KR101490052B1 - System and method for monitoring illegal remote access of user's terminal - Google Patents

Abstract

The present invention relates to a web security system and method and, more specifically, to a system and method in which a web service server providing an arbitrary web service determines whether a user using a user terminal requesting a web service is a legal user or a remote intruder using a remote access terminal, which accesses to the user terminal from a remote place, and provides the web service only to the legal user. The system comprises: a web service server which provides an agent, when the arbitrary web service is requested, receives and transmits static pattern information including network connection information related to the provision of the agent and executed process information, receives an intrusion determination result according to the static pattern information, and provides or blocks the requested web service according to the result of the intrusion determination; a user terminal which connects to the web service server to request the web service, receives and installs the agent according to the web service request, collects the static pattern information by the agent, and provides the information to the web service server; and a remote connection monitoring server which includes a dynamic pattern information database storing dynamic pattern information on at least one of a legal remote accessor or an intruder. and, when the static pattern information is received from the web service server, compares the dynamic pattern information with the received static pattern information to determine whether the user requesting the web service through the user terminal is a legal user or an intruder, and transmits the determination result to the web service server.

Description

SYSTEM AND METHOD FOR MONITORING < RTI ID = 0.0 > and /

The present invention relates to a web security system and method, and more particularly, to a Web security system and method in which a user using a user terminal requesting a web service in a web service server providing an arbitrary web service is a legitimate user, To a user terminal remote access detection system and method capable of determining whether a remote intruder is a remote intruder and providing a web service only to a legitimate user.

Recently, due to the rapid development of wired / wireless internet communication technology, personal information is being leaked through the websites of users' computers and users. Such leakage of personal information is causing financial risks such as reissuance of accredited certificates according to impersonation and electronic transfer. Also, personal information that is leaked is used for fraudulent transactions such as finance and e-commerce, and is being exploited to open various cannon phones and cannon accounts in offline using personal information. In addition, leakage of personal information is expected to lead directly to the survival of companies in case of internal confidential leakage.

As a method for preventing the leakage of personal information, there is a method of replacing a resident registration number using an Internet Personal Identification Number (i-Pin) (hereinafter referred to as an "i-pin") instead of a resident registration number, A method of using a security program for preventing information leakage through a virus by detecting and deleting malicious codes such as viruses and spyware, a secure settlement method and a simple settlement method at the time of settlement, and a method of using an authorized certificate.

The Ipin method is to set a password for Ipin and its Ipin to replace the resident registration number for the resident registration number on the security company website provided by Ipin, and to register the service using the registered IP address and password instead of the resident registration number And the on-line web site to be registered is authenticated through the Ipin provided security company by IP pin and password.

And, in the public certificate system, a public certificate that a password is set by a public certification authority is issued and stored in a portable storage device such as a computer, a USB, or a mobile phone, and a public certificate is called for each authentication and payment, Authentication.

However, even in the case of the above-described IP-PIN method, personal information can be exposed when the IP-PIN and the password are exposed, and the authorized certificate system can also copy the authorized certificate and can be used online only if the password is exposed.

In addition, these personal information protection schemes can not prevent the victim from knowing that the individual is unaware of the login, payment and authentication of the online information using the personal information of the three persons, There is a problem that it is not possible to cope quickly.

In order to solve such a problem, recently, a web service server registers a device such as a user's computer to be used for receiving a web service, blocks a connection such as login from a device other than the registered device, A device designation registration security system for notifying a third party connection through a device other than the registered device has been developed and applied.

However, when a third party hacked and accesses a user terminal that has completed device registration with a certain web service server using a remote access terminal, accesses a web service server through the hacked user terminal, installs malicious code, When accessing the Web service server through the user terminal, the conventional device-designated registration security system can not detect that the third party has accessed the third party because the third party is accessing through the user terminal.

Patent Publication No. 10-2007-0028549

Accordingly, it is an object of the present invention to provide a method and apparatus for detecting a remote intruder using a remote access terminal connected to a user terminal in a remote place or a user using a user terminal requesting a web service in a web service server, And to provide a web service to a legitimate user based on the determination result.

