The design of framework for detecting an insider's leak of confidential information

Abstract

The confidential information such as the technical know-how or the business information of an enterprise is very important because it may make the enterprise do the business or not. The enterprise, therefore, are in control of its confidential or critical information with the support of a lot of time and fund. In spite of their effort, 87% of the leak of confidential information is due to insiders[1]. The cause of the leak of confidential information is the negligent or weak control of employee's E-mail, instant message, P2P and so on. It also comes that insiders leak some information maliciously for the purpose of economical profit or are industrial spy. The frequency of those is increasing more and more[2]. The insiders are very skilled in the equipments or systems of the organization which they belong to and can delete immediately their traces after their improper activities. Therefore, it needs the acquisition of data in conformity with the leak type of confidential information for finding out the evidence. We propose a framework to detect and prevent the leak of confidential information according to the leak type with the forensic sight. And the framework has also the function of the first response and the gathering evidence.