KR102440180B1 - Method and apparatus for determining whether to expose personal information using cdm packets - Google Patents

Abstract

The present disclosure relates to a method for determining whether to expose personal information and an electronic device for performing the same. According to an embodiment, a method for an electronic device to determine whether to expose personal information includes: transmitting a query to a server connected to the electronic device; obtaining a packet transmitted from the server in response to the transmitted query as a query result for the query; and identifying whether personal information about a user of the electronic device in the packet is exposed by inputting the obtained packet into a neural network model; may include.

Description

Method and device for determining whether personal information is exposed using CDM packets

The present disclosure relates to a method and apparatus for determining whether to disclose personal information. More particularly, it relates to a method and apparatus for determining whether to expose personal information using a packet in a CMD query result.

When analyzing personal information exposure, the most important thing is to check the presence or absence of personal information in the document. Although regular expressions have been widely used as one of the existing methods for determining personal information, there is a limitation in that polymorphism of personal information cannot be determined.

For example, in order to express an address in Korea as a regular expression, a regular expression such as Equation 1 below may be required.

However, the regular expression shown in Equation 1 above has a limitation in that it cannot determine an address other than a real address as an address, or an address that is a real address but has a slightly different shape. As in the above example, since personal information also has various forms, there is a limit to classifying personal information with a regular expression.

Accordingly, there is a demand for technology development capable of identifying various types of personal information and detecting whether or not personal information has been exposed.

Korean Patent No. 2101456

According to an embodiment, a method for determining whether to expose personal information and an electronic device for performing the same may be provided.

According to an embodiment, a method for determining whether to expose personal information using a neural network model and an electronic device for performing the same may be provided.

According to an embodiment of the present disclosure for achieving the above-described technical problem, a method for an electronic device to determine whether to expose personal information includes: transmitting a query to a server connected to the electronic device; obtaining a packet transmitted from the server in response to the transmitted query as a query result for the query; and identifying whether personal information about a user of the electronic device in the packet is exposed by inputting the obtained packet into a neural network model; may include.

According to another embodiment for achieving the above-described technical problem, an electronic device for determining whether to expose personal information includes: a network interface; display; a memory storing one or more instructions; and at least one processor executing the one or more instructions. including, wherein the at least one processor transmits a query to a server connected to the electronic device by executing the one or more instructions, and as a query result for the query, is transmitted from the server in response to the transmitted query An electronic device may be provided that acquires a packet and identifies whether personal information about a user of the electronic device in the packet is exposed by inputting the acquired packet into a neural network model.

In addition, according to another embodiment of the present invention for achieving the above-described technical problem, there is provided a method for determining whether to expose personal information by an electronic device, the method comprising: transmitting a query to a server connected to the electronic device; obtaining a packet transmitted from the server in response to the transmitted query as a query result for the query; and identifying whether personal information about a user of the electronic device in the packet is exposed by inputting the obtained packet into a neural network model; A computer-readable recording medium in which a program for performing the method is stored, including, may be provided.

1 is a diagram schematically illustrating a process in which an electronic device inspects personal information exposure according to an exemplary embodiment.
2 is a flowchart of a method for an electronic device to determine personal information exposure, according to an embodiment.
3 is a flowchart of a method for an electronic device to obtain a packet from a server according to an embodiment.
4 is a diagram for describing a process in which an electronic device learns a query using a neural network model, according to an embodiment.
5 is a block diagram of an electronic device according to an embodiment.

Terms used in this specification will be briefly described, and the present disclosure will be described in detail.

The terms used in the present disclosure have been selected as currently widely used general terms as possible while considering the functions in the present disclosure, but these may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, and the like. In addition, in a specific case, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the corresponding invention. Therefore, the terms used in the present disclosure should be defined based on the meaning of the term and the contents of the present disclosure, rather than the simple name of the term.

In the entire specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, terms such as "...unit" and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software. .

Hereinafter, with reference to the accompanying drawings, the embodiments of the present disclosure will be described in detail so that those of ordinary skill in the art to which the present disclosure pertains can easily implement them. However, the present disclosure may be implemented in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present disclosure in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

1 is a diagram schematically illustrating a process in which an electronic device inspects personal information exposure according to an exemplary embodiment.

According to an embodiment, the personal information detection system 100 may include the electronic device 1000 and the server 2000 . According to an embodiment, the personal information detection system 100 analyzes packets transmitted/received between the electronic device 1000 and the server 2000 to determine whether the user's personal information is exposed or the overall security of the server. danger can be detected.

