KR20190038524A - Method and apparatus for monitoring users of web server - Google Patents

Abstract

According to an embodiment of the present invention, a method for monitoring a web server comprises the steps of: identifying a first user based on a unique identification means entered by the first user when the first user connects to a web server; determining whether the identified first user matches a second user that is a true user of the identification means based on at least one of a plurality of pieces of connection information including at least one piece of detailed access information among the IP address, time, and day of week stored in the user DB, and probability information about movement between internal pages of the web server; and when the first user and the second user do not match, transmitting the user inconsistency information including the determination result to a preset contact person or the second user.

Description

[0001] METHOD AND APPARATUS FOR MONITORING USERS OF WEB SERVER [0002]

The present invention relates to a method and apparatus for monitoring an action of a web server user to detect an abnormal symptom.

If the member information (mainly user ID and password) of a website operated by a member is leaked to a malicious third party, the malicious third party may steal information of the normal member, access the website, . In addition, legitimate normal users may occasionally perform prohibited actions (eg, large database content hijacking).

Due to this problem, the administrator of the web site often confirms that the user is a normal user in addition to the ID and password. However, there is a case in which a normal user suffers difficulty in accessing the corresponding website (for example, throwing away the correct answer to the designated question), so that the administrator can not easily apply it.

Therefore, a statistical method and a machine learning method are applied to a normal web page connection pattern of each user to be used normally, and a profile of each user is generated. Then, a user action on the web server There is a need for a method and an apparatus for monitoring an abnormal symptom.

A related prior art is Korean Patent Registration No. 10-1456603 entitled " Network Traffic Monitoring System, published on Oct. 24, 2014).

It is an object of the present invention to provide a method and apparatus for monitoring a user behavior of a web server through a network in real time to detect an abnormal symptom.

According to another aspect of the present invention, there is provided a method for monitoring a web server, the method comprising the steps of: when a first user accesses a web server, Identifying a user; Based on at least one of a plurality of pieces of access information including at least one detailed access information among an IP address, a time and a day of the week stored in the user DB, and a plurality of pieces of movement information indicating a movement order between the pages of the web server, Determining whether a first user and a second user that are true users of the identification means coincide with each other; And transmitting the user inconsistency information including the determination result to a preset contact person or the second user when the first user and the second user do not match as a result of the determination.

Preferably, a plurality of DBs including at least one detailed DB information among the result data transmitted in correspondence with the at least one query and the number of queries, which is the number of times of at least one query transmitted to the system DB linked to the web server, When the utilization information is further stored in the user DB, the step of determining whether the second user is coincident may determine whether the first user and the second user are identical based on the DB utilization information.

Preferably, the DB utilization information includes at least one detailed DB information of the number of queries and the result data in units of each session, and when it is determined based on the DB utilization information, Wherein the step of determining whether a user is matched comprises: for a normal distribution based on an average and standard deviation of each of the at least one detailed DB information included in the DB utilization information, the number of queries during the first user's access session and the result And whether or not at least one of the data is included in the normal distribution is greater than a threshold probability.

Preferably, when determining based on the plurality of pieces of connection information, the step of determining whether the second users are mutually coinciding includes: calculating a frequency of each of the at least one detailed connection information included in the plurality of pieces of connection information; Calculating a membership value that is a value of a membership function corresponding to each of the detailed access information based on the frequency of each of the at least one detailed access information; And determining whether the first user and the second user coincide with each other using a membership value corresponding to each of the at least one detailed connection information included in the connection information for the connection of the first user .

Preferably, the step of determining whether the first user and the second user coincide using the membership value may include multiplying all the membership values for each of the at least one detailed access information to calculate an access information result value step; And determining whether the first user and the second user coincide with each other based on whether the connection information result value is equal to or greater than a predetermined first threshold value.

The step of calculating the frequency of each of the at least one detailed access information may further include calculating a frequency of each of the at least one detailed access information by dividing the frequency of each of the at least one detailed access information by a predetermined period, The membership value can be calculated by assigning a different weight to each period.

Preferably, when determining based on the plurality of pieces of movement information, the step of determining whether the second users are mutually coinciding includes: calculating a frequency of each of the at least one movement included in the plurality of pieces of movement information; Generating a state transition table indicating a probability of movement of the web server internal pages based on the frequency of each of the at least one movement; And determining whether the first user and the second user coincide with each other based on a Markov chain, the state transition table, and the movement between the inside of the web server during connection of the first user .

