KR100992069B1 - A system for preventing exposure of personal information on the internet and the method thereof - Google Patents

Abstract

PURPOSE: A system for preventing exposure of personal information on the internet and a method thereof are provided to rapidly delete and manage the exposed personal information by searching a webpage provided from a website. CONSTITUTION: A searching unit(31) searches a webpage which exposes personal information by accessing a website, and a verification unit(32) analyzes the webpage to calculates a fact index of the webpage which judges the exposure of the personal information and the threat index of the webpage which indicates the exposure degree of the personal information. A confirmation unit(33) calculates the reliable index of the website by receiving the correspondence of the webpage, and an analysis unit(34) calculates the risk level of the website by using the reliable index. A management unit(35) uses the risk level to classify the website as search group so that the policy for exposure of the website may be differentiated.

Description

A system for preventing exposure of personal information on the internet and the method

The present invention relates to a personal information exposure response system and method that can retrieve a web page provided by a website on the Internet, collect personal information exposure information, and quickly delete and respond to the exposed personal information.

The present invention also relates to a personal information exposure response system and method for retrieving a variable exposure parameter of a dynamic webpage from a maximum value of a previous visit parameter when revisiting a website for a quick exposure search.

In addition, the present invention calculates the threat index and fact index of each web page according to the degree of personal information exposure, calculates the reliability index of the website according to the degree of correspondence to the exposure, calculates the threat level of each website and grouped The present invention relates to a system and method for exposing personal information with different exposure response policies.

The steady development of computer technology has led to the continuous development of the Internet, which has revolutionized the distribution of information. Operators providing information and communication services easily collect personal information through the Internet and use it commercially. However, due to the negative effects of the information distribution, the public's personal information is exposed and disclosed through the website, or the personal information is leaked by malicious users, thereby causing secondary damage by misuse or abuse. Personal information exposed and leaked like this is misused and causes mental and financial damage to the people.

In order to solve this problem, the government or public institutions are making efforts to search personal information by using a general-purpose search engine such as Google to delete personal information exposed on the Internet, and continuously delete the searched results.

In general, general-purpose search engines use web robots (webots, crawlers) to collect and analyze information on web pages of each website to construct index data. When the search engine receives the search request based on the search word, the search engine searches the search word based on the configured index data and sends the search result.

However, as the number of web documents that need to be collected by search engines increases exponentially, the time required to collect web documents increases, as well as the time required to index collected web documents. As a result, there is a problem in that new web pages that can be generated during the process of building the index data are not reflected in the index data.

For this reason, if personal information is searched through a general-purpose search engine, it is likely to be searched after considerable time after personal information is exposed. The longer the time from exposure to discovery, the more likely that the personal information will be passed on to the person who wants to abuse it.

In order to solve the above problems, [Korean Patent Laid-Open No. 2008-0092506 (published on October 16, 2008) using a secondary crawler that collects new web documents while creating index data, "Search for building index data. Systems and methods therefor "], but the specific update method is not presented.

In particular, dynamic webpages such as bulletin boards are updated more frequently than static webpages, but related technologies have not been proposed. Moreover, personal information is often exposed or traded on a dynamic webpage such as a bulletin board by an individual who is not responsible for managing the website. If bulletin boards are not managed or prevented in real time in real time, personal information is rapidly spread and there is a great possibility of widespread exposure.

On the other hand, when personal information is exposed on a web page, the subject who must delete the exposed personal information or take preventive measures is the administrator of the website. In particular, if the administrator of the website does not take preventive measures against personal information disclosure, the possibility of a personal information disclosure incident on the site is very high.

Therefore, personal information exposure search also needs to be managed separately for each website. However, conventional search engines manage index data indiscriminately for similar websites. However, it is a technology that gives priority to a website in [Korean Patent Publication No. 2007-0098521 (published on October 5, 2007)], etc., but prioritizes the order of visit (fetch order) of a web page during the collection process.

In conclusion, the conventional search engine technology cannot be applied as it is in order to manage personal information exposure, and problems that occur specially in personal information exposure management, for example, exposure monitoring such as bulletin boards, and exposure monitoring at the website level The technical problem of the.

