KR20240009302A - Electronic apparatus and method for analyzing http traffic thereby - Google Patents

Abstract

Extracting header information including at least one of host information, URL information, and method information from the header of the HTTP message; Selecting a parsing tool corresponding to extracted header information from among a plurality of parsing tools; and extracting content from the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool. A method for analyzing HTTP traffic according to an embodiment is disclosed.

Description

Electronic device and method of analyzing HTTP traffic thereby {ELECTRONIC APPARATUS AND METHOD FOR ANALYZING HTTP TRAFFIC THEREBY}

This disclosure relates to traffic analysis. More specifically, the present disclosure relates to an apparatus and method for extracting and analyzing content of HyperText Transfer Protocol (HTTP) traffic on a network.

As network technology has developed dramatically, services that were mainly performed offline, such as document work, are now being performed online. Since many services such as file upload/download, email, chat, and document editing are performed online, efficient network security is required.

Network security has evolved from the existing method of access control using only packet header information (IP protocol information) to a method of inspecting the payload of the packet (e.g., IDS (Intrusion Detection System)/IPS (Intrusion Preventing System)). Furthermore, it has developed into a method of inspecting the headers of L7 (layer 7) protocols such as HTTP, represented by web firewalls.

Recently, since most network services are based on HTTP, there is a need to go further than the web firewall method that simply inspects HTTP headers.

The purpose of an electronic device and a method of analyzing HTTP traffic using the same according to an embodiment is to effectively analyze HTTP messages from various service providers.

Additionally, an electronic device and a method of analyzing HTTP traffic using the same according to an embodiment aim to prevent personal information and corporate information from being leaked by extracting and analyzing content within an HTTP message.

The problems to be solved by the present invention are not limited to those mentioned above, and other problems not mentioned can be clearly understood by those skilled in the art from the description below.

A method of analyzing HTTP traffic by an electronic device according to an embodiment includes at least one of host information, URL (Uniform Resource Locator) information, and method information from the header of an HTTP (HyperText Transfer Protocol) message. extracting header information including one; selecting a parsing tool corresponding to the extracted header information from among a plurality of parsing tools; And it may include extracting content from the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool.

In one embodiment, different parsing rules may be set for each of the plurality of parsing tools.

In one embodiment, the parsing rule includes one or more keys, and the extracting step includes: identifying text corresponding to the one or more keys in the content; And it may include extracting the value of the identified text.

In one embodiment, the parsing rule further includes a processing option, and the method of analyzing HTTP traffic may further include processing the extracted value according to the processing option.

In one embodiment, the processing options include an option to output the value, if the value is a specific string, an option to convert it to another specified string and output it, split the value with a delimiter, and format the divided values into an array format. It may include an option to save the value, or an option to extract the value through regex (regular expression) grammar.

In one embodiment, the method for analyzing HTTP traffic may further include, when the content is encoded, decoding the encoded content according to a decoding method corresponding to the encoding method of the content.

In one embodiment, the method of analyzing HTTP traffic may further include outputting the extracted content through a display.

In one embodiment, the HTTP message is a message transmitted and received between a client device and a server, and the method of analyzing the HTTP traffic includes, when the extracted content corresponds to leak prevention content, a message transmitted and received between the client device and the server. A step of blocking messages may be further included.

In one embodiment, when the HTTP message is a request related to translation, the text to be translated from the body according to the parsing rule, and information indicating the language of which country the text after translation is extracted as the content , If the HTTP message is a response related to translation, the text corresponding to the translation result from the body according to the parsing rule, and information indicating the language of which country the text to be translated is can be extracted as the content. there is.

In one embodiment, when the HTTP message is a request related to mail transmission, sender information, recipient information, mail title, and mail content may be extracted from the body according to the parsing rule as the content.

An electronic device according to an embodiment includes a memory that stores one or more instructions; And a processor operating according to the one or more instructions, wherein the processor receives host information, URL (Uniform Resource Locator) information, and method information from the header of the HTTP (HyperText Transfer Protocol) message. extract header information including at least one of the following, select a parsing tool corresponding to the extracted header information among a plurality of parsing tools, and extract the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool. Content can be extracted from .