According to an embodiment, the electronic device 1000 may transmit the CDM query 162 to the server 2000 and obtain the CDM query result 164 in response to the transmitted query 162 . According to an embodiment, the Common Data Model (CDM) may refer to a data structure standardized to facilitate use of data having different structures as a common data model. According to an embodiment, a query managed by at least one of the electronic device 1000 or the server 2000 and data related to a query result may be managed in a common data model structure.

According to an embodiment, the electronic device 1000 may determine whether personal information in the packet is exposed by analyzing the packet obtained from the server 2000 . According to an embodiment, the electronic device 1000 may analyze a packet using ALTO (WIRE SHARK), which is a representative open source of packet analysis. In addition, the electronic device 1000 may perform an overall analysis process of the packet by interworking with the ALTO system to which the WIRE SHARK is applied. According to an embodiment, the ALTO system may be used to detect the overall security risk of the server 2000 as well as packet analysis. According to an embodiment, the electronic device 1000 may generate a personal information discharge test result or information on exposure risk as visual content, and may output the generated content.

According to an embodiment, the electronic device 1000 may identify whether personal information is exposed by inputting information on a packet analysis result into a neural network model. According to an embodiment, the electronic device may determine whether to expose personal information in the packet by inputting the packet analysis result to the entity name recognition (NER) model of the RNN structure. According to an embodiment, the object recognition model composed of the RNN may be learned based on the divided parts-of-speech through a part-of-speech discriminator (CRF). According to an embodiment, the part-of-speech discriminator (CRF) model may be learned based on the Sejong corpus provided by the National Institute of the Korean Language.

According to an embodiment, the electronic device 1000 may include a processor 110 , a memory 120 , and a network interface 130 . The processor 110 may perform a method of determining whether personal information in a packet is exposed by executing one or more instructions in the memory 120 . According to an embodiment, the memory 120 may include a plurality of artificial intelligence models that can be learned according to an artificial intelligence learning algorithm. The network interface 130 may transmit and receive data, packets, queries, and query results between the server 2000 and other systems other than the personal information detection system.

According to an embodiment, the memory 120 includes a Recurrent Neural Network (RNN) model 122 , a Conditional Random Field model 124 , and a Name Entity Recognition model 126 . can do. According to an embodiment, the conditional random field model (CRF) 126 is configured as a neural network model, so that the part-of-speech can be identified from a string-type sentence according to a statistical modeling method. According to an embodiment, the conditional random chapter model 126 may identify words and parts of speech constituting a sentence in the form of (word, part-of-speech) and (word, part-of-speech). According to an embodiment, the conditional random field model 126 may be a SOFT MAX REGRESSION using POTENTIAL FUNCTION for sequential labeling.

According to an embodiment, the entity name recognition model 126 is a model composed of an RNN, and can infer and distinguish not only normalized personal information but also words that can be identified as personal information. According to an embodiment, the entity recognition model may be used for NLP and natural language processing technology, which are a classification of machine learning. The entity name recognition model may be used to extract and recognize a word (entity name) corresponding to a predefined person, company, place, time unit, etc. from a document.

According to another embodiment, an artificial neural network used by the electronic device 1000 may refer to a computing system focusing on a biological neural network. Unlike classical algorithms that perform tasks according to predefined conditions, artificial neural networks can learn to perform tasks by considering a large number of samples. An artificial neural network may have a structure in which artificial neurons are connected, and a connection between neurons may be referred to as a synapse. A neuron may process a received signal and transmit the processed signal to another neuron through a synapse. The output of a neuron may be referred to as activation, and a neuron and/or synapse may have a weight that can be varied, and the influence of a signal processed by the neuron may increase or decrease depending on the weight. .

For example, the artificial neural network may be composed of a plurality of neural network layers. Each of the plurality of neural network layers has a plurality of weight values (weights), and a neural network operation is performed through an operation between an operation result of a previous layer and a plurality of weights. The plurality of weights of the plurality of neural network layers may be optimized by the learning result of the artificial neural network.

For example, a plurality of weights may be modified and updated so that a loss value or a cost value obtained from the artificial intelligence model during the learning process is reduced or minimized. The artificial neural network according to the present disclosure may include a deep neural network (DNN), for example, a Convolutional Neural Network (CNN), Deep Neural Network (DNN), Recurrent Neural Network (RNN), Restricted RBM (RBM). Boltzmann Machine), DBN (Deep Belief Network), BRDNN (Bidirectional Recurrent Deep Neural Network), or deep Q-Networks, etc., but is not limited to the above-described example.

