• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.21 no.12
• /
• pp.2333-2340
• /
• 2017

Recently industry is suffering severe losses of important internal information, and most of the leaks result from the insiders. Thus, various technological counter measures are being studied in order to protect private organization information. In this paper, among various internal information leakage path protection mechanisms, we propose a technique for preventing files which are defined as confidential from being copied or moved through USB. The implemented confidential file loss prevention system is composed of both signature insert manager and confidential file detect manager. The signature insert manager allows a system administrator to insert a special pattern specifying a classified confidential file, while the confidential file detect manager protects confidential file leakage when a user attempts to move or copy a confidential file to the USB memory. This results would be contributed to reducing the damage caused by leakage of confidential files outside of the company via USB.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.4
• /
• pp.51-60
• /
• 2005

The riles or intellectual property on computer systems have increasingly been exposed to such threats that they can be flowed out by internal users or outer attacks through the network. The File Outflow Monitoring System monitors file outflows at server by making the toe when users copy files on client computers into storage devices or print them, The monitoring system filters I/O Request packet by I/O Manager in kernel level if files are flowed out by copying, while it uses Win32 API hooking if printed. As a result, it has exactly made the log and monitored file outflows, which is proved through testing in Windows 2000 and XP.

• KIISE Transactions on Computing Practices
• /
• v.20 no.12
• /
• pp.632-639
• /
• 2014

In this paper, we propose a PC's self-monitoring system for protecting illegal outflow of important personal files, which are managed in the Windows environment PC. This paper is based on the idea that it should be a read (access) file operation in order to outflow files through the network. To compare the information (name, some content) obtained from all operations of the reading of the 'Windows File System Driver' and captured transmission packets of mini port of 'Windows NDIS (Network Driver Interface Specification) Driver', and, if two pieces of information match, this system will determine the transmission to user. In this paper, tentatively, we developed a function to gather file information about file read operation and developed a function for transmission packet capture. This demonstration implementation showed that the proposed process has validity and the proposed process verified that it does not significantly affect the PC's performance.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.10a
• /
• pp.556-558
• /
• 2017

Recently internal confidential file leakage of industry is substantially increasing, which results in serious damage to enterprises. Most of these outbreaks are caused by internal employees. In this paper, we proposed and implemented a signature insertion scheme for defining confidential file in order to detect the outflow of internal confidential files with various file formats.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.22 no.11
• /
• pp.1544-1553
• /
• 2018

Recently internal information leakage in industries is severely increasing in spite of industry security policy. Thus, it is essential to prepare an information leakage prevention measure by industries. Most of the leaks result from the insiders, not from external attacks. In this paper, a real-time internal information leakage prevention system via both storage and network is implemented in order to protect confidential file leakage. In addition, a Hadoop-based user behavior analysis and statistics system is designed and implemented for storing and analyzing information log data in industries. The proposed system stores a large volume of data in HDFS and improves data processing capability using RHive, consequently helps the administrator recognize and prepare the confidential file leak trials. The implemented audit system would be contributed to reducing the damage caused by leakage of confidential files inside of the industries via both portable data media and networks.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2003.11a
• /
• pp.52-55
• /
• 2003

정보시스템의 활용도가 높아지면서 네트워크를 통해 보다 빠르게 상호간 정보체계를 공유하게 됨으로써 컴퓨터 통신망을 통해 내부정보의 위조 또는 변조, 유출되는 등 각종 불법 행위가 급증하고 있다. 이에 본 논문에서는 내부 정보보안 사고에 대한 적극적인 보안수단을 제공하기 위해 내부사용자에 의한 파일유출을 감시하고 중요파일에 대한 접근시도 및 .접근동작에 대해 로그정보를 분석하여 보안사고 발생시 입증할 수 있는 근거를 제시하고자 파일 감사시스템을 설계하고 구현하였다.

• Convergence Security Journal
• /
• v.6 no.2
• /
• pp.1-11
• /
• 2006

The files of intellectual property on computer systems have increasingly been exposed to such threats that they can be flowed out by internal users or outer attacks through the network. The File Outflow Protection System detects file outflow when users not only copy files on client computers into storage devices, but also print them. This Protection system has been designed to Win32 API hooking by I/O Manager in kernel level if files are flowed out by copying. As a result, the monitoring system has exactly detected file outflows, which is proved through testing.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.10a
• /
• pp.217-219
• /
• 2021

With the development of ICT, the amount of data increases, and the technology of storing and processing becomes important. In this study, we study real-time file copy leakage prevention system to prevent leakage of important data in enterprises, public places, etc. As a research method, we propose a system that detects events in real time to prevent data leakage after analyzing data leakage cases and problems. The file leakage prevention system compares and analyzes with the existing EDLP system, and the proposed system reduces load and detects events. Future research requires research on the prevention of leaks through networks and various channels.

• Journal of Korea Society of Industrial Information Systems
• /
• v.16 no.2
• /
• pp.59-64
• /
• 2011

A lot of computer users use external memory device. But, same time file efflux incidents are also increasing. There are two ways people use for efflux file. One is moving it after checking file which is running on computer and the other is checking file name only. Checking from running file case, we can identify vestige with running information of applied program but, the case of moving as external device without running file there is no evidence running applied program. So there are a lot of difficulty with forensic investigation. In this paper we suggest the way to help forensic investigation which is method of getting external memory device information of volume and time through its awareness method and connection information and moving to external device without running file after compare the external memory device volume information through link file analysis and getting information of link file formation & access time from link file.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2023.07a
• /
• pp.217-218
• /
• 2023

내부자 위협이란, 조직의 보안 및 데이터, 시스템에 대한 내부 정보에 접근하는 현 임직원 및 전 임직원, 계약자와 같이, 동일한 조직 내부의 사람들로부터 발생하는 위협을 의미한다. 일반적으로 내부자들은 업무를 위하여, 시스템에 대한 합법적인 접근 권한을 가지며, 만약 이러한 권한이 오남용되는 경우에는 조직에 매우 심각한 피해를 입힐 수 있다. 이러한 내부자 위협은 외부로부터의 위협보다 방어 및 탐지가 훨씬 어려운 한계점이 있으며, 그 피해 규모가 매우 방대하다는 문제점도 존재한다. 이에 따라, 본 논문에서는 내부자 위협을 탐지하기 위하여, 이메일을 통한 기밀정보를 유출하는 유형의 위협에 대응하는 방안을 제안한다. 제안하는 방안은 조직 내에서 이메일을 발신하는 경우를 대상으로, 파일이 포함된 이메일에 발신자를 식별하기 위하여, 파일에 키 값 및 서명을 삽입하며, 발신되는 이메일을 모니터링하여 첨부된 파일의 유형을 파악함으로써, 동적 그래프를 통하여 시각화한다. 내부 시스템 및 네트워크에서의 보안관제 담당자 및 관리자는 시각화된 그래프를 확인함으로써, 직관적으로 정보 유출을 파악하고 대응할 수 있을 것으로 판단된다. 본 논문에서 제안하는 방안을 통하여, 조직 내의 내부자 위협을 탐지할 수 있으며, 데이터 유출 사고가 발생하는 경우, 유출자를 빠르게 식별하고 초기에 대응할 수 있을 것으로 판단된다.