Preferably, the step of determining whether the first user and the second user coincide with each other based on the movement between the inside of the web server may include using the state transition table, Calculating movement information result values by multiplying all of the probability values; And determining whether the first user and the second user coincide with each other according to whether the movement information result value is equal to or greater than a predetermined second threshold value.

The plurality of pieces of connection information and the plurality of pieces of movement information may be generated by collecting login data connected to the web server and log data moved between the web server internal pages for a predetermined period.

According to another aspect of the present invention, there is provided a monitoring apparatus for a web server, the apparatus comprising: a monitoring unit configured to monitor, based on a unique identification unit input by the first user when the first user accesses the web server, An identification unit for identifying a first user; Based on at least one of a plurality of pieces of access information including at least one detailed access information among an IP address, a time and a day of week stored in the user DB, and a plurality of pieces of movement information indicating the order of movement between the web server internal pages, A judging unit for judging whether the first user and the second user who are the true users of the identification means are in agreement with each other; And a transmission unit for transmitting the user inconsistency information including the determination result to a preset contact person or the second user when the first user and the second user do not match as a result of the determination.

The present invention has the effect of detecting a user indicating an abnormal symptom by monitoring the user's action in the web server.

In addition, the present invention has an effect of separately detecting an anomaly in each step by dividing a user action on a web server into a connection analysis step, a usage pattern analysis step, and a database connection pattern analysis step.

1 is a flowchart illustrating a monitoring method of a web server according to an embodiment of the present invention.
2 is a flowchart illustrating a method of monitoring a web server according to another embodiment of the present invention.
FIG. 3 is a flowchart illustrating a method for determining whether a first user and a second user coincide with each other according to an exemplary embodiment of the present invention. Referring to FIG.
4 is a flowchart illustrating a method for determining whether a first user and a second user are in accordance with each other according to another embodiment of the present invention.
5 is a view for explaining a monitoring apparatus of a web server according to an embodiment of the present invention.
FIG. 6 is a diagram illustrating a connection relationship between a web server and a web server monitoring apparatus according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 7 is a diagram for explaining a threshold that serves as a criterion for determining whether a first user and a second user match with each other according to an embodiment of the present invention.
8A and 8B are diagrams for explaining a user's URL movement and state transition table according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a monitoring method of a web server according to an embodiment of the present invention.

In step S110, when the first user connects to the web server, the monitoring device identifies the first user based on the unique identification means entered when the first user connects.

Here, the web server is a system connected to a computer, a smart phone, a tablet PC, and the like through a wired or wireless network. For example, a web application server (WAS) server or an application server that includes the functions of a web server corresponds to a web server.

In addition, the unique identification means may be uniquely defined to identify each user in the web server. For example, the user ID and password may correspond to identification means for identifying each user.

For example, when the user information of each user and the ID of the user is stored in the user DB, when the first user logs in using the ID "A", the monitoring device displays the first user among a plurality of users stored in the user DB It can be identified as the user of the A ID.

In step S120, the monitoring apparatus displays a plurality of pieces of connection information including at least one detailed access information of the IP address, time and day of week stored in the user DB, and a plurality of pieces of movement information indicating the order of movement between pages of the web server And judges whether the identified first user and the second user, which is the true user of the identification means, are in agreement with each other.

For example, the connection information includes at least one of an Internet Protocol (IP) address such as IPv4 or IPv6, a time or a time period during which the connection is advanced, and a day of the connection, Information. In addition, the connection information may further include detailed connection information of the country where the connection acquired using the IP address is performed, and the device (PC, smartphone, tablet PC, etc.) on which the connection is made.

Also, the movement information may include information on the order of movement between pages of the web server after connection for each user's ID stored in the user DB. That is, when the web server is a web server including web pages of A, B and C, information on the movement order between the three web pages (for example, A to B, A to C, B to C, B to A , C in A, and C in B).

At this time, the plurality of pieces of connection information and the plurality of pieces of movement information stored in the user DB include a connection to the web server of the second user, which is a true user of the identification means (e.g., A ID) input by the first user, It can be assumed that it is generated using data on movement.