In one embodiment, different parsing rules may be set for each of the plurality of parsing tools.

In one embodiment, the parsing rule includes one or more keys, and the electronic device can identify text corresponding to the one or more keys in the content and extract the value of the identified text.

In one embodiment, the parsing rule further includes a processing option, and the electronic device can process the extracted value according to the processing option.

An electronic device and a method for analyzing HTTP traffic using the same according to an embodiment can effectively analyze HTTP messages from multiple service providers.

Additionally, an electronic device and a method of analyzing HTTP traffic using the same according to an embodiment can prevent personal information and corporate information from being leaked by extracting and analyzing content within an HTTP message.

The effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

FIG. 1 is a diagram illustrating a client device, a server, and an electronic device for analyzing HTTP traffic, according to an embodiment.
Figure 2 is a flowchart showing a method of analyzing HTTP traffic by an electronic device according to an embodiment.
Figure 3 is a table showing the correspondence between header information and a parsing tool according to an embodiment.
Figure 4 is a diagram illustrating an HTTP message according to one embodiment.
FIG. 5 is a diagram illustrating a filter rule for extracting header information from the HTTP message shown in FIG. 4 and header information extracted according to the filter rule.
FIG. 6 is an exemplary diagram illustrating a method of extracting content from the body of the HTTP message shown in FIG. 4 according to a parsing rule.
FIG. 7 is a diagram illustrating content extracted through the parsing process shown in FIG. 6.
Figure 8 is an example diagram for explaining a method of extracting content from the body of an HTTP message according to parsing rules.
FIG. 9 is a diagram illustrating content extracted through the parsing process shown in FIG. 8.
Figure 10 is a diagram illustrating an HTTP message according to one embodiment.
FIG. 11 is a diagram illustrating a filter rule for extracting header information from the HTTP message shown in FIG. 10, and header information extracted according to the filter rule.
FIG. 12 is a diagram illustrating a filter rule for extracting content from the HTTP message shown in FIG. 10.
FIG. 13 is a diagram showing the body of the HTTP message shown in FIG. 10.
FIG. 14 is a diagram illustrating content extracted from the body of the HTTP message shown in FIG. 13 according to the filter rule shown in FIG. 12.
Figure 15 is a block diagram showing the configuration of an electronic device according to an embodiment.

Since the present disclosure can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail through detailed description. However, this is not intended to limit the embodiments of the present disclosure, and the present disclosure should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the various embodiments.

In describing the embodiments, if it is determined that detailed descriptions of related known technologies may unnecessarily obscure the gist of the present disclosure, the detailed descriptions will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of the specification are merely identifiers to distinguish one component from another component.

In addition, in this specification, when a component is referred to as "connected" or "connected" to another component, the component may be directly connected or directly connected to the other component, but specifically Unless there is a contrary description, it should be understood that it may be connected or connected through another component in the middle.

In addition, in this specification, components expressed as 'unit (unit)', 'module', etc. are two or more components combined into one component, or one component is divided into two or more components for each more detailed function. It may be differentiated into In addition, each of the components described below may additionally perform some or all of the functions of other components in addition to the main functions that each component is responsible for, and some of the main functions of each component may be different from other components. Of course, it can also be performed exclusively by a component.

FIG. 1 is a diagram illustrating a client device 10, a server 20, and an electronic device 100 for analyzing HTTP traffic, according to an embodiment.

Referring to FIG. 1, the client device 10 and the server 20 can transmit and receive an HTTP message 30 through a network.

In one embodiment, the client device 10 may include various types of devices such as smartphones, desktop PCs, laptops, tablet PCs, and servers that can be connected to the server 20 through a network.

In one embodiment, the network may include a wired network and a wireless network. For example, the network may include various networks such as a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN). Additionally, the network may include the known World Wide Web (WWW). However, the network according to the embodiment of the present disclosure is not limited to the networks listed above, and may include at least some of a known wireless data network, a known telephone network, and a known wired and wireless television network.

The HTTP message 30 transmitted and received between the client device 10 and the server 20 may be an HTTP request or an HTTP response. For example, the client device 10 may transmit an HTTP request to the server 20, and the server 20 may generate an HTTP response according to the HTTP request and transmit it to the client device 10.

