개인 정보 노출에 대한 정량적 위험도 분석 방안
A method for quantitative measuring the degree of damage by personal information leakage
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
본 연구에서는 개인 정보별 노출시 피해를 정량적으로 산출할 수 있는 위험도를 정의한다. 제안 방법은 개인정보를 세분화 후, 각 개별 위험도를 산정한다. 또한 두 가지 이상의 정보가 복합될 경우의 추가되는 위협도 동시에 고려한다. 또한 개인 정보를 습득하고자 하는 공격자 유형별로 개인 정보의 가치를 구분하여 개인정보 노출시에 어떠한 공격에 취약한지를 알 수 있도록 하였다. 또한 노출 정도를 판별하기 위해 엔트로피 개념을 위험도 산출시 도입한다. 이를 바탕으로 페이스북 사용자들의 공개된 정보에 대한 위험도를 분석한다. 2만여명의 공개 정보를 분석한결과, 페이스북 사용자는 평균적으로 스토커 공격에 취약한 것으로 보여졌다.
Abstract
This research defines the degree of the threat caused by the leakage of personal information in a quantitative way. The proposed definition classifies the individual items in a personal data, then assigns a risk value to each item. The proposed method considers the increase of the risk by the composition of the multiple items. We also deals with various attack scenarios, where the attackers seek different types of personal information. The concept of entropy applies to associate the degree of the personal information exposed with the total risk value. In our experiment, we measured the risk value of the Facebook users with their public profiles. The result of the experiment demonstrates that they are most vulnerable against stalker attacks among four possible attacks with the personal information.
참고문헌 (24)
- "2013 Cost of Data Breach Study: Global Analysis" (2013)[URL]
- Estimation of the percent of unique population elements on a microdata file using the sample, "L. V. Zayatz", U.S. Department of Commerce, ~, pp.Census (1991), SRD[DOI]
- L.V. Zayatz, "Estimation of the number of unique population elements using a sample", Proceedings of the Survey Research Section on American Statistical Association, pp.369~373 (1991)
- G. Chen, "Estimation of identification disclosure risk in microdata", Journal of Offical Statistics-Stockholm, 14(1), pp.79~95 (1998)
- C. J. Skinner, "A measure of disclosure risk for microdata", Journal of the Royal Statistical Society : series B(statistical methodology), 64(4), pp.855~867 (2002)
- R. Agrawal, "Privacy-preserving data mining", ACM SIGMOD Record, 29(2), pp.439~450 (2000)
- C. E. Shannon, "A mathematical theory of communication", ACM SIGMOBILE Mobile Computing and Communications Review, 5(1), pp.3~55 (2001)
- D. Agrawal, "On the design and quantification of privacy preserving data mining algorithms", Proceedings of the ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pp.247~255 (2001)
- R. Yasui, "The Metric Model for Personal Information Disclosure", Proceeding of the 2010 IEEE International Conference on Digital Society, pp.112~117 (2010)
- R. Gross, "Information revelation and privacy in online social networks", Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society, pp.71~80 (2005)
- I. F. Lam, "Involuntary information leakage in social network services", Advances in Information and Computer Security, IWSEC'08, LNCS 5312, pp.167~183 (2008)
- F. B. Viégas, "Bloggers' expectations of privacy and accountability: An initial survey", Journal of Computer‐Mediated Communication, 10(3), pp.00~00 (2005)
- L. Sweeney, "Finding lists of people on the web", ACM SIGCAS Computers and Society, 34(1) (2004)
- E. Minkov, "Extracting personal names from email: applying named entity recognition to informal text", Proceedings of the Conference on Human Language Technology and Empirical Methods in Natural Language Processing, Association for Computational Linguistics, pp.443~450 (2005)
- T. T. T Hien, "An ontological approach to lifelog representation for disclosure control", Proceedings of the 2009IEEE International Symposium on Consumer Electronics, pp.932~936 (2009)
- M. Iwaihara, ""Risk evaluation for personal identity management based on privacy attribute ontology," Conceptual Modeling-ER 2008, ICCM'08", LNCS, 5231, pp.183~198 (2008)
- G. J. Ahn, "Ontology-Based Risk Evaluation in User-Centric Identity Management", Proceeding of the 2011IEEE International Conference on Communications, pp.1~5 (2011)
- Privacy security index research report, "KISA", ~ (2008)
- "Privacy white papaer" (2003)[URL]
- "Implementation cases of privacy management and security protection" (2011)[URL]
- S. Guiaşu, "Weighted entropy", Reports on Mathematical Physics, 2(3), pp.165~179 (1971)
- 임종인, "개인정보관련분쟁의 사례분석과 대안의 모색", 정보법학, 12(2), pp.214~251 (2008), 한국정보법학회
- "A casebook of dispute conciliation of privacy" (2011)[URL]
- "General law site of Korea court" (2008)[URL]