According to an embodiment, the electronic device 1000 may transmit/receive a query and a result of the query by interworking with the server 2000, and may check whether personal information is exposed in the packet as a result of the query. According to an embodiment, the server 2000 may include a processor 140 , a database 150 , and a network interface 160 . By executing one or more instructions in the database 150 , the processor 140 may cause the server 2000 to analyze personal information in the packet by interworking with the electronic device. According to an embodiment, the network interface 160 may transmit/receive data, packets, queries, and query results to/from the electronic device 1000 or other systems for checking whether personal information is exposed.

According to an embodiment, the processor 140 may obtain the CDM query 162 from the electronic device 1000 and transmit the query result 164 to the electronic device 1000 in response to the obtained query. According to an embodiment, a packet as a CDM query result transmitted by the server 2000 may be analyzed by the ALTO system and used to check the security risk of the server 2000 as a whole.

2 is a flowchart of a method for an electronic device to determine personal information exposure, according to an embodiment.

In S210 , the electronic device 1000 may transmit a query to the server 2000 connected to the electronic device 1000 . According to an embodiment, the electronic device 1000 may transmit a CDM query for requesting Common Data Model (CDM) data as a query result to the server. In S220 , the electronic device 1000 may obtain a packet transmitted from the server in response to the transmitted query as a result of the query for the query. According to an embodiment, the electronic device 1000 may obtain a query result from the server through HTTPS.

In S230 , the electronic device 1000 may identify whether personal information about the user of the electronic device in the packet is exposed by inputting the obtained packet into the neural network model. According to another embodiment, the electronic device 1000 may determine whether personal information in the packet is exposed by inputting a packet analysis result analyzed using the ALTO system to the neural network model.

According to another embodiment, the electronic device 1000 may generate information on whether personal information has been exposed as visual content and display the generated visual content on the display screen of the electronic device. According to an embodiment, the electronic device 1000 may output the personal information exposure result as content in a visual or audio format.

3 is a flowchart of a method for an electronic device to obtain a packet from a server according to an embodiment.

In S310 , the electronic device 1000 may access the server 2000 through HTTPS. In S320 , the electronic device 1000 may obtain a packet through the connected server 2000 . More specifically, the electronic device 1000 may be connected to a server through a network interface, and may obtain a packet from the connected server. In S330, the electronic device 1000 may store data in a packet obtained using the ALTO system to which the WIRE SHARK is applied as a PCAP file. Wireshark, used by electronic devices, is a free and open source packet analysis program that can be used for network problems, analysis, and software and communication protocol development. The electronic device 1000 may analyze a packet obtained from the server using the WIRE SHARK, and may input a packet analysis result (eg, a PCAP file) into a predetermined neural network model.

4 is a diagram for describing a process in which an electronic device learns a query using a neural network model, according to an embodiment.

According to an embodiment, the electronic device 1000 may determine whether to expose personal information in the packet by inputting a packet obtained from the server into a model of a predetermined neural network structure. According to another embodiment, the electronic device 1000 may analyze a packet obtained from the server using a WIRE SHARK, and may input information on the analysis result into a predetermined neural network model. According to an embodiment, the neural network model may include a conditional random field model and an entity name recognition model for distinguishing parts of speech that are the basis of grammar.

In general, when analyzing personal information exposure, it is necessary to check the presence or absence of personal information in the document. Regular expression has been widely used as one of the methods for determining existing personal information, but there is a limitation that polymorphism of personal information cannot be determined. there was. However, the electronic device 1000 according to the present disclosure configures the entity name recognition model 420 using the neural network model 430, and uses the entity name recognition model to determine not only normalized personal information but also personal information. Can be distinguished by inferring possible words. Accordingly, the electronic device 1000 according to the present disclosure can compensate for the disadvantages of the regular expression by inferring and classifying words that can be identified as personal information.

Also, in order to compensate for the shortcomings of the regular expression, the electronic device 1000 may distinguish the part-of-speech, which is the basis of the grammar, through the conditional random field model 410 (CRF) including the neural network model 430 . The conditional random field model can be learned only by using the part-of-speech information about Hangul, and the electronic device 1000 can learn the conditional random field model using the Sejong corpus provided by the National Institute of the Korean Language. The electronic device 1000 may identify part-of-speech information about Hangul using the learned conditional random chapter model, and train the entity name recognition model 420 based on the identified part-of-speech information. The electronic device 1000 may effectively classify words that can be identified as personal information in a packet by using the learned entity name recognition model.