Then, the monitoring device compares at least one of the connection of the first user to the web server and the data of the movement between the web server pages with at least one of the plurality of pieces of connection information and the plurality of pieces of movement information stored in the user DB, 1 < / RTI > user is consistent with the second user.

A detailed method of determining whether the first user coincides with the second user will be described later in detail with reference to FIGS. 3 and 4.

In another embodiment, a plurality of pieces of connection information and a plurality of pieces of movement information may be generated by collecting login data connected to the web server and log data moved between pages of the web server for a predetermined period.

For example, a plurality of pieces of connection information can be generated by collecting login data connected to the web server during a learning period set for four weeks. At this time, a plurality of pieces of connection information can be generated for all or part of the user stored in the user DB. Specifically, login data can be collected from the IP address of the HTTP protocol, connection time, and connection day value.

Similarly, a plurality of pieces of movement information can be generated by collecting log data moved between pages of the web server during a learning period set for four weeks. That is, when the web server is a web server including web pages of A, B and C, log data moved between the three web pages (eg, A to B, A to C, B to C, B to A , A in C, and B in C). Specifically, log data can be collected from the requestURL and bodyparameter of the HTTP protocol.

In step S130, if the first user and the second user do not match as a result of the determination, the monitoring device transmits the user inconsistency information including the determination result to the preset contact person or the second user.

That is, if it is determined that the first user and the second user do not coincide with each other, the monitoring apparatus can transmit the user inconsistency information to the person in charge or the second user.

At this time, the user inconsistency information includes a result of the determination that the first user and the second user do not match, and also includes the login data (e.g., IP address, time, day of week) And may further include log data (e.g., movement history) moved between pages of the server.

On the other hand, the preset contact person may be an administrator of the web server, and when the user inconsistency information is transmitted, the contact person performs an appropriate action corresponding thereto (e.g., blocking the IP address of the first user from accessing the web server, 2 requesting the user to change the password). Further, when the second user also transmits the user inconsistency information, necessary measures such as changing the password can be taken.

As described above, the monitoring method of the web server according to the embodiment of the present invention has the effect of detecting the user indicating the abnormal symptom by monitoring the user activity on the web server.

2 is a flowchart illustrating a method of monitoring a web server according to another embodiment of the present invention.

In step S210, when the first user accesses the Web server, the monitoring device identifies the first user based on the unique identification means entered when the first user connects.

In step S220, the monitoring apparatus determines whether or not the monitoring apparatus has received a plurality of pieces of connection information stored in the user DB, a plurality of pieces of movement information, a number of inquiries that is the number of at least one query sent to the system DB linked to the web server, Determines whether the identified first user and the second user who is the true user of the identification means are in agreement based on at least one of the plurality of DB usage information including at least one detailed DB information of the transmitted result data.

That is, the monitoring apparatus determines whether the first user and the second user coincide with each other based on a plurality of DB utilization information including detailed DB information about at least one of the number of queries of the system DB and the result data linked to the web server It can be judged.

More specifically, the monitoring apparatus compares and analyzes the system DB usage pattern in normal use indicated by a plurality of DB usage information stored in the user DB and the system DB usage pattern of the first user, It is possible to judge whether or not they match.

For example, if the second user suddenly requests much more queries from the system DB than the normal user, the monitoring device sends a second query to the first user, It can be determined that the user is not a user. Details of this method will be described later in detail in the description of the other embodiments below.

Preferably, the detailed DB information included in the plurality of DB utilization information may be information on the number of queries and result data for specific data registered in advance. That is, the monitoring apparatus can selectively monitor the DB usage pattern for the user DB according to the importance of each data stored in the user DB.

On the other hand, the query count and result data of the system DB can be obtained by using the executeSql and resultCount functions for the SQL query corresponding to the query when the query to the system DB is performed.

Also, in order to determine whether the first user and the second user coincide with each other, the monitoring device generates a reference profile of a second user for the detailed DB information included in the plurality of DB use information, Can be compared.

For example, the monitoring device may generate a reference number of reference queries and a reference profile of result data by weighting each week for the latest n weeks. More specifically, the reference profile can be generated by setting the weight of the current attention to the highest. That is, when t is the current week, w _tn <w _tn-1 <... <w _t-1 <w _t , the weight for each week can be determined. At this time, the total sum of the weights for each week is 1.