The electronic device 100 may acquire the HTTP message 30 transmitted and received between the client device 10 and the server 20 and extract header information and content through a parsing process for the HTTP message 30.

As will be described later, header information may include at least one of host information, URL (Uniform Resource Locator) information, and method information. Header information may be included in the header of the HTTP message 30, and content may be included in the body of the HTTP message 30.

To explain the HTTP message 30 in more detail, the HTTP message 30 includes Layer 2 with hardware information, Layer 3 with IP information, Layer 4 with port information, and protocol information such as HTTP. It can be divided into Layer 7, and after analyzing the header of the Layer 7 protocol, it is possible to extract content containing information such as email, chat, and files.

Since Layer 2 to Layer 7 are commonly used protocols, it is relatively easy to extract information. However, since the content is implemented by the server 20 itself, there is no standard document, and therefore, no known parsing tool exists. Some servers 20 express content in json (JavaScript Object Notation), some servers 20 express content in xml (eXtensible Markup Language), and some servers 20 express content in MIME (Multipurpose Internet Mail Extensions), so various types of It is difficult to extract content from the HTTP message 30.

The electronic device 100 according to an embodiment of the present disclosure may extract content from the HTTP message 30 of various servers 20 through filter rules and parsing rules, which will be described later. The operation of the electronic device 100 according to one embodiment will be described with reference to FIGS. 2 to 15.

FIG. 2 is a flowchart showing a method of analyzing HTTP traffic by the electronic device 100 according to an embodiment.

In step S210, the electronic device 100 extracts header information including at least one of host information, URL information, and method information from the header of the HTTP message.

In one embodiment, the electronic device 100 may obtain an HTTP message by combining HTTP packets transmitted and received over a network.

Host may be unique identification information given to devices or servers connected to a network. Additionally, URL is a protocol for indicating where a resource is located on a network and can often be referred to as a web address or Internet address. A method can indicate the purpose or type of request sent by the client to the server.

In one embodiment, the electronic device 100 may extract header information from the header through parsing according to the HTTP protocol standard.

In step S220, the electronic device 100 selects a parsing tool corresponding to header information extracted from the header of the HTTP message among a plurality of parsing tools.

In one embodiment, the plurality of parsing tools may include JavaScript Object Notation (JSON), Multipurpose Internet Mail Extensions (MIME), eXtensible Markup Language (XML), HTTP_Header, and HTTP_FORM_Encoded. However, this is only one example, and the electronic device 100 may use various types of known parsing tools.

Briefly explaining the parsing tools illustrated above, JSON expresses content in a format such as {key:value}, MIME transmits multi-data with ---boundary, and presents content in a format such as key:value; Expressed using newline as a separator.

Additionally, XML expresses content in a format such as <key>value</key>, HTTP_Header expresses content in a format such as key:value, and uses newline as a delimiter. Additionally, HTTP_FORM_Encoded expresses content in the format of key=value and uses & as a separator.

The electronic device 100 may store in advance the correspondence between various header information and various parsing tools. The electronic device 100 may select a parsing tool corresponding to header information extracted from the HTTP message based on a pre-stored correspondence relationship.

A method by which the electronic device 100 selects a parsing tool based on header information will be described with reference to FIG. 3 .

Figure 3 is a table showing the correspondence between header information and a parsing tool according to an embodiment.

Referring to Figure 3, if the host is "www.abc.com", the URL is "/translatev3", and the method is "post", HTTP_FORM_Encoded may be selected for the HTTP request and JSON may be selected for the HTTP response. there is. That is, in one embodiment, a parsing tool for extracting content within an HTTP request and a parsing tool for extracting content within an HTTP response may be selected differently depending on specific header information.

Next, if the host is "www.aab.com", the URL is "/v2/mails", and the method is "post", MIME can be selected for the HTTP request and HTTP response. Additionally, when the host is "www.aab.com", the URL is "/v2/mails", and the method is "delete", XML may be selected for the HTTP request and HTTP response. That is, in the header information extracted from the header of one HTTP message and the header information extracted from the header of another HTTP message, even if the host and URL are the same, if the method is different, one HTTP message and the other HTTP message Different parsing tools may be selected for the message.

