1. A computer implemented method for recognizing information flow and detecting information leakage, the method comprising: recognizing by a micro-processor operations running on an operating system as contexts defined as a set of object handle, related API function list, and situation information; expressing possible associations between the contexts; explicitly expressing the expressed associations between the contexts as user's behaviors occurring on a system; determining if a target object with respect to a behavior is used as a function of a source object of another behavior in the explicitly expressed associations between the contexts; recognizing the behavior as one behavior corresponding to a dynamically extended context association when the target object is used as the function of the source object of another behavior; inspecting the one behavior and determining if the object passes through a leakage point; adding contexts related to the object to an information flow chain when it is determined that the object does not pass through the leakage point; inspecting the information flow chain linked to the object when it is determined that the object passes through the leakage point; determining if a source of the information flow chain configured with the contexts belongs to a confidential object by using the inspection result; blocking the contexts from passing through the leakage point when it is determined that the source of the information flow chain belongs to the confidential object; and permitting the contexts to pass through the leakage point when it is determined that the source of the information flow chain does not belong to the confidential object.