An object of the present invention is to solve the problems as described above, to retrieve a web page provided by a website on the Internet to collect personal information exposure information, personal information that can quickly delete and respond to the exposed personal information It is to provide an exposure response system and method.

It is another object of the present invention to provide a personal information exposure response system and method for retrieving a variable exposure of a dynamic webpage from a maximum value of a previous visit when revisiting a website for a quick exposure search.

 Another object of the present invention is to calculate the threat index and fact index of each webpage according to the degree of personal information exposure, calculate the reliability index of the website according to the degree of correspondence to the exposure, calculate the threat level of each website It is to provide a system and method for exposing personal information by grouping them in different exposure response policies.

In order to achieve the above object, the present invention relates to a personal information exposure response system that collects and manages personal information exposure information of a website by searching a web page provided by a website on the Internet, wherein the personal information is accessed by accessing the website. A search unit for searching the exposed web page, but searching only a new web page when revisiting the website; A verification unit for analyzing a searched web page and calculating a threat index of a web page indicating an exposure level of personal information and a fact index of a web page determining whether personal information is exposed; A confirmation unit for calculating a reliability index of the website by receiving a response to the searched web page; An analysis unit for calculating a threat level of the website using the reliability index of the website; It is characterized in that it comprises a management unit for classifying the website into a search group by using the threat level, and different exposure response policy of the website according to the search group.

In addition, the present invention in the personal information exposure response system, the web site of the website directly linked directly or indirectly searched from the homepage of the website, if the web page is a dynamic web page, the link inquiry of the dynamic web page By analyzing the parameter string, the parameter is increased to search a series of web pages linked by the link text, but increases from the maximum value of the parameter at the previous visit of the website.

In the present invention, in the personal information exposure response system, the search unit divides the link statement into a page string and a parameter string to form a list of parameter strings using the page string as a key, and the parameter included in the parameter string. According to the format of the parameter value, it is divided into fixed or variable parameter types, and even if deleted from the link statement, the parameter (hereinafter, dummy parameter) whose same web page is searched by the link statement is removed from the parameter string, and the duplicated parameter string, Alternatively, the web server may search for a series of web pages by removing a parameter string in which both the fixed parameter and the variable parameter do not exist, and increasing the variable parameter in the parameter string remaining in the list.

In the present invention, the personal information exposure response system, the search unit, if the parameter value is an integer type is divided into a variable parameter, a non-integer fixed parameter, but the parameter value of the variable parameter is determined as the maximum value of the parameter of the same parameter name, The variable parameter is converted into a fixed parameter according to the frequency of overlap of the parameter string in the list by the same parameter.

In addition, the present invention is a personal information exposure response system, wherein the search unit, by querying the web page with the parameter string from which the parameter is removed, the web page exists and the signature (signature) and page size of the searched web page is removed If it is the same as the previous web page, the removed parameter may be determined as a dummy parameter.

In addition, the present invention is characterized in that in the personal information exposure response system, the threat index value _k of the web page k is calculated by [Equation 1].

[Equation 1]

Where n is the number of types of personal information, S is the fact index with 0 or 1, C is the number of exposed personal information, P is the weight according to the type of personal information, and W is the vulnerability of the webpage.

In addition, the present invention is characterized in that in the personal information exposure response system, the reliability index of the website is calculated by [Equation 2].

[Equation 2]

Where R is the number of responses, Total is the number of exposures, and W is the weight of the response period.

In addition, the present invention is characterized in that the risk level of the website in the personal information exposure response system is calculated by [Equation 3].

[Equation 3]

Where n is the number of exposed web pages on the website, T is the reliability of the website, and value is the threat index of the web page.

In addition, in the personal information exposure response system, the management unit is characterized in that the visit period for the web site belonging to the search group according to the search group is different.

In addition, the present invention relates to a personal information exposure response method of a system for retrieving a web page provided by a website on the Internet to collect and manage personal information exposure information of the website, (a) the system is the website Searching for a webpage in which personal information is exposed by accessing the webpage, and searching only a new webpage when the user visits the website again; (b) analyzing the searched web pages to calculate a threat index of the web page indicating the exposure level of the personal information and a fact index of the web page determining whether the personal information is exposed; (c) calculating a reliability index of the web site by receiving whether the web page corresponds to the searched web page; (d) calculating a threat level of the website using the reliability index of the website; And (e) dividing the websites into search groups using the threat level, and varying the exposure response policy of the websites according to the search groups.