Similarly, in the header information extracted from the header of one HTTP message and the header information extracted from the header of another HTTP message, even if the host and method are the same, if the URL is different, one HTTP message and the other HTTP message Different parsing tools may be selected for the message.

Referring again to FIG. 2, in step S230, the electronic device 100 extracts content from the body of the HTTP message according to a parsing rule corresponding to the parsing tool selected in step S220.

Different parsing rules may be set for each of the plurality of parsing tools that the electronic device 100 can use. When extracting content from the body of an HTTP message, the parsing rule can refer to the key of the content to be extracted, processing options, etc. as rules defined according to the grammar of the parsing tool.

That is, the electronic device 100 can extract content from the body of the HTTP message according to the grammar of the key and parsing tool defined in the parsing rule.

In one embodiment, the rule for selecting one of a plurality of parsing tools may be referred to as a filter rule, and the rule for extracting content from the body of the HTTP message according to the parsing tool selected according to the filter rule is parsed. It can be referenced as a rule. That is, the electronic device 100 according to one embodiment can effectively parse HTTP messages of various services based on filter rules and parsing rules.

FIG. 4 is a diagram illustrating an HTTP message 400 according to an embodiment, and FIG. 5 shows a filter rule for extracting header information from the HTTP message 400 shown in FIG. 4, and a header extracted according to the filter rule. This is a drawing illustrating information.

Referring to FIG. 4, the HTTP message 400 may include a header 410 and a body 430.

The header 410 may include information about the host 416, method 412, and URL 414, and the body 430 may include content.

As described above, the electronic device 100 may extract header information from the header 410 according to a filter rule to select a parsing tool for extracting content.

Referring to Figure 5, "www.bing.com" (516), which is the value for "http_host", is extracted as a host, and "/ttranslatev3?" (514), which is the value for "http_path", is extracted as a URL. can be extracted. And, “POST” (512), the value for “http_method”, can be extracted as a method.

As described above, the electronic device 100 may select a parsing tool corresponding to “www.bing.com” (516), “/ttranslatev3?” (514), and “POST” (512) among a plurality of parsing tools. there is.

FIG. 6 is an exemplary diagram illustrating a method of extracting content from the body 430 of the HTTP message 400 shown in FIG. 4 according to a parsing rule 600.

When a parsing tool corresponding to header information extracted from the header 410 of the HTTP message 400 is selected, a parsing rule 600 corresponding to the selected parsing tool may be identified. The electronic device 100 may extract content from the body 430 of the HTTP message 400 according to the parsing rule 600.

Referring to FIG. 6, the parsing rule 600 includes information 611 indicating that the parsing rule 600 is for an HTTP request, and information 612 indicating that the parsing rule 600 is set for the form_data parsing tool. It can be included.

In addition, the parsing rule 600 includes one or more keys 614 and 616 indicating content to be extracted from the body 430 of the HTTP message 400, and processing options for values corresponding to the one or more keys 614 and 616. It may include (613, 615).

Specifically, the parsing rule 600 may include “text” 614 and “to” 616 as keys. “Text” (614) may be a key for extracting the original text before translation, and “to” (616) may be a key for extracting information indicating which country the language after translation is from.

Additionally, in the parsing rule 600, “key_only” (613) is set as the value processing option corresponding to “text” (614), and “country_type” is set as the value processing option corresponding to “to” (616). (615) is set.

The value corresponding to the key may be processed according to processing options. For example, processing options include options to output a value, if the value is a specific string, an option to convert it to another specified string and output it, an option to split the value with a delimiter and store the split values in an array format, or It can include options to extract values through regex (regular expression) grammar.

If the parsing rule 600 includes “text” 614 and “to” 616 as keys, the electronic device 100 uses “text” 614 and “text” 614 in the body 430 of the HTTP message 400. The texts 622 and 624 corresponding to “to” 616 can be identified, and the values 623 and 625 of the identified texts 622 and 624 can be obtained as the content of the HTTP message 400.

Since the value 623 corresponding to “text” 622 in the body 430 of the HTTP message 400 shown in FIG. 6 is encoded, the electronic device 100 decodes the value 623 and returns the original Value can be obtained.