According to an embodiment, the neural network model 430 constituting the conditional random field model 410 or the entity name recognition model 420 may include a deep neural network (DNN), for example, CNN. (Convolutional Neural Network), DNN (Deep Neural Network), Recurrent Neural Network (RNN), RBM (Restricted Boltzmann Machine), DBN (Deep Belief Network), BRDNN (Bidirectional Recurrent Deep Neural Network) or Deep Q-Network ( Deep Q-Networks) and the like, but is not limited to the above-described example. According to an embodiment, the neural network model 430 may include a plurality of layers and a weight 432 related to the connection strength of the layers. The neural network model 430 can be trained by modifying and updating weights.

5 is a block diagram of an electronic device according to an embodiment.

According to an embodiment, the electronic device 1000 may include a processor 1300 , a network interface 1500 , and a memory 1700 . However, the present invention is not limited thereto, and the electronic device 1000 may further include an output unit (display, speaker).

According to an embodiment, the electronic device 1000 may generate a predetermined neural network model and train the generated neural network model. The electronic device 1000 may obtain a packet from the server using the learned neural network model, and determine whether personal information in the obtained packet is exposed.

According to an embodiment, the electronic device 1000 may generate learning data for learning an artificial neural network. According to an embodiment, the electronic device 1000 may train the artificial neural network by using the generated learning data to modify and update the layers in the artificial neural network and a weight related to the connection strength of the layers. According to an embodiment, the electronic device 1000 includes a smart phone, a tablet PC, a PC, a smart TV, a mobile phone, a media player, a server, an AI program loaded with an AI program for processing the weights of the artificial neural network and including a voice recognition function; It may be, but is not limited to, a micro server or other mobile or non-mobile computing device.

According to an embodiment, the processor 1300 controls the overall operation of the electronic device 1000 by executing one or more instructions in the memory 1700 . According to an embodiment, the processor 1300 may perform the functions of the electronic device 10000 described in FIGS. 1 to 4 by executing programs stored in the memory 1700 . The processor 1300 may include one or a plurality of processors, and the one or more processors may be a general-purpose processor such as a CPU, an AP, a digital signal processor (DSP), or the like, or a graphics-only processor such as a GPU. According to an embodiment, when the processor 1300 includes a general-purpose processor and a graphics-only processor, each of the general-purpose processor and the graphics-only processor may be implemented as a separate chip.

According to an embodiment, when the processor 1300 is implemented as a plurality of processors or graphics-only processors, at least some of the plurality of processors or graphics-only processors may include the electronic device 1000 and other electronic devices connected to the electronic device 1000 . Alternatively, it may be mounted on a server. For example, by executing programs stored in the memory 1700 , the processor 1300 may transmit/receive a packet in association with a server and determine whether personal information in the packet is exposed.

According to an embodiment, the processor 1300 transmits a query to a server connected to the electronic device, obtains a packet transmitted from the server in response to the transmitted query as a query result of the query, and obtains the By inputting the received packet into the neural network model, it is possible to identify whether personal information about the user of the electronic device in the packet is exposed.

According to an embodiment, the processor 1300 may generate visual content for whether the personal information is exposed or not, and display the generated visual content on the screen of the electronic device.

According to an embodiment, the processor 1300 may transmit a CDM query for requesting Common Data Model (CDM) data as a query result.

According to an embodiment, the processor 1300 accesses the server through HTTPS,

A packet may be obtained from the connected server, and data in the obtained packet may be stored as a PCAP file by using the ALTO system to which WIRE SHARK is applied.

According to an embodiment, the processor 1300 may input the PCAP file to the neural network model and identify whether the personal information about the user of the electronic device has been exposed based on an output value of the neural network model. .

The network interface 1500 may include one or more components that allow the electronic device 1000 to communicate with another device (not shown) and the server 2000 . The other device (not shown) may be a computing device such as the electronic device 1000 or a sensing device, but is not limited thereto. For example, the network interface 1500 may include a short-range communication unit and a mobile communication unit.

Short-range wireless communication unit, Bluetooth communication unit, BLE (Bluetooth Low Energy) communication unit, near field communication unit (Near Field Communication unit), WLAN (Wi-Fi) communication unit, Zigbee communication unit, infrared (IrDA, infrared) It may include a data association) communication unit, a Wi-Fi Direct (WFD) communication unit, an ultra wideband (UWB) communication unit, and the like, but is not limited thereto. The mobile communication unit transmits/receives a radio signal to and from at least one of a base station, an external terminal, and a server on a mobile communication network. According to an embodiment, the network interface (not shown) transmits a query request, a CDM query request, a weight value in the artificial neural network, training data for learning the artificial neural network, etc. to the server under the control of the processor, In response to the request, the query result, artificial neural network learning data, artificial neural network learning information, and the like may be received.