In addition, the present invention is a personal information exposure response method, in the step (a), if all the web pages of the website directly or indirectly linked from the homepage of the website, and the web page is a dynamic web page, By analyzing a parameter string of the link text of the dynamic web page, the parameter is increased to search for a series of web pages linked by the link text, but increases from the maximum value of the parameter at the previous visit of the website.

In addition, the present invention is a personal information exposure response method, wherein the step (a), (a1) dividing the link statement into a page string and a parameter string to form a list of parameter strings using the page string as a key, ( a2) dividing a parameter included in the parameter string into a fixed or variable parameter type according to a parameter value format; (a3) a parameter in which the same web page is inquired by the link statement even if it is deleted from the link statement (hereinafter referred to as a dummy parameter) ) From the parameter string, (a4) removing duplicate parameter strings, or parameter strings in which neither fixed parameters nor variable parameters exist, and (a5) remaining parameter strings in the list. Increasing the variable parameters in the Characterized in that it also.

According to the present invention, in the personal information exposure response method, step (a2) comprises: (a21) dividing the parameter into a variable parameter if the parameter value is an integer type and a fixed parameter if the parameter value is not an integer type; Determining the maximum value of the parameter of the same parameter name, and (a23) converting the variable parameter to a fixed parameter according to the overlapping frequency of the parameter string in the list by the same parameter.

In addition, the present invention relates to a computer-readable recording medium recording a program for performing the personal information exposure response method.

As described above, according to the personal information exposure response system and method according to the present invention, the number of web pages to be fetched by retrieving the variable parameters of the dynamic webpages from the maximum value of the parameters at the previous visit when re-visiting the website The effect of retrieving the exposed personal information faster can be obtained by reducing.

In addition, according to the personal information exposure response system and method according to the present invention, by assessing the threat level on a website basis and by dividing the group into a different exposure response policy, by managing the websites that are likely to expose personal information more intensively The effect is to maximize the effectiveness of the response policy.

1 is a view showing the configuration of an entire system for implementing a personal information exposure response system and method according to the present invention.
2 is a diagram illustrating a concept of a personal information exposure response system using the personal information exposure response system and method according to the present invention.
3 is a block diagram of the configuration of a personal information exposure response system according to an embodiment of the present invention.
4 is a diagram for one example of generating a list of parameter strings in a link statement according to one embodiment of the present invention.
5 is a diagram illustrating an example of obtaining a parameter string including a variable parameter according to an embodiment of the present invention.
6 is a diagram illustrating a link sentence of a bulletin board according to an embodiment of the present invention.
7 illustrates a statistical screen managed by the personal information exposure response system according to an embodiment of the present invention.
8 is a diagram illustrating an example of a search period for each search group according to an embodiment of the present invention.
9 is a flowchart illustrating a personal information exposure response method according to an embodiment of the present invention.
FIG. 10 is a diagram illustrating a performance evaluation result of a system and method for exposing personal information according to an embodiment of the present invention. FIG.
Explanation of symbols on the main parts of the drawings
10: Website 20: Internet
30: personal information exposure response system 31: search unit
32: verification unit 33: verification unit
34: analysis unit 35: management unit
40: Database 41: Website DB
42: link information DB 43: analysis result DB

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, the configuration of the entire system for implementing the personal information exposure response system and method according to the present invention will be described with reference to FIG.

As shown in FIG. 1, the entire system for implementing the present invention is composed of a plurality of websites 10, a personal information exposure response system 30 (hereinafter, an exposure response system), and an administrator terminal 50. The website 10, the exposure response system 30, and the manager terminal 50 are all connected on the Internet 20. It may also include a database 40 for storing necessary data.

The website 10 is a site that provides a web page (or web service) on the Internet 20 and is implemented as a web server. That is, the website 10 is specified by a domain name and can be implemented by a plurality of web servers. Web servers can also be installed physically apart. Since a technology for building a website is a known technology, a detailed description thereof will be omitted.

