KR101648349B1 - Apparatus and method for calculating risk of web site - Google Patents

Abstract

Disclosed is a method for calculating the risk of a web site. According to an embodiment of the present invention, the method for calculating the risk of the web site includes: a step of collecting web contents included on a web site to be inspected; a step of inspecting whether the web contents includes at least one among a malicious script, an HTML vulnerable tag, and a blacklist URL corresponding to the risk of the web site; and a step of calculating the risk of the web site by using at least one among a risk factor included in the web contents, hierarchical information of a web page included in the web contents, and connection information of the web page included in the web contents.

Description

[0001] APPARATUS AND METHOD FOR CALCULATING RISK OF WEB SITE [0002]

The present invention relates to a web site risk calculation apparatus and method, and more particularly, to a web site risk calculation apparatus and method using web site content and a web site, And a web site risk calculation device and method thereof that can calculate a risk of a web site including the web site.

In recent years, malicious codes are spreading through various channels. The most widely used method is distribution through websites. In modern society, where the use of the Internet has become necessary, distribution of malicious code through websites is one of the most attractive and useful methods for the spreaders.

The security of websites depends on the availability of the company or organization that owns the website, but in general, all websites can be potential candidates for spreading malicious code.

This is because there is currently no technology to fully protect a Web site or server, and many Web sites are vulnerable to cracker attacks without minimal defense.

Therefore, in order to cope with the distribution of malicious codes through websites, many security companies are attempting to analyze web sites to measure various risks such as distribution of malicious codes and phishing, and to database them.

In addition, based on the database information of the web site risk information, there are a series of services that inform the users of the risk of the web site that they are currently accessing.

A new type of web site risk measurement method that can objectively measure the risk of multiple web sites has been needed to reflect this trend of technology development.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problems, and an object of the present invention is to provide a web site risk measurement method capable of scoring a risk of a web site by using an objective indicator.

It is another object of the present invention to provide a web site risk measurement method that allows a user to intuitively recognize a risk of a web site to which the user intends to access by assigning different ranks according to the web site risk.

The technical objects of the present invention are not limited to the above-mentioned technical problems, and other technical subjects not mentioned can be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided a method for calculating a web site risk, comprising the steps of: collecting web content included in a web site to be inspected; Tag, and blacklist URL of the web page, a risk factor included in the web content, a hierarchical information of the web page including the web content, and a link of the web page including the web content And calculating the risk of the web page using at least one of the information.

According to an embodiment of the present invention, the step of calculating the risk of the web page may include: providing a predetermined risk score corresponding to a risk factor included in the web content; A step of providing a predetermined risk score corresponding to the hierarchical information of the web page including the web content, and a risk score corresponding to the connection information of the web page containing the web content.

According to an embodiment of the present invention, the step of assigning predetermined risk scores corresponding to the risk factors included in the web content may include: when a plurality of risk factors included in the web content are present, And summing the set risk scores.

According to an embodiment of the present invention, the step of calculating the risk of the web page may include calculating a score of a score corresponding to the risk factor, a score corresponding to the hierarchical information, and a score corresponding to the connection information And calculating a risk level for the web page.

According to an embodiment of the present invention, a maximum risk score among risk factors related risk scores assigned to a plurality of web pages, a maximum risk score among hierarchical information related risk scores assigned to a plurality of web pages, and a plurality of web pages , The maximum risk score that can be given to the hierarchical information, and the maximum risk score that can be given to the connection information. And calculating a value obtained by dividing the sum of the sum of the plurality of web pages by the sum of the sum and the sum as a web site risk composed of the plurality of web pages.

According to an embodiment of the present invention, the method may further include the step of assigning a rating corresponding to the website risk to the website.

According to an embodiment of the present invention, the risk may be calculated by reflecting a weight corresponding to a past risk of the web site.