In another embodiment, the monitoring device may use a normal distribution based on the mean and standard deviation of the at least one detailed DB information to determine whether the first user is in agreement with the second user.

Here, the normal distribution refers to a case where a variance X (for example, the number of queries or result data) having an average (m) and a standard deviation () has a probability density function of the following equation (1). More specifically, the monitoring apparatus calculates the average and standard deviation of the number of queries and the result data using the plurality of DB usage information, and determines whether the first user is in mutual agreement with the second user It can be judged. At this time, it is assumed that the number of inquiries and the result data for the same user follow a normal distribution.

[Equation 1]

Here, f (x) is a probability density function of the variable X, m is an average value of the variance X, and? Is the standard deviation of the variance X.

For example, if the monitoring device has a probability of 95.0% of the variance X within the range of ± 1.96σ of the mean m in the normal distribution, and if the threshold probability is 95.0%, the variance X within the range of m ± 1.96σ It can be determined that the second user coincides with the second user.

In yet another embodiment, the monitoring device generates a Gaussian mixed model using the mean and standard deviation of the detailed DB information, and uses the generated Gaussian mixed model to determine whether the first user interacts with the second user It is possible to judge whether or not they match.

At this time, the Gaussian mixture model may include a plurality of Gaussian distributions (normal distributions) based on the average and standard deviation of the detailed DB information. The detailed DB information may be the number of queries of a specific SQL function (e.g., resultCount) and information on result data.

More specifically, the monitoring apparatus calculates the distribution of the average value of the number of queries of the resultCount function for a predetermined time, and when the probability distribution is two or more, the average value of the number of queries (n number of queries) It is possible to judge whether the first user is in agreement with the second user by judging whether or not one of the two Gaussian distributions satisfies the following expression (2).

&Quot; (2) &quot;

는 일정한 시간 동안 resultCount함수의 질의횟수의 평균값이다.Where, μ _i is the mean of a plurality of Gaussian distribution of the i-th distribution, and Z _{α / 2} is the normal Gaussian value of α significance level, σ _i is the standard deviation of the i-th distributed plurality of Gaussian distribution, n is the query The number of times (samples)

Is the average value of the number of queries of the resultCount function over a certain period of time.

Meanwhile, each DB utilization information can be generated by collecting at least one detailed DB information among the number of queries and result data for each session. In this case, a session refers to a state where a computer and a computer are logically connected to each other on a network, and a session may be terminated when a physical or logical connection is terminated.

In step S230, if the first user and the second user do not match as a result of the determination, the monitoring device transmits the user inconsistency information including the determination result to the preset contact person or the second user.

FIG. 3 is a flowchart illustrating a method for determining whether a first user and a second user coincide with each other according to an exemplary embodiment of the present invention. Referring to FIG.

In step S310, the monitoring device calculates the frequency of each of the at least one detailed access information included in the plurality of access information.

For example, the monitoring device can calculate the frequency of detailed access information of the IP address. That is, if there are 20 connections in total and the connection is performed through 3 IP addresses in total, the monitoring device can calculate the frequency of detailed connection information as shown in Table 1.

IP address 128.125.103.3 128.125.323.8 128.125.333.5 frequency One 14 5

Also, if there are 20 connections in total, and the connection is divided by the day of the week, the monitoring device can calculate the frequency of detailed connection information as shown in Table 2.

Connection day Work month anger Number neck gold Sat frequency 0 4 3 10 2 One 0

In addition, a total of 20 connections were made, and the monitoring device could calculate the frequency of detailed connection information as shown in Table 3 if the connection time is divided by 2 hours.

Access time 0 2 4 6 8 10 frequency 0 0 0 0 5 2 Access time 12 14 16 18 20 22 frequency 2 4 5 2 0 0

In step S320, the monitoring device calculates a membership value, which is a value of a membership function corresponding to each of the detailed connection information, based on the frequency of each of the at least one detailed connection information.

The membership function is a function used in the fuzzy theory or the like and indicates the degree of truth of an element as a value between 0 and 1. In addition, the membership value indicates to what extent the membership of the detailed connection information belongs to the value.

That is, the monitoring device can generate the membership function using the frequency of each of the at least one detailed access information, and calculate the membership value corresponding to each detailed access information from the function.

At this time, the membership value used in the present invention can be expressed by Equation (3).