The website 10 includes not only a portal site that provides a personal hosting service such as a personal homepage, a blog, a community site such as a cafe or a bulletin board, but also a site that provides various web services such as a bank and a shopping mall.

The exposure response system 30 is a server that visits the website 10 and searches web pages provided by the website 10 to analyze whether personal information is being exposed. The exposure response system 30 may be composed of a plurality of servers that perform detailed functions.

On the other hand, the exposure response system 30 uses the homepage of each website 10 as a seed to search all web pages linked directly or indirectly from the homepage. However, even if it is linked to a web page, it is preferable not to search web pages of other websites. For example, if the web page of the website A has posted the advertisement banner of the website B, the link to the advertisement banner is not retrieved during the search of the website A.

The exposure response system 30 determines whether or not the personal information by comparing the data provided on the web page with the personal information format. Personal information includes your social security number, driver's license number, internet personal identification number (I-PIN), passport number, e-mail address, telephone number, address, etc. Whether the information on the web page is personal information is determined using a technique such as pattern matching.

The personal information may have different importance and different degrees of handling depending on the type of personal information. For example, the resident registration number, driver's license number, etc. among the personal information is very important personal identification information, so if exposed at least one is determined to be very threatening. But e-mail is not a threat, even if one is exposed. However, if hundreds and tens of thousands of e-mails are exposed at the same time, personal information exposure can be considered very threatening.

The manager terminal 50 is a computer terminal used by an administrator, and means a computing terminal such as a personal computer (PC), a notebook computer, a netbook, a PDA, and the like.

The manager accesses the exposure response system 30 through the manager terminal 50 to view analysis data such as the collected personal information exposure status, or establish and input an exposure response policy. In addition, the manager directly visits the website 10 exposed by the exposure response system 30 to establish whether or not the actual exposure is occurring.

Hereinafter, the description of the administrator performing a certain task means the task performed by the administrator terminal 10. The reference numeral 10 is also attached to the manager in addition to the terminal.

Database 40 is a website DB 41, which stores websites by grouping them according to the threat level (hereinafter referred to as risk level or threat level, where risk level and threat level are used in the same sense.) The link information DB 42 stores link information of each web page of the site, and the analysis result DB 43 stores a result of analyzing a threat index of the web page and the web site. However, the configuration of the database 40 is only a preferred embodiment, and in the development of a specific device, it may be configured in a different structure by a database construction theory in view of the ease and efficiency of access and search.

Referring to FIG. 2, the concept of a personal information exposure response system using the personal information exposure response system 30 will be described in more detail. The personal information exposure response system quickly searches for personal information exposed through a web page and It refers to a system that responds comprehensively, including deletion measures and the spread of exposure situations. The personal information exposure response system is a system that searches and responds to personal information exposed on the web first.

The role of the personal information exposure response system is to search and verify the personal information exposed on the website, to manage and delete the status of personal information exposure, to analyze the cause of personal information exposure, and to study the comprehensive countermeasure for reducing the exposure, and to share the personal information in Korea. We will operate a hotline for cooperation and cooperate to delete personal information exposed to foreign countries.

In particular, since each major portal site has a greater influence on the Internet than other sites, close cooperation with the major portal sites is required in order to respond quickly to personal information exposure. Therefore, by sharing exposure information with these major portal sites, a hotline will be established to cope with infringement of personal information.

Next, the configuration of the personal information exposure response system 30 according to an embodiment of the present invention will be described with reference to FIG.

As shown in FIG. 3, the exposure response system 30 includes a search unit 31, a verification unit 32, a verification unit 33, an analysis unit 34, and a management unit 35.

The search unit 31 may search pages of a search target website to detect whether personal information is exposed through filtering, and may search for a page where personal information is exposed by using an existing search engine such as Google or Baidu. .

Recently, when constructing a bulletin board due to the development of Internet homepage technology, dynamic web pages such as JavaScript based page moving function and dynamic hypertext markup language (HTML) are frequently used. Since personal information exposure is often exposed through bulletin boards, dynamic pages are effectively analyzed and URL (Uniform Resource Locator) is extracted and processed.