The web site risk calculation apparatus according to another embodiment of the present invention includes a collection unit for collecting web contents included in a check target web site, at least one of the collected malicious script, HTML vulnerable tag, and black list URL And a control unit configured to control at least one of a type of the inspection performed on the web content, a location of the web content, and connection information of the web page including the web content, And a web page risk calculator for calculating the web page risk.

According to an embodiment of the present invention, the web page risk calculation unit may assign a predetermined risk score corresponding to a risk factor included in the web content, and determine a risk score of the web page including the web content in a hierarchical structure of the web page A predetermined risk score corresponding to the hierarchical information is given, and a risk score corresponding to the connection information of the web page including the web content can be given.

According to an embodiment of the present invention, when a plurality of risk factors included in the web content are included, the web page risk calculation unit may sum predetermined risk scores corresponding to each risk factor.

According to an embodiment of the present invention, the web page risk calculation unit may multiply the score given in correspondence with the risk factor, the score given in correspondence with the hierarchical information, and the score given in correspondence with the connection information, Can be calculated.

According to an embodiment of the present invention, a maximum risk score among risk factors related risk scores assigned to a plurality of web pages, a maximum risk score among hierarchical information related risk scores assigned to a plurality of web pages, and a plurality of web pages , The maximum risk score that can be given to the hierarchical information, and the maximum risk score that can be given to the connection information. And a web site risk calculator for determining a value obtained by dividing the sum of the plurality of web pages by a value obtained by summing the sum as a web site risk composed of the plurality of web pages.

According to an embodiment of the present invention, the website risk calculation unit may assign a rating corresponding to the website risk to the website.

According to an embodiment of the present invention, the website risk calculator may calculate a risk of a web site by reflecting a weight corresponding to a past risk of the web site.

According to the web site risk calculation method according to the embodiment of the present invention, the risk of a web site can be scored using an objective indicator.

In addition, by assigning different grades according to the web site risk, the user can intuitively recognize the risk of the web site he or she intends to access.

1 is a functional block diagram illustrating a web site risk calculation apparatus according to an embodiment of the present invention.
FIG. 2 is a view for explaining a process of assigning a score corresponding to a risk factor included in a web page according to an embodiment of the present invention.
3 is a diagram for explaining a hierarchical structure of a Web site to be inspected according to an embodiment of the present invention.
4 is a view for explaining risk score information corresponding to hierarchical information of a web page according to an embodiment of the present invention.
5 is a view for explaining a method of assigning a risk score corresponding to connection information of a web page according to an embodiment of the present invention.
6 is a diagram for explaining a process of calculating a risk of a web page according to an embodiment of the present invention.
7 is a diagram illustrating a process of calculating a risk of a web site including a plurality of web pages according to an embodiment of the present invention.
FIG. 8 is a view for explaining a rating given to a web site according to an embodiment of the present invention.
9 is a flowchart illustrating a method of calculating a risk of a web site according to an embodiment of the present invention.
10 is a functional block diagram illustrating a web site risk calculation apparatus according to another embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

Also, the singular forms herein may include plural forms unless specifically stated in the text. It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions.

First, let us define the terms used in this specification.

Web Site: This is a meaningful bundle of Web pages that are displayed through a generic URL consisting of a domain name, an IP address, and a root path in an Internet Protocol-based network.

Web Page: It refers to each page constituting the Web site.

Web Contents: It refers to various texts, pictures, sound video files included in web pages.

1 is a functional block diagram illustrating a web site risk calculation apparatus according to an embodiment of the present invention.

The web site risk calculation apparatus 100 shown in FIG. 1 includes a collection unit 110, an inspection unit 120, and a risk calculation unit 130.

The collection unit 110 collects web contents included in the check target website. The collecting unit 110 according to an embodiment of the present invention can collect a plurality of web sites URLs to be checked to a crawler to collect web contents included in the web sites to be checked. , The crawler can collect the web content included in the web page according to the predetermined priority.