&Quot; (3) &quot;

Herein, m _ij is a membership value, i is an index of at least one detailed access information, I _max is a total number of types of detailed access information, ij is an index indicating a jth category in the i-th detailed access information, , N ⁱ _max is a sum of values included in the i-th detailed access information, α _i is a membership value assigned when the frequency of the specific information (j) is 0 in the i-th detailed access information, and β ⁱ _min is i I is the membership value assigned to the index with the smallest frequency among the values included in the i-th detailed access information, and? ^I _max is a membership value (here, 1) assigned to the index having the greatest frequency among the values included in the i- to be.

For example, referring to Tables 1 to 3, I _max is 3, including IP address, day and time, N ¹ _max corresponding to Table 1 is 3, N ² _max corresponding to Table 2 is 7, N ³ _max corresponding to Table 3 is 12,? Is 0.1,? _Min is 0.5, beta _max is one. In addition, each membership value is calculated by Equation (3).

At this time,? And? _Min are determined as shown in Table 4 according to I _max .

I _max 2 3 4 5 alpha 0.1 0.1 0.1 0.05 β _min 0.4 0.5 0.6 0.65

Therefore, the membership values corresponding to the frequencies of detailed access information (Tables 1, 2 and 3) are calculated as shown in Tables 5, 6 and 7 by? And? _Min of Equation 3 and Table 4 (I _max = 3) .

IP address 128.125.103.3 128.125.323.8 128.125.333.5 frequency One 14 5 Membership Value 0.5 One 0.75

Connection day Work month anger Number neck gold Sat frequency 0 4 3 10 2 One 0 Membership Value 0.1 0.875 0.75 One 0.625 0.5 0.1

Access time 0 2 4 6 8 10 frequency 0 0 0 0 5 2 Membership Value 0.1 0.1 0.1 0.1 One 0.5 Access time 12 14 16 18 20 22 frequency 2 4 5 2 0 0 Membership Value 0.5 0.75 One 0.5 0.1 0.1

In another embodiment, the monitoring device may assign a different weight to a predetermined period of time to calculate the membership value.

For example, the monitoring device may calculate the membership value by assigning a different weight to each week for a period of two weeks. At this time, Table 8 shows the membership value of last week, and Table 9 shows the membership value of this week

IP address a b c Frequency (x _t-1 ) One 14 5 Membership Value 0.5 One 0.75

IP address a b c Frequency (x _t ) 3 8 9 Membership Value 0.5 0.75 One

At this time, the monitoring device can calculate the membership value as shown in Table 10 by assigning weights of 0.3 and 0.7 to the frequencies of the last week and the present week, respectively. On the other hand, a greater weight is given to the frequency of this week, because the closer the data is to the present, the more accurately the user's tendency is reflected. This calculation method uses Equation (4).

IP address a b c Frequency (0.7 * x _t + 0.3 * x _t-1 ) 2.4 9.8 7.8 Membership Value 0.5 One 0.75

&Quot; (4) &quot;

Here, p _t is a frequency indicating a result of being given a different weight, T is a total number of periods in which a different weight is given, t i is an i th whole period from today, w _i is a difference X _i is the frequency for the i-th period, and i and j are relationships where i > j.

In step S330, the monitoring device uses the membership value corresponding to each of the at least one detailed connection information contained in the connection information for the connection of the first user to determine whether the first user and the second user are in agreement with each other.

For example, referring to Equation (3), the membership value for each of the values of the detailed connection information is proportional to the frequency. Therefore, the larger the membership value of the detailed access information, the greater the possibility that the first user and the second user coincide with each other. This is because the connection pattern of the first user to the web server is close to the connection pattern of the second user to the web server.

In another embodiment, the monitoring device may calculate connection information result values to determine if the first user and the second user are in agreement.

The connection information resultant value can be calculated by Equation (5). That is, if each detailed access information on the connection of the first user is given, it can be calculated by using this information, obtaining membership values for each detailed information index, and multiplying them by m _i .

&Quot; (5) &quot;

Wherein, R _c is a connection information result value, k is the number of detailed access information, _i m is the membership value of the i-th detailed contact information for a contact of the first user.

Then, the monitoring apparatus compares the calculated connection information result value with a predetermined first threshold value to determine whether the first user and the second user coincide with each other. For example, when the result of the connection information is equal to or greater than the first threshold, if the first user coincides with the second user and the result of the connection information is less than the first threshold, It can be determined that the user is a user.

