determining of the confidential document comprises: If the file stored in the monitoring target according to the acquisition of the confidential document knowledge is a document that is not registered, the confidential document leakage prevention method characterized in that for monitoring and determining the confidential document using a language-based and non-language-based secret detection algorithm. The method of claim 1, wherein the process of acquiring knowledge of the confidential document comprises: Classifying the collected documents by type; Transcoding the classified file; Classifying the data of the converted file by field; Generating and updating a model based on the field-classified data based on language or non-language; And distributing the generated model to each of the inspection units periodically. The method of claim 4, wherein the generating of the model based on the language comprises: Collecting example documents of any inspection object; Constructing a statistical dictionary for the field described in the collected documents; Generating a word list by selecting words frequently used in the corresponding field using the statistical dictionary from the collected documents; And generating a learning model according to a probability that the selected word is included in the word list. The method of claim 4, wherein generating the non-verbal based model comprises: Collecting stored confidential documents; Inputting the collected confidential documents into a hash function, respectively; Performing hash key registration by returning hash keys corresponding to the confidential documents; Generating a hash list by collecting hash keys of the confidential documents; And generating a fingerprint model through the generated hash list. The method of claim 2, wherein the monitoring and determining of the confidential document comprises: In the case of using the non-language-based confidential detection algorithm, if the model generated according to the knowledge of the confidential document is distributed to each monitoring step, monitoring the documents leaked to each monitoring step; And determining whether the leaked document is a confidential document by using the generated hash list of the model. The method of claim 3, wherein the monitoring and determining of the confidential document comprises: In the case of using the language-based confidentiality detection algorithm, if the model generated according to the knowledge of the confidential document is distributed to each monitoring step, monitoring the documents leaked to each monitoring step; And determining whether the leaked document is a confidential document by using the generated hash list of the model. The method of claim 1, wherein the monitoring of the confidential document comprises If the monitoring unit is a network monitoring unit, confidential network leakage prevention method characterized in that the monitoring through the data analysis, application traffic analysis and email attachment analysis of all traffic up to layer 7 in all network monitoring. The method of claim 1, wherein the monitoring of the confidential document comprises: When the monitoring unit is a desktop (PC) monitoring unit, the leakage of confidential documents, characterized in that to monitor the data flow in and out of all PC, CD (CD) storage process, USB storage process, file storage process. A document collection unit that collects documents from all supporting monitors; Acquire confidential document knowledge for recognizing the confidential document for both registered and unregistered documents among the collected confidential documents, and whether the confidential document is based on the corresponding confidentiality detection algorithm according to the acquisition of the confidential document knowledge. A control unit to determine, A monitoring and blocking unit for monitoring the leakage of documents by all the monitoring units according to the acquisition of the confidential document knowledge, and blocking the confidential documents determined by the control unit; And a storage unit for storing the information, the acquired confidential document knowledge, and the information about the model generated according to the acquisition of the confidential document knowledge. The method of claim 11, And the controller determines whether a confidential document is determined using a non-language-based confidentiality detection algorithm when all files stored in the monitoring target according to the knowledge of the confidential document are registered. The method of claim 11, And the controller determines whether a confidential document is classified using a language-based or non-language-based confidentiality detection algorithm when the file stored in the monitoring target according to the knowledge of the confidential document is not registered. The method of claim 11, The controller receives the documents collected by the collection unit, classifies the data by type, classifies the data of the converted file by code conversion of the classified file, and classifies the data classified by the field based on language or non-language. A device for preventing the leakage of confidential documents, characterized in that to generate and update the model according to the distribution periodically to each of the inspection stage. The method of claim 14, When the controller generates the model based on the language, the controller constructs a statistical dictionary of the corresponding field described in the example documents of the inspection target collected through the document collecting unit, and uses the statistical dictionary to build the statistical dictionary. And generating a word list by selecting frequently used words from the generated word list, and generating a learning model according to a probability that the selected word is included in the generated word list. The method of claim 14, When generating the non-verbal based model, the controller inputs the confidential documents collected by the document collecting unit to a hash function, registers the hash keys by returning hash keys corresponding to the confidential documents, And a fingerprint print model having a hash list constructed by collecting hash keys of the confidential documents. The method of claim 11, The monitoring and blocking unit, when the monitoring unit is a network monitoring unit, the confidential document leakage prevention device, characterized in that for monitoring through the data analysis, application traffic analysis and email attachment analysis of all traffic up to layer 7 in all network monitoring. The method of claim 17, When the monitoring unit is the network monitoring unit, all the network entry and exit points of the security terminal characterized in that it comprises a gateway. The method of claim 11, When the monitoring unit is a desktop (PC) monitoring unit, the monitoring and blocking unit monitors data flow in and out of all PCs, and monitors a CD storage process, a USB storage process, and a file storage process. Document leakage prevention device. The method of claim 19, When the monitoring unit is the desktop monitoring unit, all the desktop (PC) has a security document leakage prevention device, characterized in that it comprises a security agent.

Images