The inspection unit 120 checks whether the collected web content includes at least one of a malicious script, an HTML vulnerable tag, and a blacklist URL.

The inspection unit 120 according to an embodiment of the present invention generates a document object model (DOM) for collected web contents to check whether malicious script is included and determines whether malicious script is included . ≪ / RTI >

Specifically, if the hash value is extracted from the DOM information and compared with the previously stored hash value, if it is determined that the hash value extracted from the DOM information is different from the previously stored hash value, it can be determined that the malicious script is included in the web content.

The inspection unit 120 extracts the tag information from the document object model and can check whether the HTML weak tag is included in the web content. Specifically, it is possible to confirm whether or not the HTML vulnerable tag exists by comparing the signature of the previously stored HTML malicious tag with the tag information extracted from the document object model.

In addition, the checking unit 120 may compare the black list URL information with the URL information extracted from the web content to check whether the web content includes the URL registered in the black list.

However, the inspection that can be performed by the inspection unit 120 is not limited to this, and other tests such as script static analysis, behavior analysis, and the like may be additionally performed.

The web page risk calculation unit 130 may calculate the risk of the web page using at least one of the risk factors included in the web page, the hierarchical information of the web content, and the web page connection information including the web content.

A concrete method of calculating the risk of a web page by using the above-described information by the web page risk calculation unit 130 will be described in detail below.

FIG. 2 is a view for explaining a process of assigning a score corresponding to a risk factor included in a web page according to an embodiment of the present invention.

The web site risk checking apparatus 100 according to an exemplary embodiment of the present invention may further include a storage unit (not shown) for storing score information corresponding to a risk factor.

For example, if the inspection unit 120 determines that the web content included in the web page includes a URL registered in the black list as a result of performing a risk check on an arbitrary web page, the corresponding risk score is assigned can do.

In the present embodiment, since the risk score corresponding to the blacklist URL test is " 40 points ", a risk score " 40 "

Meanwhile, as a result of the inspection unit 120 performing a check on one web page, there may be a case where a plurality of risk factors are included in the web page. For example, one web page may include web content including HTML fragile tags and web content including blacklisted URLs.

In this case, the web site risk calculation unit 130 according to an embodiment of the present invention may calculate a risk score related to a risk factor by summing a plurality of scores corresponding to the risk factors.

For example, a score of "40" corresponding to "HTML Vulnerable Tag" and a score of "10" corresponding to "Blacklist URL" may be added together to give "50 points" as a risk score related to a risk factor.

The web page risk calculator 130 can not only assign a risk score corresponding to the risk factors included in the web page but also assign a risk score according to the position of the web page including the web content including the risk factors It is possible.

3 is a diagram for explaining a hierarchical structure of a Web site to be inspected according to an embodiment of the present invention.

The web site may have a hierarchical structure as shown in Fig. The first layer web page 310 is a web page displayed when the user accesses the representative URL of the web site.

The second layer of web pages 320 are web pages that can be accessed through the first layer web page 310. For example, after a user accesses the first layer web page 310 by inputting a representative URL, one of the second layer web pages 320 through the link included in the first layer web page 310 Can be linked to a web page.

The third tier web pages 330 are web pages that can be accessed through the second tier web pages 320. Likewise, the third layer web pages 330 may be linked through links included in the second layer web pages 320, and so on.

The web page risk calculation unit 130 according to an embodiment of the present invention may assign different risk scores to each hierarchy of web pages in which the risk factors are detected in consideration of the hierarchical structure of the web pages.

* The more frequently a web page belongs to the upper layer, the higher the frequency of access to the user, and the lower the frequency of access to a web page belonging to a lower layer.

To this end, the web site risk calculation apparatus according to an embodiment of the present invention may store risk score information corresponding to hierarchical information of a web page including a risk factor.

4 is a view for explaining risk score information corresponding to hierarchical information of a web page according to an embodiment of the present invention.