On the other hand, the first threshold value can be determined in the range of the following expression (6).

&Quot; (6) &quot;

Here,? Is a first threshold value,? Is a membership value assigned when the frequency corresponding to the value included in the detailed connection information is 0, and? _Min is allocated when the frequency among the values included in the detailed access information is minimum Membership value, and β _max is a membership value (here, 1) assigned when the frequency among the values included in the detailed connection information is the maximum.

That is, the first threshold value may be determined between? And?, And preferably, the average value may be determined as? +? / 2.

For example, if the first threshold value determining equation (? +?) / 2 and the? In Equation 6 are applied to I _max ,?, And? _Min in Table 4,

I _max 2 3 4 5 alpha 0.1 0.1 0.1 0.05 θ 0.13 0.113 0.115 0.083 gamma 0.16 0.125 0.1296 0.117 β _min 0.4 0.5 0.6 0.65

4 is a flowchart illustrating a method for determining whether a first user and a second user are in accordance with each other according to another embodiment of the present invention.

In step S410, the monitoring device calculates the frequency of each of the at least one movement included in the plurality of pieces of movement information.

For example, referring to FIG. 8A, the monitoring apparatus can calculate a frequency of moving from a specific web page (news.naver.com) to each of other web pages. That is, the monitoring device can calculate all the frequencies of moving from the particular web page to another web page that can be moved through the web page. Movement between web pages can occur when a user clicks a link on a screen displayed in a web browser using a mouse.

In step S420, based on the frequency of each of the at least one move, the monitoring device generates a state transition table in which a second user indicates a probability of movement between pages of the web server.

For example, referring to FIG. 8B, the monitoring device may use the frequency of each of its at least one move to generate a state transition table for each move. That is, the probability of moving from www.naver.com to news.naver.com is 0.2153, and the probability of moving from new.naver.com to sports.news.naver.com/main/index.nhn is 0.0508.

At this time, each probability included in the state transition table is a denominator which is a denominator of the sum of the frequencies of moving from the specific web page A to the other web pages A ₁ , A ₂ , A ₃ , and A _{4 connected} thereto, To A ₁ , A ₂ , A ₃ , and A ₄ , respectively. For example, assuming that the frequencies from A to A ₁ , A ₂ , A ₃ and A ₄ are 50, 50, 200 and 100, respectively, the probability of moving from A to A ₁ , A ₂ , A ₃ and A ₄ 50/400, 50/400, 200/400, 100/400.

At this time, if there is a web page A ₅ connected from the web page A, but the frequency at which the monitoring device moves from A to A ₅ is 0, in order to prevent the probability value to be calculated by multiplying in the future, Specify the number as a constant.

In step S430, the monitoring device determines whether the first user and the second user coincide based on a Markov chain, a state transition table, and a movement between the web server pages during connection of the first user.

The Markov chain can represent a random process that transitions from one state to another. At this time, the respective transition processes do not affect each other and are independent. In particular, the Markov chain expresses continuous motion as a product of probabilities.

At this time, the movement (x ₁ , x ₂ , ..., x _t-1 ) between the web server pages by the first user is time T = 1, ₂ , ..., x _t-1 using the Markov chain. , the probability of occurrence at t is calculated as shown in Equation (7) below.

&Quot; (7) &quot;

P is the probability of total movement between Web server pages by the first user, T is the number of movements within the web server by the first user, P (x ₁ ) and the _{probability, P (x i + 1 |} x i) x _i is the incident x _{i + 1} case (web page) probability to occur when the generated Web pages.

For example, when the first user moves through the web page T times, P (x ₁ ) is the probability of the initial screen appearing, and P (x _{i + 1} | x _i ) The probability of moving from the previous x _i web page to the x _{i + 1} web page. That is, moving a web page can be applied to a Markov chain since the previous move has no effect on the next move.

Then, the monitoring apparatus obtains information on the probability that the monitoring apparatus moves from the respective x _i web pages to the x _{i + 1} web pages in the state transition table, and calculates the probability of the movement of the web server pages by the first user . In addition, the probability that the initial screen P (x ₁ ) appears may be one. The monitoring apparatus can determine whether the first user and the second user coincide using the calculated probability.

In another embodiment, the monitoring device may calculate movement information result values to determine if the first user and the second user are in agreement.