According to another aspect of the present invention, there is provided a user terminal remote access detection system, comprising: an agent for providing an arbitrary web service request; static pattern information including network connection information and executed process information; A web service server unit receiving and transmitting an intrusion detection result according to the static pattern information and providing or blocking the requested web service according to a result of the intrusion detection; A user terminal accessing the web service server unit, requesting the web service, receiving and installing an agent according to the web service request, collecting static pattern information by the agent, and providing the collected static pattern information to the web service server unit; And a dynamic pattern information database for storing dynamic pattern information that is information on at least one of a legitimate remote accessor and an intruder, wherein when receiving the static pattern information from the web service server unit, the dynamic pattern information and the received static pattern information And a remote access monitoring server unit for determining whether a user requesting the web service through the user terminal is a legitimate user or an intruder and transmitting the determination result to the web service server unit.

The user terminal includes: a communication unit connecting to a wire / wireless data communication network and performing data communication with other devices connected to the wire / wireless data communication network; A storage unit for storing the agent; And a control unit for collecting static pattern information by the agent and providing the static pattern information to the web service server unit through the communication unit.

Wherein the control unit comprises: a network connection check unit for collecting network connection information in which state information of a network connection connected from the outside through the communication unit is a connected state; A process detecting unit detecting a process that generates the collected network connection information and generating detected process information; And a static pattern information generating unit for generating static pattern information including the network connection information and the process information and transmitting the generated static pattern information to the web service server unit through a communication unit.

Wherein the control unit comprises: a port analyzing unit for reclassifying information detected and collected by the network connection checking unit and the process detecting unit by a specific open port; Wherein the exception information includes exception information including an exception connection, an exception process, and an exception port, which are stored in advance, and a network connection included in the exception information among the information detected by the network connection checking unit and the process detecting unit, An exception analysis unit that excludes network connection and process information having the network connection and the process information from the information; And an IP analysis unit for detecting a source IP address of the network connection and a process, wherein the static pattern information generation unit generates the static pattern information based on the information corresponding to the information included in the exception information and the information And static IP address information, and source IP information.

Wherein the web service server unit receives an intrusion determination result from the remote access monitoring server unit and transmits an identity confirmation request message to the communication terminal of the telephone number of the user registered in advance if the result is intrusion determination information, And provides the web service according to whether the message is received or not.

The communication terminal is a mobile communication terminal, and the identity verification request message and the response message are short message service messages.

Wherein the web service server unit includes an automatic response system (ARS), wherein the web service server unit transmits an outbound call to a communication terminal of a telephone number registered in advance with respect to the user through the automatic response system, And transmits a response message to the voice or communication terminal as a button signal and provides the web service according to whether the response message is received.

According to another aspect of the present invention, there is provided a method for detecting a remote access to a user terminal, comprising the steps of: when a user terminal accesses a web service server unit and requests an arbitrary web service, Installing agent installation process; A static pattern collecting step of collecting static pattern information, which is information on a remote connection made by the user terminal, to the remote access monitoring server part by the installed agent when requesting an arbitrary web service; The remote access monitoring server compares the received static pattern information with operation pattern information, which is information on at least one of legitimate remote accessors and intruders registered in advance, and determines whether the user requesting the web service through the user terminal is a legitimate user Detecting an intruder and transmitting the result; And a service providing step in which the web service server receives the result and provides or blocks the web service.

The static pattern collecting step may include: a network connection inspecting step of collecting network connection information that is established in a network connection externally connected through a communication unit; A process information generation step of detecting a processor that has generated the collected network connection information and generating detected process information; A static pattern information generation step of generating static pattern information including the network connection information and the processor information; And a static pattern information transmission step of transmitting the static pattern information to the web service server unit through a communication unit.