In the risk score information shown in Fig. 4, " one layer " is a web page displayed when a user accesses a web site through a representative URL. That is, the highest risk score is given because it is a web page having a high frequency of user access. On the other hand, since web pages belonging to a lower layer are web pages accessed through web pages of an upper layer, a lower score is given to a web page belonging to a lower layer.

For example, if the web page in which the web content containing the HTML vulnerable tag is located belongs to the " three-tier ", that web page is assigned a risk score of " 2.5 " On the other hand, if the web page in which the web content containing the HTML vulnerable tag is located is more than " five layers ", a risk score of " 0.625 "

Also, the web page risk calculation unit 130 according to an embodiment of the present invention may assign a risk score using the connection information of the web page.

5 is a view for explaining a method of assigning a risk score corresponding to connection information of a web page according to an embodiment of the present invention.

Here, the connection information of a web page refers to the number of paths that can flow into a web page for a specific web page. For example, the number of paths that can be connected through other Web pages of the same Web site, and the number of paths that can be connected through other Web sites may be added. The web page connection information described above can be measured through analysis of the document connection structure.

The higher the number of paths that can be introduced to a specific web page, the higher the risk score is given because the user is more likely to access the web page. If the number of paths is small, the user is less likely to access the web page.

Accordingly, the web site risk calculation apparatus 100 according to an embodiment of the present invention may store risk score information corresponding to connection information of a web site. For example, a relatively low risk score of "1 point" is given when there are one or two paths that can be connected to an arbitrary web page, and a relatively high risk score of "11 points" .

Hereinafter, the process of calculating the risk level for each web page using the risk score given through the above-described process will be described.

6 is a diagram for explaining a process of calculating a risk of a web page according to an embodiment of the present invention.

In the present embodiment, an example is described in which an arbitrary web page 610 includes web contents including URLs registered in the HTML vulnerable tag and the black list. In addition, the arbitrary web page 610 belongs to the " second layer " as shown in FIG. 6, and the number of paths that can be connected to the web page 610 is five.

When the inspection section 120 performs an inspection on an arbitrary web page 610, an " HTML vulnerable tag " and a " blacklist URL " are detected as a risk factor. Accordingly, since the web site risk calculation device 100 according to the embodiment of the present invention stores the risk score information corresponding to the risk factors, the risk score " 10 points " corresponding to "Quot; 50 points " obtained by adding " 40 " points corresponding to " list URL "

In addition, since the arbitrary page 610 in which the risk factor is detected is the web page belonging to the " second layer ", " 5 points "

Lastly, since the number of paths that can be connected to an arbitrary web page 610 is 5, " 2 points " is given using the information shown in Fig.

The web page risk calculator 130 according to an embodiment of the present invention calculates the risk for an arbitrary web page 610 by multiplying the risk score given through the process described above.

The equation is expressed as follows.

Therefore, the risk for any web page shown in FIG. 6 is calculated as 50 X 5 X 2 = 500 points.

However, the present invention is not limited to this. For example, the risk score may be added to the web page, or the risk score may be weighted. And a method of summing them.

When the risk for each web page is calculated through the above-described process, a plurality of sets of web pages can calculate the risk for the web site.

7 is a diagram illustrating a process of calculating a risk of a web site including a plurality of web pages according to an embodiment of the present invention.

The web site risk calculation apparatus 100 according to an embodiment of the present invention may further include a web site risk calculation unit (not shown) for determining a risk of a web site.

When the risk for each of the plurality of web pages constituting the web site is calculated through the processes described in Figs. 1 to 6, the web site risk calculator can calculate the risk of the web site using the calculated risk.

Specifically, the risk of a web site can be calculated through the following equation.

Here, the MRI (Max Risk Item) means the highest risk score among the risk scores given for the web page.

For example, if the first web page is given "50 points" and the second web page is given "30 points" and the third web page is given "70 points" in the risk score associated with the risk factor, The MRI associated with the " 70 points ".