For example, when the first user moves the web page through T times, the monitoring device obtains the probabilities corresponding to the respective movements from the state transition table, multiplies all of the obtained probabilities, and calculates the movement information resultant value .

Then, it is possible to determine whether the first user and the second user coincide with each other according to whether the movement information result value is equal to or greater than a predetermined second threshold value. For example, when the movement information resultant value is equal to or greater than the second threshold, when the first user coincides with the second user and the movement information resultant value is less than the second threshold, It can be determined that the user is a user.

On the other hand, the second threshold value can be determined in the range of the following equation (8).

&Quot; (8) &quot;

Here,? Is a second threshold value,? _J is a value given when there is no probability corresponding to the movement in the state transition table, and all? _{J =} ?, And? _{Min i} is i Is the smallest probability value in the state transition table corresponding to the i &lt; th &gt; movement, [pi] _maxi is the largest probability value in the state transition table corresponding to the i-th movement, and N is the number of movements between the web server pages of the first user .

을 만족해야 하기 때문에,

의 형태로 지정하는 것이 바람직하다. 따라서, 아래 수학식 9를 얻을 수 있다.The second threshold can be determined in the range of the following equation (9). At this time, according to Equation (8),?

Lt; / RTI &gt;

It is preferable to designate it in the form of. Therefore, the following equation (9) can be obtained.

&Quot; (9) &quot;

Referring to FIG. 7, the movement information result value calculated by the monitoring apparatus and the second threshold value may be compared with each other, and the determination result may be calculated using the warning level of five levels.

If the first step (normal) is larger than the smallest value among the result values that can be judged as a correct user, the detection result and the action log data can be stored in the DB.

The second stage (interest) is a case in which the detection result value of each model has a value within 67-100% from the second threshold value, and the detection result and activity log data can be notified to the administrator and stored in the DB.

 Step 3 (Note) is a case where the detection result value of each model has a value within 34 to 66% from the second threshold value, and the detection result and activity log data can be notified to the administrator and stored in the DB.

Step 4 (boundary) is a case in which the detection result value of each model has a value within 0 ~ 33% from the second threshold value, and the detection result and activity log data can be notified to the administrator and stored in the DB.

Step 5 (serious) is a case in which the detection result value of each model has a value smaller than the second threshold value range, and the detection result and action log data can be notified to the administrator and stored in the DB.

5 is a view for explaining a monitoring apparatus of a web server according to an embodiment of the present invention.

Referring to FIG. 5, the web server monitoring apparatus 500 according to an embodiment of the present invention may include an identification unit 510, a determination unit 520, and a transmission unit 530.

Meanwhile, the monitoring device 500 of the web server may be directly connected to the web server, or may be installed in a server connected to the web server by wired or wireless, a PC, a smart phone, and a tablet PC.

6, when a first user 603 and a second user 606 connect to a web server 609 (e.g., a WAS server), the agent 612 sends a request to the first user 603 And login log data for the web server 609 of the second user 606 and movement log data in the web server 609 in the user DB 615. [ The server 618 on which the monitoring device 500 of the web server is installed uses the data stored in the user DB 615 to determine whether the first user 603 and the second user 606 coincide with each other . Then, the result can be transmitted to the person in charge 621.

The identification unit 510 identifies the first user 603 based on the unique identification means that the first user 603 has accessed when the first user 603 connects to the web server 609 .

The determination unit 520 determines a plurality of access information including at least one detailed access information among the IP address, the time and the day of the week stored in the user DB 615 and the order in which the pages within the web server 609 are moved And determines whether the identified first user 603 and the second user 606, which are the true users of the identification means, coincide with each other.

If the first user 603 and the second user 606 do not coincide with each other as a result of the determination, the transmitting unit 530 notifies the predetermined person in charge 621 or the second user 606, And transmits inconsistency information.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The computer readable recording medium includes a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM, DVD, etc.).

