JP2014134865A - Transmission information analysis device, method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a transmission information analysis device, method and program which enable a user to easily grasp whether or not a server is the one which he/she has used and provided personal information to, in the past.SOLUTION: A user terminal 1 comprises a detection unit 11 which detects a form used for information transmission in a Web page being browsed, an extraction unit 12 which extracts a character string included in predetermined dictionary data 21 or a character string similar to the dictionary data from the detected form, and a history table 22 which stores the extracted character string, a character string input in the form corresponding to the character string or a character string in the dictionary data corresponding to the character string in association with identification information of a server providing the Web page being browsed, when the information transmission by the form is performed.

Description

  The present invention relates to an apparatus, a method, and a program for analyzing information transmitted when browsing a website.

  Conventionally, an access control method for an unauthorized server that operates a phishing site or a server that cannot permit browsing to a specific age group has been proposed. For example, Web filtering services like Non-Patent Documents 1 to 3 are provided.

In these web filtering services, web pages that can be browsed are controlled according to the age of the user or the object of interest. Specifically, for example, the following functions are provided by software installed in the user's terminal.
-Blacklist format browsing control: Do not communicate with servers that you want to prohibit browsing.
・ Whitelist format browsing control: Communication to the server to which browsing is permitted.
-Browsing control by genre: Permit or prohibit browsing of the selected genre.
Web browsing history survey: saves the history of Web servers browsed in the past.

Web filter, [online], [November 28, 2012 search], Internet <http: // security. nifty. com / iflter /> Reliable access service, [online], [searched on November 28, 2012], Internet <http: // www. auone-net. jp / security / service / anshin_access / index. html> Harmful Site Block Service, [online], [searched on November 28, 2012], Internet <http: // www. ocn. ne. jp / option / vcheck / webfilter />

By the way, as a factor that a user browsing a website feels uneasy, there is a case where personal information is erroneously provided to a malicious site.
The browsing control by the Web filtering service as described above is effective in preventing connection to such a site before personal information is erroneously provided to a malicious site. However, it is not possible to completely prevent the transmission of personal information because browsing control cannot provide information to sites that are leaked.

  Even if the password management software automates the input of IDs and passwords to a given website, the user is not restricted from entering information required from the website. The transmission of information could not be prevented.

  An object of the present invention is to provide a transmission information analysis apparatus, method, and program that allow a user to easily grasp whether or not a server has been used in the past and has provided personal information.

  The present invention provides the following solutions.

  (1) a detection unit that detects a form for transmitting information in a Web page being browsed, and a character string included in predetermined dictionary data from the form detected by the detection unit; Alternatively, an extraction unit that extracts a character string similar to the dictionary data, and when information transmission is performed using the form, the character string extracted by the extraction unit and the character input to the form corresponding to the character string A storage unit that stores a string or a character string in the dictionary data corresponding to the character string as identification information of a server that provides the Web page being browsed, and stores it as a transmission information character string; A transmission information analyzing apparatus provided.

  According to such a configuration, the transmission information analyzing device detects that the Web page being browsed transmits a predetermined type of information included in the dictionary data, extracts a character string indicating the transmission information, Are stored in association with the identification information. Therefore, by referring to the stored information, the user may have used a server in communication in the past to provide a predetermined type of information as necessary, such as before performing an information transmission operation. It can be easily grasped whether or not. In addition, since the user can grasp how much information is registered in which Web site, the user can verify whether the information is not provided by mistake.

  (2) The transmission information analysis apparatus according to (1), wherein the detection unit detects a form tag in which a post method appears from an html source file for displaying the Web page.

  According to such a configuration, the transmission information analysis device can easily detect a form for information transmission by detecting a form tag including a post method from an html source file for displaying a Web page. it can.

  (3) An acquisition unit that acquires identification information of a server that manages a Web page, and a search unit that searches the storage unit for a transmission information character string associated with the identification information acquired by the acquisition unit. And a display unit that displays the transmission information character string searched by the search unit. (1) or (2).

  According to such a configuration, the transmission information analyzing apparatus can search and display what information has been transmitted in the past to the currently communicating or designated server. Therefore, the user can easily grasp which information is provided to which server.

  (4) The transmission information analysis apparatus according to (3), wherein when the transmission information character string is not searched by the search unit, the display unit displays that the search is not performed.

  According to such a configuration, the transmission information analyzing apparatus displays that the character string indicating the predetermined type of information is not searched when the character string indicating the predetermined type of information is not searched. Since no information has been registered in the past, the history is not displayed, so that it is easy to determine that the server is not being used normally.