Wherein the static pattern collection step comprises: a port analysis step of reclassifying the network connection information and the process information for each specific open port; An exception analysis step of excluding information included in the exception information among the reclassified network connection information and process information with reference to exception information including a previously stored exception connection, an exception process and an exception port; And an IP analysis step of detecting a source IP of the detected network connection and a process, wherein the generating of the static pattern information includes generating the static pattern information including the port information and excluding the information included in the exception information And generates static pattern information.

The process information generating step may include: a process detecting step of detecting a processor that has generated the collected network connection information; Judging whether or not the detected right is a normal right by comparing the detected right with the predefined right rules and generating a result of the judgment;

A normal installation path determination step of detecting path information in which the detected process is installed, determining whether the detected path is a normal installation path, and generating a determination result; A process owner verification step of detecting owner information of the detected process, determining whether or not the owner information exists, comparing the information with information on legitimate owners, determining whether the owner is false, and generating the result information;

Determining whether an attribute of the detected process is hidden, and generating a result information; And a process information generating step of generating process information including the detected process information, process authorization determination result information, normal installation path determination information, owner verification information, and process hiding determination information.

The service providing process may include receiving an intrusion determination result from the remote access monitoring server unit; A telephone number loading step of loading a previously registered telephone number of the user if the received intrusion determination result is intrusion determination information; A personal identification request step of transmitting a personal identification request message to the communication terminal of the user's telephone number; And a web service providing step of providing the web service according to whether or not a response message to the identity confirmation request message is received.

The requested web service in the agent installation process is a login service and the web service in the static pattern collection process is an arbitrary web service provided by a web service server unit including a login service.

The present invention collects static pattern information including network connection information and executed process information of a user terminal, compares the collected static pattern information with predetermined dynamic pattern information, and transmits the static pattern information to an arbitrary web service server It is possible to judge whether the user who is connected to receive the service is a legitimate user or an intruder who illegally remotely accesses the user terminal.

Accordingly, the present invention can confirm the information of the remote access terminal connected to the user terminal by simply connecting the user to the web service server, so that leakage of personal information through the user terminal and unauthorized use of the third party through the web service server It is possible to prevent the leakage of the user's personal information through the web service server.

1 is a block diagram of a system for detecting a remote access to a user terminal according to the present invention.
2 is a diagram illustrating a configuration of a user terminal of a user terminal remote access detection system in which an agent according to the present invention is activated.
3 is a flowchart illustrating a method for collecting static pattern information in a user terminal of the user terminal remote access detection system according to the present invention.
FIG. 4 is a flowchart illustrating a method for detecting a user terminal remote access in a user terminal remote access detection system according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. Explain the method.

1 is a block diagram of a system for detecting a remote access to a user terminal according to the present invention.

Referring to FIG. 1, a user terminal remote access detection system according to the present invention includes a user terminal 200, a communication terminal 400, a web service server unit 500, and a remote access monitoring server unit 600. Reference numeral 100 denotes a remote access terminal that remotely accesses the user terminal 200.

The wired / wireless data communication network 150 may be a network combining a wired / wireless Internet network, a third generation mobile communication network (3G network), and a fourth generation mobile communication network (LTE).

The user terminal 200 is connected to the web service server unit 500 via the wired or wireless data communication network 150 to perform data communication and the web service server unit 500 can access the wired / And performs data communication with the server unit 600.

The communication terminal 400 receives a Short Message Service (SMS) message, a Multimedia Message Service (MMS) message from the web service server unit 500 via the wire / wireless data communication network 150, The mobile communication terminal 410 and the public switched telephone network (PSTN) capable of receiving a voice message through the mobile communication network of the wire / wireless data communication network 150 and receiving the voice message from the web service server unit 500 And a general wired telephone 420 capable of receiving a voice message.

The web service server unit 500 is connected to the communication terminal 400 of the user through the public switched telephone network (PSTN) according to the present invention and performs voice communication or transmits the voice communication through the mobile communication network of the wired / wireless data communication network 150 And performs data message communication.