In addition, the search unit 31 accesses a web site and searches a web page in which personal information is exposed, but searches only a new web page when the user visits the web site again. In other words, to improve the search speed, only new pages are visited when the user visits after the initial visit. UPM (URL Parameter Matrix) and HTTP (HyperText Transfer Protocol) HTTP header information are used to search whether the page is changed and only newly created pages. Apply algorithms to do this. Each algorithm is as follows.

First, the search unit 31 divides the link statement into a page string and a parameter string to form a list of parameter strings using the page string as a key.

Dynamic web pages among the search engine result files generate a list of parameter strings (hereinafter referred to as parameter matrices) using page strings as keys using a full URL list file (domain.urllist). The link statement is divided into a page string and a parameter string separated by '?'. The parameter matrix may have a plurality of parameter string lists as values using the page string as a key.

For example, if there is a link text as shown in FIG. 4A, the link text is a link text for a dynamic web page since there is a symbol "?". At this time, the string "http://www.nbkoreashop.com/shop/shopview.asp" before the "?" Of the link statement is the page string, and the string "search_product = & pdtcd = A110 & ... & ITEM_STYLE after the"? " = NBPQ9S202M "is a parameter string.

Next, the search unit 31 classifies the parameters included in the parameter string into fixed or variable parameter types according to the parameter value format.

A parameter has a parameter name, a parameter type, and a parameter value and is expressed as "name: type: value (or parameter name: parameter type: parameter value)". The parameter type is represented by the fixed parameter (or string type parameter) S and the variable parameter (or integer parameter) I.

Each parameter extracted from the parameter string of FIG. 4A is as shown in FIG. 4B. Each parameter is separated by the symbol "&" in the parameter string. Search product, Pdtcd, ..., ITEM_STYLE and all 10 parameters. The extracted parameters are expressed as "parameter name: parameter type: parameter value". At this time, parameters whose parameters are integers are gray background parameters such as cPage, ViewCount, and Item sec. These parameters become variable parameters I soon.

Next, the search unit 31 removes from the parameter string a parameter (hereinafter, referred to as a dummy parameter) for which the same web page is inquired by the link text even if deleted from the link text. The process of removing a dummy parameter includes a preprocessing step of removing a parameter previously known as a dummy parameter and a parameter that deletes a parameter, regenerates a link statement, requests a corresponding web page, and removes the result if the received web page is the same. It is divided into verification stages.

The preprocessing step removes parameters that have no parameter values or that contain page, pg, or cPage. For example, in FIG. 4B, Search_product and Item_class are removed because there is no parameter value, and cPage is removed because it is previously set as a dummy parameter. The result of removing the dummy parameter by the preprocessing step is shown in FIG. 4C.

Next, in the parameter verification step, the search unit 31 searches the web page with the parameter string from which the parameter has been removed, so that the signature and page size of the web page before the web page exists and the searched web page exist before the web page is removed. If it is the same, the removed parameter is determined as a dummy parameter.

That is, the parameter verification step checks whether each parameter is a used parameter for each parameter string. All parameters of the parameter string are combined with the page string to create a link (URL) to download the web page of the link (URL) to generate a page size and signature. Next, delete parameters in order, get the HTTP header information of the relevant link (URL), check if the return code is 200, download the page, and generate the page size and signature. Compares the signature and page size of the webpage without the parameter to see if it is the same page. If the return code is not 200 or is not the same page, the deleted parameter is determined to be used.

For example, FIG. 4D is a link statement (URL) generated after removing SortName and SortKey among the parameters of FIG. 4C. If the size and signature of the web page downloaded by the link text of FIG. 4D are compared and determined to be the same web page, the parameters SortName and SortKey are removed. The parameter passed through the verification step is shown in FIG. 4E.

Next, the search unit 31 removes duplicate parameter strings or parameter strings in which neither fixed parameters nor variable parameters exist. At this time, the search unit 31 classifies the parameter as a variable parameter if the parameter value is an integer type, or a fixed parameter if it is not an integer type, and sets the parameter value of the variable parameter as the maximum value of the parameter of the same parameter name.

In FIG. 5A, three parameter strings including the variable parameter num are provided, but parameter values of num are 100, 120, and 80. At this time, the parameter value of the variable type num is set to 120, which is the maximum value. Accordingly, all three parameter strings become the same parameter string, and two are removed and only one remains due to duplication.

