Somansa Co., Ltd.

Il Hoon Choi

Tae Wan Kim

Seung Tae Paek

Sang Wook Kim

Sang Seok Lee

Hwan Cheol Lim

Sang Jin Lee

Byung Hyun Ha

Disclosed is a method of inspecting sensitive information stored in a file system. The method includes storing file inspection result information including a file path field, a field of whether file writing is changed, a file size field, a final file modification date field, and a field of a number of detection per pattern, with respect to files in the file system, monitoring a file change event generated in the file system, detecting a type of the file change event sensed according to the monitoring the file change event, modifying the file inspection result information with respect to the file system according to the type of the file change event, detecting whether sensitive information is included, with respect to modified files in the file inspection result information, and modifying the file inspection result information by reflecting sensitive detection information according to the detection of the sensitive information.

Method and apparatus for inspecting sensitive information stored in file system

An apparatus for constructing Aho-Corasick automata according to the present invention includes a concatenative normal form transforming unit configured to receive a regular expression that is expressed using an operator including a concatenation and an alternation and transform the regular expression into concatenative normal forms (wherein each concatenative normal form is defined as a form in which character alternations are connected by concatenation); a trie generating unit configured to generate a trie from the concatenative normal forms by updating states and transitions of the trie (wherein each transition corresponds to a set of characters) while processing each concatenative normal form in order; and a failure link creating unit configured to create a failure link for each state of the trie by using a set of characters corresponding to each transition of the trie.

Apparatus and method for constructing Aho-Corasick automata for detecting regular expression pattern

Disclosed is a system for forwarding traffic of an endpoint. The system includes the endpoint configured to transmit traffic generated by an application to a server and a security gateway configured to receive the traffic from the endpoint and analyzes data related to information security of secure sockets layer (SSL) traffic among the traffic. Here, the endpoint includes a local redirection module configured to store redirection information including server connection information for transmitting the traffic to the server and to perform redirection related to transmission of the traffic and a local proxy module configured to decode the data with respect to the SSL traffic among the traffic received from the local redirection module and then to forward the decoded SSL traffic to the security gateway according to the redirection of the local redirection module.

System and method for forwarding traffic of endpoint

Disclosed is a system for tracking an information leakage of an endpoint. The system includes a management server which transmits the detection pattern information to an endpoint terminal connected through a network and an endpoint terminal which monitors generation and change of a file by using the detection pattern information, performs a first detection activity through matching information stored in a heap memory of a currently-executed process with the detection pattern information, and a second detection activity according to monitoring of a particular application program interface (API) according to process execution, executes an information leakage response process corresponding to first detection activity information and second detection activity information, and transmits the first detection activity information and the second detection activity information to the management server.

System and method for tracking information leakage at endpoint

Provided is a data loss prevention system comprising an address converting module for converting a private IP address of a received traffic into an IPv6 address; a first communication module for decoding the received traffic; the data loss analyzing module for analyzing the traffic transmitted from the first communication module according to a predetermined policy and examining whether personal information or confidential information is included; and a second communication module for transmitting the traffic transmitted from the data loss analyzing module to the address converting module after the traffic is encoded or not encoded according to the information representing whether the traffic is encoded included in the IPv6 address, wherein the address converting module restores the IPv6 address of the traffic transmitted from the second communication module to the private IP address.

Data loss prevention system implemented on cloud and operating method thereof

Disclosed are a DLP security system and an operating method thereof. An operating method of a data loss prevention (DLP) apparatus, comprising: converting, into packets, Ethernet signals received from a fail over device that are transmitted and received between an external network and internal network; analyzing the packets to classify the packets into first packets required to be precisely judged and second packets not required to be precisely judged; distributing and allocating a judgment job about the first packet to at least one in-line instance according to a predetermined reference; and allocating the judgment job distributed to the in-line instance in which a fail occurs to the in-line instance which is normally operated when it is verified whether there is an in-line instance which is normally operated in the case where the fail occurs in the at least one in-line instance.

Apparatus and security system for data loss prevention, and operating method of data loss prevention apparatus

Provided are an information protection apparatus and system. The information protection apparatus based on Windows, Unix, or Linux includes a first check unit, a second check unit, and a security measure unit. The first check unit checks whether there is a file including monitoring information among a plurality of check target files in a local storage area, according to a predetermined check policy. The second check unit checks whether there is a file including the monitoring information among the check target files in a sharing storage area of a file system that is shared in a network drive type in an NFS scheme. The security measure unit performs a security measure conforming to a predetermined security policy for the file including the monitoring information.

Personal information protection system for providing specialized function for host terminal based on Unix and Linux

Provided are an apparatus and method for monitoring web application telecommunication data by user. An information identification apparatus includes a collector collecting web application telecommunication data transmitted and received between a web server and a web client; a storage storing an identification information profile about a method of extracting user identification information by web server; and an extractor selecting user login-related web application telecommunication data among the web application telecommunication data with reference to the identification information profile, extracting a [web server address, login session identification information, and user identification information] list from the selected web application telecommunication data, extracting at least one piece of information of the web server address and the login session identification information from the web application telecommunication data after the user login, and determining whether the extracted information is matched with at least one piece of information in the list.

Apparatus and method for monitoring web application telecommunication data by user

Disclosed are a system and a method for printed matter security. A method for printed matter security according to an exemplary embodiment of the present invention includes: receiving policy information, information of a monitoring application program, and pattern information of personal information from a security server; inserting a printing interruption module in the monitoring application program when the monitoring application program corresponding to the information of the application program is executed; storing a content of a printing request by interrupting the printing request of the monitoring application program by the printing interruption module; verifying whether the personal information is included in the content of the printing request, using the pattern information; and performing an information protection function corresponding to the policy information when the personal information is included in the content of the printing request.

Growing community of inventors

Seoul, South Korea

Il Hoon Choi