The user terminal 200 may be a designated terminal registered in advance by the user in the web service server unit 500 or may be an unregistered general terminal. The user terminal 200 is a terminal capable of accessing the web service server unit 500 through the wire / wireless data communication network 150. The terminal 200 may be a personal computer (PC), a computer terminal 300 such as a notebook computer, A smart terminal 410 capable of both voice communication and data communication such as a smart pad. The user terminal 200 is installed with an agent provided with the web service server unit 500. At least one of the network connection information, the process information, and the IP information, And provides the collected static pattern information to the web service server unit 500. However, the static pattern information preferably includes at least network connection information and process information.

The web service server unit 500 stores user information including login information and a telephone number including an ID and a password for a plurality of users. The web service server unit 500 includes a login service, a user information change / And a payment service to the user terminal 200 of the logged-in user. In particular, the web service server unit 500 stores an agent program. When an arbitrary user logs in, it is determined whether an agent is installed in the user terminal of the user. If the agent is not installed, . When the static pattern information is received from the user terminal 200 through the agent, the web service server unit 500 provides the static pattern information to the remote access monitoring server unit 600. The web access server unit 500 receives the static pattern information from the remote access monitoring server unit 600, When the intrusion determination information is received, the service is provided or blocked according to the determined intrusion. The web service server unit 500 transmits a personal identification request message to the communication terminal 400 corresponding to the telephone number of the user registered in advance with respect to the user before providing and blocking the service, Or to block or block the < / RTI > The identity confirmation request message may be a voice message or a data message such as a short message service (SMS) message, a multimedia service (MMS) message, or a push message. That is, the web service server unit 500 includes an ARS (Auto Response System) or a short message service (SMS) message, a multimedia message service (MMS) message, and the like in order to transmit the identity confirmation request message as a voice message And an application server corresponding to the agent so as to be able to transmit a push message.

The remote access monitoring server unit 600 includes a dynamic pattern information database (DB) 610 that stores two types of dynamic pattern information, and when receiving static pattern information from the web service server unit 500, And compares the static pattern information with the dynamic pattern information registered in advance in the dynamic pattern information DB 610 to determine the network connection of the static pattern information and the invasion of the processes. Specifically, the dynamic pattern information includes black list information and white list information. The blacklist information includes remote access blocking malicious codes (zombie / backdoor) information, and the whitelist information includes process information on normal processes previously defined as information to be "exceptionally processed " . The remote access blocking malicious code information of the black list includes a process name, an MD5 hash value, and the like.

FIG. 2 is a diagram illustrating a configuration of a user terminal of a user terminal remote access detection system in which an agent is driven according to an embodiment of the present invention.

2, a user terminal 200 according to the present invention includes a control unit 210, a storage unit 220, an input unit 230, a display unit 240, and a communication unit 250.

The storage unit 220 includes a program storage area for storing a control program for controlling the operation of the user terminal including the agent according to the present invention, a temporary area for temporarily storing data generated during the execution of the control program, And a data area for storing static information and pattern information.

The input unit 230 includes a key input device having a plurality of keys for inputting numbers and characters and outputting a key signal corresponding to the pressed key, and a display unit 240, And a touch pad for outputting the data to the control unit 210.

The display unit 240 displays various information of the user terminal according to the present invention.

The communication unit 250 includes devices such as a remote access terminal 100, a web service server unit 500, and a remote access monitoring server unit 600 connected to a wired / wireless data communication network 150 and connected to a wired / wireless data communication network 150 And data communication between the control unit and the control unit. The communication unit 250 includes a wireless Internet communication unit for wirelessly connecting to the wireless Internet network of the wire / wireless data communication network 150 and a wired Internet connection unit for connecting the wired Internet network of the wired / And a mobile communication unit for wirelessly connecting to a mobile communication network of the wire / wireless data communication network 150. [

The control unit 210 controls the overall operation of the user terminal according to the present invention. Particularly, the control unit 210 is connected to the network 210 through the communication unit 250 during the operation of the agent, or to a network (hereinafter, referred to as "process" Generates connection information and process information for creating a network connection, generates static pattern information including network connection information and process information, and provides the generated static pattern information to the web service server unit 500. The network connection information may be information such as protocol information, local address information, foreign address information, and status information. The process information includes a process name, an MD5 hash value, (Or issuer) information, process capacity information, process attribute information, and the like. The network connection information and process information themselves are well known to those having ordinary skill in the art, and a detailed description thereof will be omitted.