FIG. 7 shows an extraction result 700 for the content of an HTTP message. As shown in FIG. 7, the electronic device 100 extracts the content corresponding to “text” 614 included in the parsing rule 600. You can obtain value (720) ("ja") corresponding to value (710) ("I am Han Young-ho. ~") and "to" (616).

FIG. 8 is an exemplary diagram illustrating a method of extracting content from the body 824 of the HTTP message 820 according to the parsing rule 810.

HTTP message 820 shown in FIG. 8 may be an HTTP response to the HTTP request shown in FIG. 4.

Referring to FIG. 8, the parsing rule 810 includes information 811 indicating that the parsing rule 810 is for an HTTP response, and information 812 indicating that the parsing rule 810 is set for a json parsing tool. may include.

In addition, the parsing rule 810 includes one or more keys 814 and 816 indicating content to be extracted from the body 824 of the HTTP message 820, and processing options for values corresponding to the one or more keys 814 and 816. (813, 815) may be included.

Specifically, the parsing rule 810 includes “detectedlanguage” 814 and “translations” 816 as keys. “detectedlanguage” (814) may be a key for extracting information indicating the language of which country the text before translation is, and “translations” (816) may be a key for extracting the text after translation.

Additionally, in the parsing rule 810, “country_type” (813) is set as the value processing option corresponding to “detectedlanguage” (814), and “key_only” is set as the value processing option corresponding to “translations” (816). (815) is set.

If the parsing rule 810 includes “detectedlanguage” 814 and “translations” 816 as keys, the electronic device 100 detects “detectedlanguage” 814 and “translations” 814 in the body 824 of the HTTP message 820. The text corresponding to "translations" (816) can be identified. However, the body 824 of the HTTP message 820 shown in Figure 8 does not include “detectedlanguage” 814 and “translations” 816, which are keys in the body 824 of the HTTP message 820. Indicates the case where both and value are encoded.

The electronic device 100 confirms the encoding method of the content in the HTTP message 820 using the br (Brotli) algorithm 822, and decodes the key and value in the body 824 of the HTTP message 820 according to the confirmed algorithm. can do. Then, the electronic device 100 identifies text corresponding to “detectedlanguage” (814) and “translations” (816) within the decoded content, and obtains the value of the identified text as the content of the HTTP message (820). You can.

FIG. 9 is a diagram illustrating a result 900 extracted through the parsing process shown in FIG. 8.

As shown in FIG. 9, the electronic device 100 contains a value (“ko”) 910 corresponding to “detectedlanguage” 814 included in the parsing rule 810 and a value corresponding to “translations” 816. You can obtain value (920).

The embodiments shown in FIGS. 4 to 9 relate to HTTP requests and HTTP responses for text translation. In one embodiment, the text that is the target of translation from the HTTP request and the text after translation are set by setting a parsing rule. Information indicating the language of the country can be extracted, and information indicating the language of the text corresponding to the translation result and the text before translation can be extracted from the HTTP response.

In other words, in translation-related services, the text before and after translation, which is the core content, and the language type before and after translation can be obtained through parsing rules. It can be clearly understood that the types of content extracted from HTTP requests and HTTP responses can vary depending on the settings of the parsing rules.

FIG. 10 is a diagram illustrating an HTTP message 1000 according to an embodiment, and FIG. 11 shows a filter rule for extracting header information from the HTTP message 1000 shown in FIG. 10, and a header extracted according to the filter rule. This is a drawing illustrating information.

Figure 10 shows an HTTP message 1000 related to mail transmission. The HTTP message 1000 may include a header 1010 and a body 1030.

The header 1010 may include information about the host 1016, method 1012, and URL 1014, and the body 1030 may include content.

Referring to Figure 11, "cmail.kakao.com" (1116), which is the value for "http_host", is extracted as a host, and "/v2/mails/send" (1114), which is the value for "http_path", is extracted as a URL. can be extracted. And, “POST” (1112), which is the value for “http_method”, can be extracted as a method.

The electronic device 100 may select a parsing tool corresponding to “cmail.kakao.com” (1116), “/v2/mails/send” (1114), and “POST” (1112) from among the plurality of parsing tools.