  (5) The transmission information analysis device according to any one of (1) to (4), wherein the storage unit does not store the same combination of the identification information and the transmission information character string in duplicate.

  According to such a configuration, the transmission information analysis device does not store redundant transmission histories of the same type of information for the same server. Therefore, the storage capacity and the processing load at the time of retrieval are reduced.

  (6) The transmission information analysis device according to (5), wherein the storage unit stores the number of times information corresponding to the transmission information character string is transmitted to the same server in association with the character string.

  According to such a configuration, since the transmission information analyzing apparatus stores the number of times of information transmission, the user can grasp the frequency of use of the server and can easily grasp whether or not the server is normally used.

  (7) The transmission information analysis device according to any one of (1) to (6), wherein the storage unit stores a security type in information transmission by the form in association with the transmission information character string.

  According to such a configuration, the transmission information analyzing apparatus stores the security type at the time of information transmission. Therefore, the user can verify whether each of the transmission histories has been transmitted safely.

  (8) The transmission information analysis device according to any one of (1) to (7), wherein the storage unit stores date information on which information transmission by the form is performed in association with the transmission information character string.

  According to such a configuration, the transmission information analyzing apparatus stores the transmission date and time of information. Therefore, for example, the user can verify the transmission history of information by referring to more detailed information, such as whether the server has been used recently.

  (9) The transmission information analysis device according to any one of (1) to (8), wherein the storage unit encrypts and stores the transmission information character string.

  According to such a configuration, the transmission information analyzing apparatus encrypts and stores a character string related to a predetermined type of information. Therefore, it is suppressed that the transmission history of these information leaks to a third party.

  (10) a detection step of detecting a form for information transmission in a Web page being browsed, and a character string included in predetermined dictionary data from the form detected in the detection step; Alternatively, when an extraction step for extracting a character string similar to the dictionary data and information transmission by the form are performed, the character string extracted in the extraction step and a character input to the form corresponding to the character string A storage step of storing a string or a character string in the dictionary data corresponding to the character string as a transmission information character string in association with identification information of a server that provides the web page being browsed. A transmission information analysis method executed by a computer.

  According to such a configuration, the same effect as in (1) can be expected when the computer executes the transmission information analysis method.

  (11) a detection step of detecting a form for transmitting information in a web page being browsed, and a character string included in predetermined dictionary data from the form detected in the detection step; Alternatively, when an extraction step for extracting a character string similar to the dictionary data and information transmission by the form are performed, the character string extracted in the extraction step and a character input to the form corresponding to the character string A storage step of storing a string or a character string in the dictionary data corresponding to the character string as a transmission information character string in association with identification information of a server that provides the web page being browsed. Transmission information analysis program to be executed by a computer.

  According to such a configuration, the same effect as in (1) can be expected by causing the computer to execute the transmission information analysis program.

  According to the present invention, the user can easily grasp whether or not the server has been used in the past and has provided personal information.

It is a block diagram which shows the structure of the user terminal which concerns on embodiment. It is a figure which shows the example of the html source file which concerns on embodiment. It is a figure which shows the log | history table which concerns on embodiment. It is a flowchart which shows the preservation | save process of the personal information which concerns on embodiment. It is a flowchart which shows the display process of the personal information transmission history which concerns on embodiment.

Hereinafter, an example of an embodiment of the present invention will be described.
The user terminal 1 (transmission information analysis device) of the present embodiment analyzes information transmitted when browsing a Web site and stores a history of transmitting personal information.

  The user terminal 1 is an information processing apparatus that can be connected to the Internet, and includes a browser for browsing a Web site. Further, the transmission information analysis function according to the present embodiment is implemented using, for example, an add-on function for this browser.

FIG. 1 is a block diagram showing a configuration of a user terminal 1 (transmission information analysis apparatus) according to the present embodiment.
The user terminal 1 includes a control unit 10, a storage unit 20, a communication unit 30, an input unit 40, and a display unit 50.

  The control unit 10 is a part that controls the entire user terminal 1, and implements various functions in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 10 is provided is mentioned later.

  The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the user terminal 1, and may be a ROM, a RAM, a flash memory, a hard disk (HDD), or the like. Specifically, the storage unit 20 stores a program that causes the control unit 10 to execute each function of the present embodiment, and also includes dictionary data 21 including a list of character strings that identify personal information, and personal information. Is stored in the history table 22 including the transmission history.