More specifically, the control unit 210 includes a network connection checking unit 211, a process detecting unit 212, a port analyzing unit 213, an exception analyzing unit 214, an IP analyzing unit 215 and a static pattern information generating unit 216).

The network connection checking unit 211 collects network connection information in which the state information of the connected network through the communication unit 250 is continuously established.

The process detection unit 212 detects the process of generating the collected network connection information and generates the detected process information.

The port analyzing unit 213 reclassifies the information detected and collected by the network connection checking unit 211 and the process detecting unit 212 for each specific open port. The specific open port is a predefined port that is currently open for access, is easily accessible, and is often used for hacking.

The exception analysis unit 214 stores exception information including exception connection, exception process, and exception port that are stored in advance. The exception analysis unit 214 detects exception information including exception connection, exception process, From the network connection and process information corresponding to the network connection, process and port information included in the exception information among the classified information.

The IP analysis unit 215 detects a source IP address for a network connection, a process excluding network connection, process and port information excluded by the exception analysis unit 214, and generates IP analysis information.

In the above description, the exception analysis is first performed and the IP analysis is performed. However, the source IP of all the network connections and processes is analyzed and the exception information including the exception connection, exception process, exception port and exception IP is referred to And to remove the exclusion target information of the network connection, the process, the port, and the IP created by the network connection.

The static pattern information generating unit 216 generates static pattern information including at least one of the network connection information, the process information, and the IP analysis information, and transmits the generated static pattern information to the web service server unit 500 through the communication unit. However, the static pattern information may include at least network connection information and process information among the information.

3 is a flowchart illustrating a method for collecting static pattern information in a user terminal of the user terminal remote access detection system according to the present invention.

3, when a user accesses the web service server unit 500 through the user terminal 200 and requests a web service, the agent installation program is downloaded from the web service server unit 500 to install the agent (S311 ). The web service that induces the agent to install may be a login service, a payment service, a user information change service, or the like, but it is preferably a login service. In other words, it would be desirable to induce the agent to install at login when the agent is not installed.

When the agent is installed, the control unit 210 of the user terminal 200 detects a network connection connected to the communication unit 250 through the network connection checking unit 211 and collects network connection information about the detected network connection ). When the network connection information is collected, the control unit 210 detects a network connection that is established in the network connections detected through the network connection checking unit 211, generates network connection information for the detected network connection (S315).

When the network connection information is generated, the control unit 210 detects the processes establishing the network connection through the process detection unit 212 and collects process information on the detected processes (S317).

When the process information is received, the control unit 210 determines whether the detected process has an appropriate privilege by comparing with the predefined rights rules, and generates process privilege determination information on the determination result (S319). The process privilege may be an administrator, a general user, a system network working group privilege, a system privilege, or the like. Process authorization can be judged to be inadequate if the executed process has rights that it should not have. For example, if the processor has an administrator authority, the controller 210 may determine that the processor 210 has an unauthorized authority.

After determining the process rights, the control unit 210 extracts a process installation path through the process detection unit 212, determines whether the extracted path is installed in a normal installation path, and generates process installation path determination information (S321). Typically, the installation path is installed in a directory with a program file name. However, if it is installed under the system directory rather than the directory of the program file name, it can be judged as an abnormal installation path. Also, the legitimacy of the installation path is also associated with the process rights. If the process rights are system privileges, you will need to have an installation path under the system directory. However, if it is installed in any path other than the system directory in spite of the process having the system privilege, it can be judged that it is installed in an abnormal installation path.

After determining the process installation path, the control unit 210 extracts the process owner information through the process detection unit 212, determines whether the owner information is missing or false, generates the process owner verification information, (S323). For this, the process detection unit 212 should have information on the normal owners.