FIG. 12 is a diagram illustrating a parsing rule 1200 for extracting content from the HTTP message 1000 shown in FIG. 10, and FIG. 13 shows the body 1030 of the HTTP message 1000 shown in FIG. 10. It is a drawing. Additionally, FIG. 14 is a diagram illustrating a result 1400 extracted from the body 1030 of the HTTP message shown in FIG. 13 according to the parsing rule 1200 shown in FIG. 12.

Referring to FIG. 12, the parsing rule 1200 may include “tolist” (1210), “contents” (1240), and “from” (1250) as keys. Additionally, the parsing rule 1200 includes “name” (1220) and “addr” (1230) as subkeys for “tolist” (1210), and “name” (1260) as subkeys for “from” (1250). May include "addr" (1270).

If the parsing rule includes “tolist” (1210), “contents” (1240), and “from” (1250) as keys, the electronic device 100 retrieves “tolist” from the body 1030 of the HTTP message 1000. (1210), identify text (1310, 1340, 1350) corresponding to "contents" (1240), and "from" (1250), and store the values of the identified text (1310, 1340, 1350) in an HTTP message (1000) It can be obtained through the contents of .

Specifically, the electronic device 100 identifies “tolist” (1310), “contents” (1340), and “from” (1350) in the body 1030 of the HTTP message 1000 shown in FIG. 13, and “ The values corresponding to "tolist" (1310), "contents" (1340), and "from" (1350) can be extracted. Since “name” (1220, 1260) and “addr” (1230, 1270) are set as subkeys of “tolist” (1210) and “from” (1250) in the parsing rule 1200, the electronic device 100 In the body 1030, “name” (1320, 1360) and “addr” (1330, 1370) can be identified.

Referring to FIG. 14, as a parsing result 1400 for an HTTP message, values 1410, 1420, 1430, 1440 corresponding to “contents” 1340, “tolist” 1310, and “from” 1350. , 1450) can be extracted. In particular, the values of "tolist" (1310) and "from" (1350) contain subkeys, so the values of "name" (1320, 1360) (1420, 1450) and "addr" (1330, 1370), respectively. The values 1430 and 1440 can be extracted together.

The embodiments shown in FIGS. 10 to 14 may relate to HTTP requests for sending mail. In one embodiment, sender information, recipient information, title of mail, and content of mail are retrieved from the HTTP request through setting of parsing rules. This can be extracted.

In one embodiment, the HTTP message that is the subject of analysis by the electronic device 100 may be related to search, writing, file upload, document creation, etc. in addition to the mail and translation described above. In this case, as described above, the electronic device 100 may specify the type of content to be extracted from the HTTP message through parsing rules related to search, writing, file upload, document creation, etc. Mail, translation, search, writing, file upload, and document creation are just examples, and HTTP messages may be related to various types of services available through the server 20.

FIG. 15 is a block diagram showing the configuration of an electronic device 100 according to an embodiment.

Referring to FIG. 15 , the electronic device 100 may include a memory 1510, a control unit 1530, a communication unit 1570, and a display 1550.

Memory 1510 may store one or more instructions. In one embodiment, memory 1510 may store filter rules and parsing rules for parsing HTTP messages.

The control unit 1530 may operate according to one or more instructions stored in the memory 1510. In one embodiment, the control unit 1530 may be implemented as a processor.

In one embodiment, the control unit 1530 may extract header information including at least one of host information, URL information, and method information from the header of the HTTP message. The control unit 1530 may select a parsing tool corresponding to header information extracted from the header among a plurality of parsing tools and extract content from the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool.

In one embodiment, when the content of the HTTP message is encoded, the control unit 1530 may decode the content according to a decoding method corresponding to the encoding method of the content.

The communication unit 1570 may receive HTTP messages transmitted and received between the client device 10 and the server 20. The communication unit 1570 may transmit an HTTP message to the control unit 1530.

In one embodiment, the communication unit 1570 may receive HTTP packets transmitted and received between the client device 10 and the server 20 and obtain an HTTP message by combining the received HTTP packets.

The display 1550 may output content extracted by the control unit 1530. The display 1550 may output content according to processing options included in the parsing rule.

In one embodiment, if the content extracted from the HTTP message corresponds to pre-designated leak prevention content, the control unit 1530 blocks messages transmitted and received between the client device 10 and the server 20 to prevent security information from being leaked. It can be prevented.

