10. The computer implemented method of claim 9 , wherein, in the recognizing step, the operations occurring on the operating system are expressed as a context layer that expresses the contexts, and the operations are defined by an object layer, an object handle layer, and an operation layer, which are located under the context layer.
9. A computer implemented method for recognizing information flow and detecting information leakage, the method comprising: recognizing by a micro-processor operations running on an operating system as contexts defined as a set of object handle, related API function list, and situation information; expressing possible associations between the contexts; explicitly expressing the expressed associations between the contexts as user's behaviors occurring on a system; determining if a target object with respect to a behavior is used as a function of a source object of another behavior in the explicitly expressed associations between the contexts; recognizing the behavior as one behavior corresponding to a dynamically extended context association when the target object is used as the function of the source object of another behavior, wherein the possible associations between the contexts in the expressing step comprises: an execution association where, in the method for expressing the user's behaviors, two contexts are defined as having the execution association when one executable object generated by one context generates another context in order to express the behavior related to the information flow by using a plurality of contexts and associations thereof; a convergence association where, in the method for expressing the user's behaviors, different contexts are defined as having the convergence association when the different contexts perform the same operation on the same object; and a transfer association where, in the method for expressing the user's behaviors, contexts are defined as having the transfer association when data input/output direction is concentrated on one context within other context with respect to different or same objects in order to express the behaviors related to the information flow by using a plurality of contexts and associations thereof.