1. A method for recognizing information flow and detecting information leakage, the method comprising: recognizing operations running on an operating system as contexts defined as a set of object handle, related API function list, and situation information; expressing possible associations between the contexts; explicitly expressing the expressed associations between the contexts as user's behaviors occurring on a system; determining if a target object with respect to a behavior is used as a function of a source object of another behavior in the explicitly expressed associations between the contexts; and recognizing the behavior as one behavior corresponding to a dynamically extended context association when the target object is used as the function of the source object of another behavior.