Also, as shown in 5b, the parameter strings "board: S: free &" and "num: I: 120 &", in which neither the fixed parameter nor the variable parameter exist, are removed from the list.

Meanwhile, the search unit 31 converts the variable parameter into a fixed parameter according to the overlapping frequency of the parameter string in the list by the same parameter. That is, the integer parameter (variable parameter) of the parameters is changed to a string type parameter when the number of parameter values from which duplication is removed with respect to the total number of parameter values is equal to or less than a specific reference value (for example, 10%). If it is below a certain reference value, even if the number is a codeability parameter, it cannot be a variable parameter.

Referring to the link statements of the bulletin board of FIG. 6A, a parameter string of the same type is repeated as shown in FIG. 6B. In other words, the parameter no is repeated in 20, 21, 23, 24, 25.

Meanwhile, the search unit 31 searches all the web pages of the website directly or indirectly linked from the website homepage. In particular, when the web page is a dynamic web page, the search unit 31 analyzes a parameter string of a link sentence of the dynamic web page, increases a parameter, and searches for a series of web pages linked by the link sentence. The value is increased from the maximum value of the parameter on the previous visit of the website. That is, set the value of the parameter to the maximum value of the parameter at the previous visit and increase it.

That is, the search unit 31 analyzes the dynamic web page and obtains a parameter determined as a variable parameter among parameter strings as described above, and increases the parameter to search for a series of web pages linked by a link statement. That is, when the user visits the website again using the parameter value, the searcher finds whether there is a higher value than this value and searches for a new page to increase the search efficiency.

For example, as shown in Fig. 6B, the variable parameter "no" is obtained and the parameter value is set to 25, which is the maximum value. The variable parameter "no" is increased from 1 to 25 to search and search the website.

And the next visit to the webpage of FIG. 6B again has a higher maximum value. In the meantime, as new posts are posted on the bulletin board, the bulletin board's article number is increased. For example, if the maximum value of "no" is 50 at the time of re-visit, the web page up to 50 is searched by increasing from the previous maximum value of 25. Therefore, search by increasing the parameter "no" to 26, 27, ..., 50.

Meanwhile, the search unit 31 obtains HTTP header information and checks whether the return code is 200 when the static web page is one of the search engine result files, stores the page, and generates a page size and signature. Check whether the page is the same by comparing the signature and page size of the page without deleting the parameter. If the return code is not 200 or is not the same page, it is recognized as a new page and searched.

Next, the verification unit 32 analyzes the searched web page, and calculates the threat index of the web page indicating the exposure level of the personal information and the fact index of the web page determining whether the personal information is exposed.

The verification unit 32 analyzes the searched pages, applies the validity of personal information, and calculates a threat index and a fact index in order to accurately extract personal information exposure facts from the searched large amount of web resources. These two indices are later used by the verification unit 33 in combination with the reliability index to measure the threat level, and the threat level is used to dynamically set the search period of the search target list (website list). Threat index and fact index are as follows.

The verification unit 32 calculates a numerical value by [Equation 1] by using the exposure information attribute (exposure type, number, exposure type combination) for each page.

[Equation 1]

Where n is the number of types of personal information, S is the fact index with 0 or 1, C is the number of exposed personal information, P is the weight according to the type of personal information, and W is the score of the web page vulnerability. This is referred to hereinafter as "vulnerability of web pages").

The verification unit 32 sets the fact index by determining whether it is true that it is determined to be exposed to PII-Personal Identification Information (or personal information). Preferably, the fact index has a value of zero or one.

The fact index is calculated to be 1 if it satisfies certain criteria according to the type of personal information, and 0 if it is not satisfied. For example, social security number or driver's license number is very important personal information, so if any one is exposed, it is considered to be exposed. For example, the verification unit 32 determines that 10 or more e-mail addresses are found in one web page.

Next, the verification unit 33 receives the correspondence to the searched web page to calculate the reliability index of the website.