In another embodiment, if the content extracted from the HTTP message corresponds to pre-designated leak prevention content, the control unit 1530 may notify the administrator terminal through the communication unit 1570 that security information has been leaked.

Meanwhile, the above-described embodiments of the present invention can be written as a program that can be executed on a computer, and the written program can be stored in a medium.

The media may include, but is not limited to, magnetic storage media (eg, ROM, floppy disk, hard disk, etc.) and optical read media (eg, CD-ROM, DVD, etc.).

Although the specific embodiments have been described above, it will be obvious to those skilled in the art that various modifications are possible without departing from the scope of the present invention.

Claims (16)

In a method of analyzing HTTP traffic by an electronic device,
Extracting header information including at least one of host information, URL (Uniform Resource Locator) information, and method information from the header of an HTTP (HyperText Transfer Protocol) message;
selecting a parsing tool corresponding to the extracted header information from among a plurality of parsing tools; and
A method of analyzing HTTP traffic, comprising extracting content from the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool.
According to paragraph 1,
A method of analyzing HTTP traffic in which different parsing rules are set for each of the plurality of parsing tools.
According to paragraph 1,
The parsing rule is,
contains one or more keys,
The extracting step is,
identifying text corresponding to the one or more keys in the content; and
A method of analyzing HTTP traffic, including extracting the value of the identified text.
According to paragraph 3,
The parsing rule is,
Includes more processing options,
The method for analyzing the HTTP traffic is,
Method for analyzing HTTP traffic, further comprising processing the extracted value according to the processing option.
According to clause 4,
The above processing options are:
An option to output the value, if the value is a specific string, an option to convert it to another specified string and output it, an option to split the value with a delimiter and store the divided values in an array format, or to regex the value. (regular expression) A method of analyzing HTTP traffic, including the option to extract it through grammar.
According to paragraph 1,
The method for analyzing the HTTP traffic is,
When the content is encoded, the method further includes decoding the encoded content according to a decoding method corresponding to the encoding method of the content.
According to paragraph 1,
The method for analyzing the HTTP traffic is,
Method for analyzing HTTP traffic, further comprising outputting the extracted content through a display.
According to paragraph 1,
The HTTP message is a message transmitted and received between a client device and a server,
The method for analyzing the HTTP traffic is,
If the extracted content corresponds to leak prevention content, the method further includes blocking messages transmitted and received between the client device and the server.
According to paragraph 1,
If the HTTP message is a request related to translation,
According to the parsing rule, the text to be translated from the body and information indicating the language of which country the text after translation is extracted from the body as the content,
If the HTTP message is a translation-related response,
A method of analyzing HTTP traffic in which, according to the parsing rule, a text corresponding to a translation result and information indicating the language of which country the text to be translated is extracted from the body as the content.
According to paragraph 1,
If the HTTP message is a request related to mail transmission,
A method of analyzing HTTP traffic in which sender information, recipient information, mail title, and mail content are extracted from the body according to the parsing rule as the content.
According to paragraph 1,
The HTTP message is an HTTP request or HTTP response related to mail, translation, search, writing, file upload, or document creation. Method of analyzing HTTP traffic.
A program stored in a medium to execute the HTTP traffic analysis method of any one of claims 1 to 11 in combination with hardware.
A memory that stores one or more instructions; and
Including a processor that operates according to the one or more instructions,
The processor,
Extract header information including at least one of host information, URL (Uniform Resource Locator) information, and method information from the header of the HTTP (HyperText Transfer Protocol) message,
Select a parsing tool corresponding to the extracted header information from among a plurality of parsing tools,
An electronic device that extracts content from the body of the HTTP message according to a parsing rule corresponding to the selected parsing tool.
According to clause 13,
An electronic device in which different parsing rules are set for each of the plurality of parsing tools.
According to clause 13,
The parsing rule is,
contains one or more keys,
The electronic device is,
identify text corresponding to the one or more keys in the content,
An electronic device that extracts the value of the identified text.
According to clause 15,
The parsing rule is,
Includes more processing options,
The electronic device is,
An electronic device that processes the extracted value according to the processing option.