  The communication unit 30 is a network adapter when the user terminal 1 transmits / receives data to / from another device. Specifically, the communication unit 30 receives various Web pages provided by the Web server via the Internet under the control of the control unit 10. In addition, the communication unit 30 transmits information input to the Web page by the user to the Web server in response to a predetermined operation input.

  The input unit 40 is an interface device that receives an instruction input from the user to the user terminal 1. The input unit 40 is configured by, for example, a keyboard, a mouse, a touch panel, and the like.

  The display unit 50 displays a screen for accepting data input to the user or displays a processing result screen by the user terminal 1 according to display control by the control unit 10. The display unit 50 may be a display device such as a cathode ray tube (CRT) display, a liquid crystal display (LCD), or an organic EL display.

Next, the function of the control unit 10 will be described in detail.
The control unit 10 includes a detection unit 11, an extraction unit 12, a history storage unit 13, an acquisition unit 14, a search unit 15, and a history output unit 16.

The detection unit 11 detects a form for information transmission in a Web page being browsed by a browser.
In order to register information on the Web or transmit information to a Web server, a post method is generally specified in a form tag in an html source file. Therefore, the detection unit 11 detects the presence or absence of a form tag in which the post method appears from within an html source file for displaying the currently browsed Web page.

  The extraction unit 12 extracts a character string included in the predetermined dictionary data 21 from the form detected by the detection unit 11. Here, the dictionary data 21 is data in which character strings relating to personal information such as “credit card number”, “ID”, “password”, etc. are listed.

  Specifically, the extraction unit 12 searches the form tag in which the post method appears, and extracts a character string when there is a character string that matches or is similar to the dictionary data 21. When a character string is extracted, it means that there is a form that prompts transmission of personal information on the Web page being browsed.

  When the information transmission by the form is performed, the history storage unit 13 reads the character string extracted by the extraction unit 12, the character string input to the form corresponding to the character string, or the character string in the matched dictionary data 21 Are stored in the history table 22 as transmission information character strings in association with the identification information of the server providing the Web page being browsed.

The information transmission is executed by a predetermined process based on a user's operation input, for example, a process of <input type = “submit”> in the form tag. The history storage unit 13 stores a transmission information character string related to personal information in the history table 22 triggered by the execution of the predetermined process.
Hereinafter, the transmission information character string related to personal information will be described as the character string in the dictionary data 21 matched with the html source file and the actual personal information input by the user corresponding to this character string. The transmission information character string may include a character string extracted from an html source file instead of the character string in the dictionary data 21 or together with the character string in the dictionary data 21.

  FIG. 2 is a diagram showing an example of an html source file that provides a form for transmitting information according to the present embodiment.

In this example, since “method =“ post ”” is designated as the attribute of the <form> tag, it can be understood that this form transmits information to a predetermined server.
Furthermore, since the character strings “user ID” and “password” indicating personal information exist in the description in <form> to </ form>, it can be seen that this form transmits personal information. Note that the character string indicating the personal information is not limited to the text item label or the like, and may be extracted from, for example, the attribute “name” or “id” of the <input> tag.

  In addition, there is a description of <input type = “submit”> in the form, and a transmission information character string related to the extracted personal information is stored in the history table 22 when this button is pressed.

  Here, the server name is a character string including at least a part of the domain obtained from the URL of the Web page. It should be noted that it is possible to appropriately set the range of subdomains and directories. For example, for the URL “https://yyy.xxx.com/aaa/bbb/”, the server names “yyy.xxx.com”, “xxx.com”, “yyy.xxx.com/aaa” “Yyy.xxx.com/aaa/bbb” or the like is employed.

FIG. 3 is a diagram showing the history table 22 according to the present embodiment.
The history table 22 stores a transmission information character string related to personal information in association with a server name as identification information.

The personal information actually entered by the user is stored in the personal information character string, and the character string registered in the dictionary data 21 is stored in the personal information character string type. For example, “credit card number” included in the dictionary data 21 is stored in the personal information character string type, and “xxxx-xxxx-xxxx-xxxx” actually input in the form is stored in the personal information character string. The
In the personal information character string type, a character string extracted from an html source file may be stored. For example, although “credit card number” is described in the dictionary data 21, html is used as a similar character string. If the character string extracted from the source file is “card NO”, “card NO” may be stored in the personal information character string type.