The present invention has been described with reference to the preferred embodiments.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (9)

Identifying the first user based on unique identification means entered by the first user when the first user connects to the web server;
Based on at least one of a plurality of pieces of connection information including at least one detailed access information among the IP address, time, and day of week stored in the user DB, and probability information about movement between the web server internal pages, Determining whether a second user who is a true user of the identification means is in agreement with each other; And
When the first user and the second user do not coincide with each other, transmitting the user inconsistency information including the determination result to a preset contact person or the second user
Lt; / RTI &gt;
When judging based on the plurality of pieces of connection information,
The step of determining whether the second users are mutually coincident
Calculating frequency of each of at least one detailed access information included in the plurality of access information;
Calculating a membership value that is a value of a membership function corresponding to each of the detailed access information based on the frequency of each of the at least one detailed access information; And
Determining whether the first user and the second user coincide with each other using a membership value corresponding to each of at least one detailed connection information included in the connection information for connection of the first user
And monitoring the web server. The method according to claim 1,
A plurality of DB utilization information including at least one detailed DB information among a query number which is the number of queries transmitted to the system DB linked to the web server and result data transmitted corresponding to the at least one query, When stored further in the user DB,
The step of determining whether the second user is coincident
Further comprising determining whether the first user matches the second user based on the DB usage information. 3. The method of claim 2,
Wherein the DB utilization information includes at least one detailed DB information of the number of inquiries and the result data in each session, and when it is determined further based on the DB utilization information,
The step of determining whether the second user is coincident
Wherein at least one of the number of queries and the result data during a first user's connection session is a normal distribution based on an average and a standard deviation of each of at least one detailed DB information included in the DB utilization information, And determining whether or not the probability of being included in the web page is greater than a threshold probability. The method according to claim 1,
The step of determining whether the first user and the second user coincide using the membership value
Calculating connection information result values by multiplying all the membership values for each of the at least one detailed access information; And
Determining whether the first user and the second user coincide with each other according to whether the connection information result value is equal to or greater than a predetermined first threshold value
And monitoring the web server. The method according to claim 1,
When the frequency of each of the at least one detailed access information is calculated by dividing the frequency of each of the at least one detailed access information by a predetermined period,
The step of calculating the membership value
Wherein the membership value is calculated by assigning a different weight to each predetermined period. Identifying the first user based on unique identification means entered by the first user when the first user connects to the web server;
Based on at least one of a plurality of pieces of connection information including at least one detailed access information among the IP address, time, and day of week stored in the user DB, and probability information about movement between the web server internal pages, Determining whether a second user who is a true user of the identification means is in agreement with each other; And
When the first user and the second user do not coincide with each other, transmitting the user inconsistency information including the determination result to a preset contact person or the second user
Lt; / RTI &gt;
When judging based on the probability information,
The step of determining whether the second users are mutually coincident
Calculating a frequency of each of the at least one movement included in the information about movement between the web server internal pages;
Generating a state transition table indicating a probability that the second user moves between the internal pages of the web server based on the frequency of each of the at least one movement; And
Determining whether the first user and the second user coincide based on a movement between a Markov chain, the state transition table, and an internal page of the web server during connection of the first user
And monitoring the web server. The method according to claim 6,
Determining whether the first user and the second user coincide based on the movement between the web server internal pages,
Calculating a movement information result value by multiplying all probability values corresponding to movements between the internal pages of the web server by using the state transition table; And
Determining whether the first user and the second user coincide with each other according to whether the movement information result value is equal to or greater than a predetermined second threshold value
And monitoring the web server. The method according to claim 1,
The plurality of pieces of connection information and the probability information
Wherein the login information is generated by collecting login data connected to the web server and log data moved between the web server internal pages for a predetermined period. An identification unit for identifying the first user based on a unique identification unit input by the first user when the first user accesses the web server;
Based on at least one of a plurality of pieces of connection information including at least one detailed connection information among an IP address, a time and a day of week stored in the user DB, and probability information about movement between inner pages of the web server, And a second user who is a true user of the identification means are mutually coincident with each other; And
If it is determined that the first user and the second user do not coincide with each other, a transmission unit that transmits user inconsistency information including the determination result to a preset contact person or the second user
Lt; / RTI &gt;
When the determination unit determines that the second users are mutually consistent based on the probability information,
Calculating a frequency of each of at least one movement included in the information about the movement between pages in the web server,
Generating a state transition table indicating a probability that the second user moves between the internal pages of the web server based on the frequency of each of the at least one movement,
Characterized in that it is determined whether the first user and the second user coincide with each other based on a movement between a Markov chain, the state transition table, and an internal page of the web server during connection of the first user A monitoring device for a web server.

Images