Visually check the filtered exposure personal information / vulnerabilities, determine whether the exposure / vulnerabilities are true or serious through the exposure personal information / vulnerability threat level calculation interface, and automatically process and upgrade the exposure personal information / vulnerability response level interface. Distribution and history can be tracked. In addition, SMS, e-mail transmission interface is provided for the person in charge to delete, and the reliability index to be used for risk level is calculated according to the person's deletion.

The verification unit 33 receives the history processed by the person in charge of deletion and the corresponding history of the exposure, and calculates the reliability for each website. For example, you can quickly respond to deletion of exposed sites, or increase the reliability when the number of impressions is small.

The reliability index of the website is calculated by [Equation 2].

[Equation 2]

Where R is the number of responses, Total is the number of exposures, and W is the weight of the response period.

The reliability index generated in this way can be used later to assess the risk level of each site in the analysis system.

Next, the analysis unit 34 calculates the threat level of the website using the reliability index of the website.

The analysis unit 34 calculates the risk level through the threat index, the fact index, and the reliability index calculated by the verification system and the verification system, and generates statistical data for analyzing the exposure response status. 7 is a statistical screen managed by the personal information exposure response system to quickly respond to the exposure of personal information.

These statistics screens include social security number exposure trend, major personal information (except social security number) exposure status, real-time personal information exposure scale, website distribution by risk group, social security number exposure trend (Google search), social security number exposure trend (Baidu search), national social security number Exposure trends (Google, Baidu search), worldwide social security number exposure distribution, domestic exposure social security number deletion processing status, domestic exposure main personal information (except social security number) deletion processing status, China exposure social security number deletion processing status, foreign exposure social security number deletion processing status, website By displaying graphs of search processing status, search status by risk group, search completion rate on the day, social security number deletion processing status, and search completion website status, the situation room worker monitors personal information exposure trend in real time and reduces personal information by analyzing the cause of exposure. Synthesis Gives provides data to study the book.

By checking the various indicators generated by the analysis unit 34, the management unit 35 reflects the policies for searching, verifying, and responding, thereby enabling the construction of an intelligent system. In addition, the analysis unit 34 which mainly performs a batch job may utilize optimized resources such as mounting a corresponding module so that a verification role may be performed at idle time when the batch job is not performed. Build with system

 The risk level of the website is calculated by Equation 3.

&Quot; (3) "

Where n is the number of exposed web pages of the website, T is the reliability of the website, and value is the threat index of the web page.

The risk level calculated in this way is divided into five search groups (high risk, risk, moderate risk, moderate, and stable) based on this value. do.

For example, if a large amount of personal information is discovered on a website called A, the management unit 35 calculates a new risk level using the threat index, the fact index and the reliability index of the website. In addition, it provides flexibility in the system by rearranging search target groups so that this website can be searched frequently.

Next, the management unit 35 is set by the verification unit 33 or the analysis unit 34, the threat level for the exposure personal information / vulnerability determined and confirmed, and the target website (domain) administrator to email, SMS, Requests corrective action requests to the site by telephone or in writing and provides a function to track and manage the history of the requested corrective action. It also provides an interface for sharing issues and information. It is composed of an exposure / deletion process operated by the management unit 35 and a web interface provided to the search target website administrator. The management unit 35 has an interface for informing the actual site personnel of the threat of personal information of each site.

In addition, the management unit 35 divides the websites into search groups by using the threat level, and varies the exposure response policy of the websites according to the search groups.

The management unit 35 provides an interface for managing overall policies and system resources of the PIRST system, such as managing exposure deletion processes, managing search policies, and managing environment variables. Exposure response system system such as execution result of exposure personal information response process, search policy, exposure / vulnerability signature and environment variable management, inspection target domain management, exposure inspection system server / network status management, and personal information exposure response situation room interlock data item setting Build a system to provide integrated management of the system.

In particular, as shown in Figure 8, based on the threat level calculated by the analysis unit 34 to classify the search target website into five search groups to visit the website at different intervals to find the exposed personal information policy The function to set up the system can be operated flexibly.

Next, the personal information exposure response method according to an embodiment of the present invention will be described with reference to FIG. The method is a personal information exposure response method of the system 30 that retrieves a web page provided by a website 10 on the Internet and collects and manages personal information exposure information of the website.