After the process owner verification, the controller 210 determines whether the attribute of the process is a hidden attribute, and generates and stores process attribute information, which is the result of the determination, in operation S325.

The process authorization information, the process installation path determination information, the process owner verification information, and the process attribute information are stored in the process information (S327).

When the process information is collected, the controller 210 reclassifies the collected network connection information and process information for each specific open port. Means a port frequently used in the specific open port hacking and the like, and the port definition for the specific open port hack should be made in advance in the agent (S329).

If the network connection information and the process information are reclassified for each specific port, the controller 210 refers to the exception information including the exception connection, the exception process, and the exception port stored in advance in the storage unit 220, And information included in the exception information among process information (S331).

After the removal of the exception information, the control unit 210 generates static pattern information including network connection information and process information that are reclassified by the port and the exception information is removed (S333) To the server unit 500 (S335).

In addition, the control unit 210 may detect the source IP of the network connection and the process through the IP analysis unit 215, and may transmit the IP information to the static pattern information (not shown).

FIG. 4 is a flowchart illustrating a user terminal remote access monitoring method of a user terminal remote access detection system according to the present invention, and is a flowchart illustrating a method of monitoring a user terminal remote access in the case of proceeding with agent installation in a login request web service.

Referring to FIG. 4, when the user terminal 200 accesses the web service server unit 500 and requests a login (S411), the web service server unit 500 determines whether an agent is installed in the user terminal 200 And transmits an agent installation request message (S413).

Upon receiving the agent installation request message, the user terminal 200 receives the agent installation request message and transmits an installation acceptance signal to the web service server unit 500 when the installation acceptance is performed by the user (S415). Then, the web service server unit 500 provides the agent installation program to the user terminal 200 (S417).

When the downloading of the agent install program from the web service server unit 500 is completed, the user terminal 200 drives the agent install program to install the agent and then drives it (S419).

When the agent is installed, the user terminal 200 generates static pattern information as described with reference to FIGS. 2 and 3 (S421), and transmits the generated static pattern information to the web service server unit 500 (S423).

When the static pattern information is transmitted from the user terminal 200, the web service server unit 500 retransmits the static pattern information including the unique identification information to the remote access monitoring server unit 600 (S425).

Upon receiving the service static pattern information, the remote access monitoring server unit 600 compares the network connection information and the process information of the received service static pattern information with the predetermined dynamic pattern information, and then remotely accesses the user terminal 200 If there is a remote access terminal or a remotely accessed terminal, it is determined whether the terminal is a legitimate remote access terminal or an illegal intruder (S427).

The remote access monitoring server unit 600 transmits non-intrusion determination information to the web service server unit 500 (S431). If it is determined that there is a remote intrusion, the remote access monitoring server unit 600 transmits the intrusion determination information to the web service server unit 500 (Step S433).

Upon receipt of the invasion determination information from the remote access monitoring server unit 600 after the transmission of the service static pattern information, the web service server unit 500 checks whether the invasion determination information is non-invasion determination information or invasion determination information, It is determined whether there is a remote intruder in the user terminal 200 requesting the web service of step S435.

If there is no remote intruder, the web service server unit 500 provides the requested web service to the user terminal 200 (S447).

On the other hand, if it is determined that there is a remote intruder, the web service server unit 500 loads a telephone number registered in advance for the logged-in user, and sends a personal identification request message to the communication terminal 400 of the user of the telephone number (S437).

After transmitting the request message, the web service server unit 500 determines whether a response message is received from the communication terminal 400 in step S445. If a response message is received, the web service requested by the user terminal 200 is provided (S447). If there is no response, the web service requested by the user is blocked (S449). That is, if there is no response, the web service server unit 500 does not provide the web service to the user terminal 200.