The memory 1700 may store a program for processing and controlling the processor 1300 , and may also store data input to or output from the electronic device 1000 . Also, the memory 1700 may store information about the layers constituting the artificial neural network, nodes included in the layers, and weights related to the connection strength of the layers. Also, the memory 1700 may further store augmentation data. Also, when the weights in the artificial neural network are modified and updated, the memory 1700 may further store information about the modified and updated weights. Also, the memory 1700 may further store information on the entity name recognition model, the conditional random field model, and the neural network model.

The memory 1700 may include a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg, SD or XD memory), and a RAM. (RAM, Random Access Memory) SRAM (Static Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), PROM (Programmable Read-Only Memory), magnetic memory, magnetic disk , may include at least one type of storage medium among optical disks.

The method according to an embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present disclosure, or may be known and available to those skilled in the art of computer software.

In addition, according to the embodiment, a computer program apparatus including a recording medium storing a program for performing another method may be provided. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although the embodiments of the present disclosure have been described in detail above, the scope of the present disclosure is not limited thereto, and various modifications and improved forms of the present disclosure are also provided by those skilled in the art using the basic concept of the present disclosure as defined in the following claims. belong to the scope of the right.

Claims (13)

In a method for an electronic device to determine whether to expose personal information,
transmitting a CDM query for requesting Common Data Model (CDM) data as a query result to a server connected to the electronic device;
accessing the server through HTTPS in response to the transmitted query as a result of the query for the query, and obtaining a packet transmitted from the connected server; and
identifying whether personal information about a user of the electronic device in the packet is exposed by inputting the obtained packet into a neural network model; including,
The step of obtaining the packet includes:
Using the ALTO system to which WIRE SHARK is applied, it includes the step of storing the obtained data in the packet as a PCAP file,
The neural network model is
It is a recurrent neural network model (Recurrent Neural Network) structure, and comprises a Conditional Random Field model and a Named Entity Recognition model for distinguishing parts of speech that are the basis of grammar. The method of claim 1, wherein the method
generating visual content for whether the personal information has been exposed; and
displaying the generated visual content on a screen of the electronic device; A method comprising delete delete delete The method of claim 1, wherein the step of identifying whether the personal information has been exposed comprises:
inputting the PCAP file into the neural network model; and
identifying whether the personal information about the user of the electronic device has been exposed based on an output value of the neural network model; A method comprising In the electronic device for determining whether to expose personal information,
network interface;
display;
a memory storing one or more instructions; and
at least one processor executing the one or more instructions; including,
The at least one processor by executing the one or more instructions,
Transmitting a CDM query for requesting CDM (Common Data Model) data as a query result to a server connected to the electronic device,
accessing the server through HTTPS in response to the transmitted query as a result of the query for the query, and obtaining a packet transmitted from the connected server;
By inputting the obtained packet into a neural network model, it is identified whether personal information about a user of the electronic device in the packet is exposed,
the at least one processor,
Using the ALTO system to which WIRE SHARK is applied, the data in the acquired packet is stored as a PCAP file,
The neural network model is
It is a recurrent neural network model structure and comprises a Conditional Random Field model and a Named Entity Recognition model for distinguishing parts of speech that are the basis of grammar, an electronic device . 8. The method of claim 7, wherein the at least one processor comprises:
By executing the one or more instructions,
create visual content about whether the personal information has been exposed, and
and displaying the generated visual content on a screen of the electronic device. delete delete delete 8. The method of claim 7, wherein the at least one processor comprises:
input the PCAP file to the neural network model;
and identifying whether the personal information about the user of the electronic device has been exposed based on an output value of the neural network model. In a method for an electronic device to determine whether to expose personal information,
transmitting a CDM query for requesting Common Data Model (CDM) data as a query result to a server connected to the electronic device;
accessing the server through HTTPS in response to the transmitted query as a result of the query for the query, and obtaining a packet transmitted from the connected server; and
identifying whether personal information about a user of the electronic device in the packet is exposed by inputting the obtained packet into a neural network model; including,
The step of obtaining the packet includes:
Using the ALTO system to which WIRE SHARK is applied, it includes the step of storing the obtained data in the packet as a PCAP file,
The neural network model is
It is a recurrent neural network model structure, and it is characterized by including a Conditional Random Field model and a Named Entity Recognition model for distinguishing parts of speech that are the basis of grammar. A computer-readable recording medium in which a program to be executed is stored.

Images