The history table 22 may store a security type at the time of transmitting personal information using a form.
The security type is information for determining whether the data transmission / reception protocol is SSL, more secure EVSSL, or whether SSL is not used.

The history table 22 may not store duplicate records having the same combination. That is, when the same type of personal information is transmitted to the same Web server a plurality of times, a plurality of records are not stored and a transmission history is represented by a single record. Similar character strings are integrated into a single record as the same type.
At this time, the history table 22 stores the number of times information corresponding to the personal information character string is transmitted in association with the character string.

The history table 22 may store date and time information on which personal information is transmitted in association with a character string.
When the same type of personal information is transmitted a plurality of times, for example, the latest date and time may be stored.

  Further, information stored in the history table 22, particularly the server name, personal information character string, and personal information character string type, is stored as data after being encrypted by, for example, a hash operation as a countermeasure against leakage. Is preferred.

The acquisition unit 14 acquires the identification information of the server that manages the Web page.
For example, the acquisition unit 14 acquires identification information such as a server name based on the URL of the Web site currently being browsed or the Web site specified by the user.

  The search unit 15 searches the history table 22 for a character string associated with the identification information acquired by the acquisition unit 14.

  The history output unit 16 causes the display unit 50 to display the character string searched by the search unit 15 as a transmission history of personal information to the server. When the search unit 15 does not search for a character string, the history output unit 16 displays that the search has not been performed.

FIG. 4 is a flowchart showing personal information storage processing according to the present embodiment.
This saving process is executed when a Web page is displayed on the browser.

  In step S1, the control unit 10 (detection unit 11) determines whether or not there is an information transmission form in the Web page displayed on the browser. If this determination is YES, the process proceeds to step S2, and if the determination is NO, the process ends.

  In step S2, the control unit 10 (extraction unit 12) determines whether or not the transmitted information is personal information, that is, whether or not a predetermined character string indicating personal information is included in the description in the form. To do. If this determination is YES, the process proceeds to step S3, and if the determination is NO, the process ends.

  In step S <b> 3, the control unit 10 (history storage unit 13) determines whether the browser has executed information transmission processing. If this determination is YES, the process proceeds to step S4, and if the determination is NO, the process proceeds to step S5.

  In step S4, the control unit 10 (history storage unit 13) extracts the character string indicating the personal information determined in step S2 as the transmitted information, and stores it in the history table 22 in association with the server name.

  In step S5, the control unit 10 determines whether or not the displayed web page is closed. If this determination is YES, the process ends. If the determination is NO, the process returns to step S3. Note that the closing of the Web page includes a transition to another Web page.

FIG. 5 is a flowchart showing a personal information transmission history display process according to the present embodiment.
This display process is executed, for example, every time a new Web page is displayed or when a process execution is instructed by a user operation input.

  In step S <b> 11, the control unit 10 (acquisition unit 14) acquires a server name that is a target for displaying transmission history information, from the URL of the Web page being displayed or the Web page specified by the user.

  In step S12, the control unit 10 (search unit 15) refers to the history table 22 and searches for a transmission history of personal information associated with the server name acquired in step S11.

  In step S13, the control unit 10 (history output unit 16) causes the display unit 50 to display the transmission history information searched in step S12.

  As described above, according to the present embodiment, the user terminal 1 detects that the web page being browsed transmits personal information, extracts a character string indicating the personal information, and identifies the server identification information. Store in association with each other. Therefore, by referring to the stored information, the user is a server that has been used in the past and provided personal information as needed before the information transmission operation, etc. It can be easily grasped. In addition, since the user can grasp how much the personal information of the user is registered in which Web site, the user can verify whether the personal information is not provided by mistake.

  The user terminal 1 can easily detect a form for information transmission by detecting a form tag including a post method from an html source file for displaying a Web page.

In addition, the user terminal 1 can search and display what personal information has been transmitted in the past to a currently communicating or designated server. Therefore, the user can easily grasp which personal information is provided to which server.
At this time, for example, in the case of a phishing site, since no user ID or password has been registered in the past, the history is not displayed, so that it is possible to easily determine that the server is not being used normally.

Further, the user terminal 1 does not store redundant transmission histories of the same type of personal information for the same server. Therefore, the storage capacity of the user terminal 1 and the processing load during search are reduced.
At this time, since the number of transmissions is stored, the usage frequency of the server can be grasped, and it can be easily grasped whether or not the server is normally used.