In the above description, the web service server unit 500 transmits the identity confirmation request message to the communication terminal 400 of the user and receives the response message from the communication terminal 400. However, (S437) after transmitting the identity confirmation request message to the user terminal 400 (S437), and transmits the identity verification information input request message to the user terminal 200 through the user terminal 200 It may receive confirmation information (S443) and perform identity verification. As described above, the identity verification request message may be a voice message, a short message service (SMS) message, or a multimedia message service (MMS) message. If the communication terminal 400 is a smart phone, the request message may be a push message through the agent. If the identity verification request message is an SMS message or an MMS message, the response message may be the same SMS / MMS message, or a voice message via a scenario of the ARS system or a button signal by pressing a telephone number button.

While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. It will be easily understood. It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, it is intended to cover various modifications within the scope of the appended claims.

100: remote access terminal 110, 300: computer terminal
120, 410: mobile communication terminal 200: user terminal
210: control unit 211: network connection inspection unit
212: Process detection unit 213: Port analysis unit
214: exception analysis unit 215: IP analysis unit
216: static pattern information generation unit 220:
230: input unit 240: display unit
250: communication unit 400: communication terminal
420: wired telephone terminal 500: web service server unit
600: remote access management server unit 610: dynamic pattern information DB

Claims (13)

delete Receiving an arbitrary web service request agent, receiving static pattern information including network connection information according to the agent provision and executed process information, and transmitting the static pattern information, receiving an intrusion determination result according to the static pattern information, A web service server unit for providing or blocking the requested web service according to the request;
A user terminal accessing the web service server unit, requesting the web service, receiving and installing an agent according to the web service request, collecting static pattern information by the agent, and providing the collected static pattern information to the web service server unit;
And a dynamic pattern information database for storing dynamic pattern information that is information on at least one of a legitimate remote accessor and an intruder, wherein when receiving the static pattern information from the web service server unit, the dynamic pattern information and the received static pattern information And a remote access monitoring server unit for determining whether a user requesting the web service through the user terminal is a legitimate user or an intruder and transmitting the determination result to the web service server unit,
The user terminal comprises:
A communication unit connecting to a wire / wireless data communication network and performing data communication with other devices connected to the wire / wireless data communication network;
A storage unit for storing the agent; And
And a control unit for collecting static pattern information by the agent and providing the static pattern information to the web service server unit through the communication unit.
3. The method of claim 2,
Wherein,
A network connection check unit for collecting network connection information in which state information of a network connection connected from the outside through the communication unit is a connected state;
A process detecting unit detecting a process that generates the collected network connection information and generating detected process information; And
And a static pattern information generating unit for generating static pattern information including the network connection information and the process information and transmitting the generated static pattern information to the web service server unit through a communication unit.
The method of claim 3,
Wherein,
A port analyzing unit for reclassifying the information detected and collected by the network connection checking unit and the process detecting unit by specific open ports;
Wherein the exception information includes exception information including an exception connection, an exception process, and an exception port, which are stored in advance, and a network connection included in the exception information among the information detected by the network connection checking unit and the process detecting unit, An exception analysis unit that excludes network connection and process information having the network connection and the process information from the information; And
Further comprising an IP analysis unit for detecting the network connection and the source IP of the process,
Wherein the static pattern information generation unit generates static pattern information including the information corresponding to the information included in the exception information and the information on which the exception information is excluded and the source IP information in the static pattern information. Terminal remote access detection system.
Receiving an arbitrary web service request agent, receiving static pattern information including network connection information according to the agent provision and executed process information, and transmitting the static pattern information, receiving an intrusion determination result according to the static pattern information, A web service server unit for providing or blocking the requested web service according to the request;
A user terminal accessing the web service server unit, requesting the web service, receiving and installing an agent according to the web service request, collecting static pattern information by the agent, and providing the collected static pattern information to the web service server unit;
And a dynamic pattern information database for storing dynamic pattern information that is information on at least one of a legitimate remote accessor and an intruder, wherein when receiving the static pattern information from the web service server unit, the dynamic pattern information and the received static pattern information And a remote access monitoring server unit for determining whether a user requesting the web service through the user terminal is a legitimate user or an intruder and transmitting the determination result to the web service server unit,