Likewise, if "10 points" is assigned to the first web page, "2.5" points are assigned to the second web page, and "5 points" are assigned to the third web page in the risk score associated with the location information, Becomes " 10 points ".

If the risk score associated with the connection information is given a "1" point on one web page, a "three point" on the second web page, and a "2" point on the third web page, ".

Thus, the sum of the MRI scores is the sum of the maximum risk score assigned to the web page in relation to the risk factor, the maximum risk score assigned to the web page in relation to the location information, and the maximum risk score assigned to the web page in connection with the connection information It means one score.

Also, the " maximum score assigned to a risk factor " in the denominator in Equation 2 means the maximum risk score that can be given in relation to the risk factor. Referring to FIG. 7, it can be seen that the maximum risk score 710 that can be given in relation to the risk factor is " 40 points ".

Similarly, it can be seen that the maximum risk score 720 that can be given in relation to the position information is "10 points", and the maximum risk score 730 that can be given in connection with the connection information is "4 points".

On the other hand, the web site risk calculated through Equation (2) may be used to calculate a new risk by reflecting the risk calculated in the past for the web site. For example, a new risk can be calculated by reflecting the corresponding weight according to the risk calculated in the past.

If the risk of a website is calculated through the above-described process, a rating corresponding to the risk of the web site can be given according to the result.

FIG. 8 is a view for explaining a rating given to a web site according to an embodiment of the present invention.

The web site risk calculation apparatus 100 according to an embodiment of the present invention may assign a rating corresponding to the risk of the web site calculated in Fig. Accordingly, the web site risk calculation apparatus 100 may store the rating information shown in Fig.

However, the criterion to which the class is assigned is not limited to that shown in FIG. 8, and a more various class may be implemented by a more detailed criterion.

9 is a view for explaining a method for calculating a web site risk according to an embodiment of the present invention.

The collecting unit 110 collects the web contents included in the inspection target website (S910). Specifically, the crawler can collect a web content by assigning URLs of a plurality of websites.

When the collecting unit 110 collects web content, the checking unit 120 checks whether the web content includes at least one of a malicious script corresponding to a risk factor, an HTML vulnerable tag, and a blacklist URL (S920) .

In operation S930, the risk of the web page is calculated using at least one of the risk factors included in the web content, the hierarchical information of the web page including the web content, and the connection information of the web page including the web content. The specific method of calculating the risk of a web page using the above-described information has been described in detail with reference to FIG. 2 to FIG. 6, so that redundant description will be omitted.

10 is a view for explaining a web site risk calculation apparatus according to another embodiment of the present invention.

The web site risk calculation apparatus 1000 shown in FIG. 10 includes a processor 1010, a storage 1020, a memory 1030, a network interface 1040, and a bus 1050.

The processor 1010 executes a website risk calculation program. However, the program that can be executed in the processor 1010 is not limited thereto, and other general-purpose programs may be executed.

Storage 1020 stores a website risk calculation program. Information about the risk score corresponding to the risk factor, the risk score corresponding to the hierarchical information of the web page, and the risk score corresponding to the connection information of the web page may be stored in the storage 1020.

On the other hand, the web site risk calculation program stored in the storage 1020 includes a step of collecting web content included in the check target web site, a step of obtaining at least one of malicious script, HTML vulnerable tag, Checking at least one of the risk factors included in the web content, the hierarchical information of the web page including the web content, and the connection information of the web page including the web content, The step of calculating the risk of the web page is performed.

The memory 1030 loads the website risk calculation program. The website risk calculation program loaded into the memory 1030 is executed by the processor 1010. [

Other computing devices may be connected to the network interface 1040 and the bus 1050 may serve as a data movement path through which the processor 1010, the storage 1020, the memory 1030, and the network interface 1040 described above are connected .