  In addition, the user terminal 1 stores the security type at the time of transmitting personal information, specifically, the SSL type. Therefore, the user can verify whether each of the transmission histories has been transmitted safely.

  Further, the user terminal 1 stores the transmission date and time of personal information. Therefore, for example, the user can verify the transmission history of personal information by referring to more detailed information, such as whether the server has been used recently.

  Also, the user terminal 1 encrypts and stores a character string related to personal information. Accordingly, leakage of the personal information transmission history to a third party is suppressed.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  In the above-described embodiment, the presence or absence of the personal information transmission form is detected when the Web page is displayed on the browser. However, the present invention is not limited to this. For example, the presence or absence of personal information may be determined when information is actually transmitted by the browser.

  Further, in the above-described embodiment, it is determined by the post message and the submit button that the Web page is for transmitting information and the information transmission is performed. However, this determination unit is an example. The execution of data or processing relating to other information transmission means may be detected.

  In the above-described embodiment, the extraction unit 12 extracts a character string related to personal information from an html source file. However, when image data is included, text information is extracted by OCR (Optical Character Reader) or the like. After obtaining, a character string related to personal information may be extracted.

Note that the user terminal 1 is an example of an information processing apparatus that can be connected to a network, and is a mobile terminal such as a mobile phone, a smartphone, or a tablet terminal, or various information processing apparatuses (computers) such as a PC (Personal Computer). It's okay.
Each function described above is realized by software. When realized by software, a program constituting the software is installed in the information processing apparatus. These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network.

1 User terminal (transmission information analysis device)
DESCRIPTION OF SYMBOLS 10 Control part 11 Detection part 12 Extraction part 13 History storage part 14 Acquisition part 15 Search part 16 History output part 20 Storage part 21 Dictionary data 22 History table 30 Communication part 40 Input part 50 Display part

Claims (11)

A detection unit for detecting a form for information transmission in a web page being browsed;
From the form detected by the detection unit, an extraction unit that extracts a character string included in predetermined dictionary data or a character string similar to the dictionary data;
When information transmission by the form is performed, the character string extracted by the extraction unit, the character string input to the form corresponding to the character string, or the character string in the dictionary data corresponding to the character string A storage unit that stores the information as a transmission information character string in association with the identification information of the server that provides the Web page being browsed.   The transmission information analysis apparatus according to claim 1, wherein the detection unit detects a form tag in which a post method appears from within an html source file for displaying the Web page. An acquisition unit that acquires identification information of a server that manages a Web page;
A search unit that searches the storage unit for a transmission information character string associated with the identification information acquired by the acquisition unit;
The transmission information analysis apparatus according to claim 1, further comprising: a display unit that displays the transmission information character string searched by the search unit.   The transmission information analyzing apparatus according to claim 3, wherein when the transmission information character string is not searched by the search unit, the display unit displays that the search is not performed.   The transmission information analysis apparatus according to any one of claims 1 to 4, wherein the storage unit does not store the same combination of the identification information and the transmission information character string redundantly.   The transmission information analysis apparatus according to claim 5, wherein the storage unit stores the number of times information corresponding to the transmission information character string is transmitted to the same server in association with the transmission information character string.   The transmission information analysis device according to any one of claims 1 to 6, wherein the storage unit stores a security type in information transmission by the form in association with the transmission information character string.   The transmission information analysis apparatus according to any one of claims 1 to 7, wherein the storage unit stores date and time information on which information transmission by the form is performed in association with the transmission information character string.   The transmission information analysis device according to claim 1, wherein the storage unit encrypts and stores the transmission information character string. A detection step of detecting a form for transmitting information in a web page being browsed;
An extraction step for extracting a character string included in predetermined dictionary data or a character string similar to the dictionary data from the form detected in the detection step;
When information transmission is performed by the form, the character string extracted in the extraction step, the character string input to the form corresponding to the character string, or the character string in the dictionary data corresponding to the character string A transmission information analysis method in which a computer executes a storage step of storing a transmission information character string in association with identification information of a server providing a web page being browsed. A detection step of detecting a form for transmitting information in a web page being browsed;
An extraction step for extracting a character string included in predetermined dictionary data or a character string similar to the dictionary data from the form detected in the detection step;
When information transmission is performed by the form, the character string extracted in the extraction step, the character string input to the form corresponding to the character string, or the character string in the dictionary data corresponding to the character string A transmission information analysis program for causing a computer to execute a storage step of storing a transmission information character string in association with identification information of a server providing a web page being browsed.

Images