The web service server unit,
And transmits the identity confirmation request message to the communication terminal of the telephone number of the user registered in advance if the result of the determination is the intrusion determination information from the remote access monitoring server unit, And providing the web service.
6. The method of claim 5,
Wherein the communication terminal is a mobile communication terminal,
Wherein the identity confirmation request message and the response message are short message service messages.
6. The method of claim 5,
The web service server unit,
An automatic response system (ARS)
When an outbound call is originated to a communication terminal of a telephone number registered in advance for the user through the automatic answering system, a personal identification request message according to a scenario of the automatic answering system is voice- Message is input as a button signal of a voice or communication terminal, and the web service is provided according to whether or not the response message is received.
delete An agent installing process of downloading an agent from a web service server unit according to whether a user terminal accesses a web service server unit and installing an agent upon request of an arbitrary web service;
A static pattern collecting step of collecting static pattern information, which is information on a remote connection made by the user terminal, to the remote access monitoring server part by the installed agent when requesting an arbitrary web service;
The remote access monitoring server compares the received static pattern information with operation pattern information, which is information on at least one of legitimate remote accessors and intruders registered in advance, and determines whether the user requesting the web service through the user terminal is a legitimate user Detecting an intruder and transmitting the result; And
Wherein the web service server receives the result and provides or blocks the web service,
The static pattern collection process includes:
A network connection inspecting step of collecting network connection information which is established in a network connection externally connected through a communication unit;
A process information generation step of detecting a processor that has generated the collected network connection information and generating detected process information;
A static pattern information generation step of generating static pattern information including the network connection information and the processor information; And
And transmitting the static pattern information to the web service server unit through the communication unit.
10. The method of claim 9,
The static pattern collection process includes:
A port analyzing step of reclassifying the network connection information and the process information for each specific open port;
An exception analysis step of excluding information included in the exception information among the reclassified network connection information and process information with reference to exception information including a previously stored exception connection, an exception process and an exception port; And
Further comprising an IP analysis step of detecting a source IP of the detected network connection and a process,
The static pattern information generation step includes:
Wherein the static pattern information includes the port information and generates static pattern information excluding information included in the exception information.
11. The method according to claim 9 or 10,
In the process information generation step,
A process detecting step of detecting a processor that has generated the collected network connection information;
Judging whether or not the detected right is a normal right by comparing the detected right with the predefined right rules and generating a result of the judgment;
A normal installation path determination step of detecting path information in which the detected process is installed, determining whether the detected path is a normal installation path, and generating a determination result;
A process owner verification step of detecting owner information of the detected process, determining whether or not the owner information exists, comparing the information with information on legitimate owners, determining whether the owner is false, and generating the result information;
Determining whether an attribute of the detected process is hidden, and generating a result information; And
And a process information generating step of generating process information including the detected process information, process authorization determination result information, normal installation path determination information, owner verification information, and process hiding determination information. Way.
An agent installing process of downloading an agent from a web service server unit according to whether a user terminal accesses a web service server unit and installing an agent upon request of an arbitrary web service;
A static pattern collecting step of collecting static pattern information, which is information on a remote connection made by the user terminal, to the remote access monitoring server part by the installed agent when requesting an arbitrary web service;
The remote access monitoring server compares the received static pattern information with operation pattern information, which is information on at least one of legitimate remote accessors and intruders registered in advance, and determines whether the user requesting the web service through the user terminal is a legitimate user Detecting an intruder and transmitting the result; And
Wherein the web service server receives the result and provides or blocks the web service,
The service providing process includes:
Receiving an intrusion determination result from the remote access monitoring server unit;
A telephone number loading step of loading a previously registered telephone number of the user if the received intrusion determination result is intrusion determination information;
A personal identification request step of transmitting a personal identification request message to the communication terminal of the user's telephone number; And
And a web service providing step of providing the web service according to whether or not a response message to the identity confirmation request message is received.
The method according to claim 9 or 12,
Wherein the requested web service in the agent installation process is a login service and the web service in the static pattern collection process is an arbitrary web service provided by a web service server unit including a login service. .

Images