Meanwhile, the above-described method can be implemented in a general-purpose digital computer that can be created as a program that can be executed by a computer and operates the program using a computer-readable recording medium. In addition, the structure of the data used in the above-described method can be recorded on a computer-readable recording medium through various means. The computer-readable recording medium includes a storage medium such as a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM,

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed methods should be considered from an illustrative point of view, not from a restrictive point of view. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (14)

Collecting web contents included in a check target website;
Performing a check as to whether the web content includes at least one of a malicious script corresponding to a risk factor, an HTML vulnerable tag, and a blacklist URL;
Calculating a risk of the web page by using at least one of a risk factor included in the web content, a hierarchy information of the web page including the web content, and a connection information of the web page including the web content; And
The highest risk score among the risk factors related to the plurality of web pages, the highest risk score among the risk information related to the hierarchical information related to the plurality of web pages, and the risk information related to the connection information given to the plurality of web pages A value obtained by dividing the sum of the maximum risk scores by a maximum risk score that can be given to the risk factors, a maximum risk score that can be given to the hierarchical information, and a maximum risk score that can be given to the connection information, Determining a web site risk consisting of web pages of the web site. The method according to claim 1,
Wherein the step of calculating the risk of the web page comprises:
Providing a predetermined risk score corresponding to a risk factor included in the web content;
Providing a predetermined risk score corresponding to hierarchical information of a web page including the web content in a hierarchical structure of the web page; And
And providing a risk score corresponding to the connection information of the web page including the web content. 3. The method of claim 2,
Wherein the step of assigning a predetermined risk score corresponding to a risk factor included in the web content comprises:
And summing predetermined risk scores corresponding to the respective risk factors when a plurality of risk factors included in the web content are included. 3. The method of claim 2,
Wherein the step of calculating the risk of the web page comprises:
Calculating a risk value for the web page by multiplying a score given in response to the risk factor, a score given in correspondence with the hierarchical information, and a score given in correspondence with the connection information. delete The method according to claim 1,
And assigning a rating corresponding to the website risk to the website. The method according to claim 6,
And calculating a risk of a web site by reflecting a weight corresponding to a past risk of the web site. A collection unit for collecting web contents included in a check target website;
An inspection unit for checking whether the collected web content includes at least one of a malicious script, an HTML vulnerable tag, and a blacklist URL;
A web page risk calculator for calculating a risk of the web page using at least one of a type of the check performed on the web content, a position of the web content, and connection information of the web page including the web content; And
The highest risk score among the risk factors related to the plurality of web pages, the highest risk score among the risk information related to the hierarchical information related to the plurality of web pages, and the risk information related to the connection information given to the plurality of web pages A value obtained by dividing the sum of the maximum risk scores by a maximum risk score that can be given to the risk factors, a maximum risk score that can be given to the hierarchical information, and a maximum risk score that can be given to the connection information, A web site risk calculator configured to determine a web site risk based on web pages of the web site. 9. The method of claim 8,
The web page risk calculator calculates,
A predetermined risk score corresponding to a risk factor included in the web content is given and a predetermined risk score corresponding to the hierarchical information of the web page including the web content is given in a hierarchical structure of the web page, The web site risk calculating unit assigns a predetermined risk score corresponding to the connection information of the web page including the web site. 10. The method of claim 9,
The web page risk calculator calculates,
A web site risk calculation device for summing predetermined risk scores corresponding to the respective risk factors when a plurality of risk factors included in the web content are included. 10. The method of claim 9,
The web page risk calculator calculates,
A web site risk calculation unit for calculating a risk for the web page by multiplying the score given in correspondence with the risk factor, the score given in correspondence with the hierarchical information, and the score given in correspondence with the connection information. delete 9. The method of claim 8,
The website risk calculator calculates,
And assigns a rating corresponding to the website risk to the website. 14. The method of claim 13,
The website risk calculator calculates,
And calculating a risk of the web site by reflecting the weight corresponding to the past risk of the web site.

Images