As shown in FIG. 9A, the method includes (a) the system 30 accessing the website 10 to search for a webpage where personal information is exposed, and then revisit the website 10. Searching only a web page (S10); (b) the system 30 analyzes the searched web page, and calculates a threat index of the web page indicating the exposure level of personal information and a fact index of the web page determining whether the personal information is exposed (S20). ; (C) the system 30 calculates the reliability index of the website (10) by receiving the correspondence to the searched web page (S30); (d) calculating the threat level of the website (10) by using the reliability index of the website (10) (S40); And (e) the system 30 classifying the website 10 into a search group using the threat level, and varying the exposure response policy of the website 10 according to the search group (S50). Are distinguished.

In particular, in the step (a), all the web pages of the website directly or indirectly linked from the home page of the website 10, and if the web page is a dynamic web page, the parameters of the link statement of the dynamic web page The string is analyzed to increase a parameter to retrieve a series of web pages linked by a link statement, but increase from the maximum value of the parameter on a previous visit of the website.

As shown in FIG. 9B, the step (a) comprises: (a1) dividing the link statement into a page string and a parameter string to form a list of parameter strings using page strings as keys (S10) and (a2) Steps of classifying the parameters included in the parameter string into the fixed or variable parameter types according to the format of the parameter value (S12), (a3) The parameter in which the same web page is inquired by the link statement (hereinafter, dummy parameter) ) In the parameter string (S13), (a4) removing the parameter string in which neither the fixed parameter nor the variable parameter exists in the list (S14), and (a5) in the parameter string remaining in the list. In step S15, a series of web pages are searched by increasing the variable parameters.

In addition, as shown in Figure 9c, the step (a2), (a21) if the parameter value is an integer type, the step of classifying the parameter into a fixed type, if not integer type (S12a), (a22) the parameter value of the variable parameter Is determined as a maximum value of a parameter of the same parameter name (S12b), and (a23) the variable parameter is converted into a fixed parameter according to the frequency of overlap of the parameter string in the list by the same parameter (S12c).

The omitted part of the description of the personal information exposure response method refers to the description of the personal information exposure response system described above.

Next, the performance evaluation by the personal information exposure response system and method according to the present invention will be described with reference to FIG.

FIG. 10A is a result of selecting and testing seven websites in order to compare the results of the system and method for personal information exposure with the search volume by Google's search engine and other search engines.

As shown in FIG. 10B, as a result of improving the performance of the search engine and comparing the performance with other search engines, most of the web resources were measured.

According to the system and method for responding to personal information exposure according to the present invention, it is established as an independent system without relying on a third party provided search engine such as the existing Google inspection and verified through prompt search of personal information exposure and responds to the situation accordingly. Secondary damage from information misuse or misuse can be prevented in advance.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the said Example, this invention is not limited to the said Example and can be variously changed in the range which does not deviate from the summary.

The present invention is applicable to the development of a personal information exposure response system capable of searching for a web page provided by a website on the Internet, collecting personal information exposure information, and promptly deleting and responding to exposed personal information. In particular, the present invention can be applied to the development of a system for evaluating the threat level on a website basis and dividing it into groups to change the exposure response policy.

Claims (14)

In the personal information exposure response system that collects and manages personal information exposure information of the website by searching a web page provided by a website on the Internet,
A search unit which accesses the web site and searches for a web page exposed to personal information, but searches only a new web page when the user visits the web site again;
A verification unit for analyzing a searched web page and calculating a threat index of a web page indicating an exposure level of personal information and a fact index of a web page determining whether personal information is exposed;
A confirmation unit for calculating a reliability index of the website by receiving a response to the searched web page;
An analysis unit for calculating a risk level of the website using the reliability index of the website;
Personal information exposure response system comprising a management unit for classifying the website into a search group by using the risk level, and different exposure response policy of the website according to the search group.
The method of claim 1, wherein the search unit,
Search all the webpages of the linked website from the website's homepage,
If the web page is a dynamic web page, the parameter string of the link text of the dynamic web page is analyzed, and the parameter is increased to retrieve a series of web pages linked by the link text, but the maximum value of the parameter is the previous visit of the website. Personal information exposure response system characterized by increasing from.
The method of claim 2, wherein the search unit,
The link statement is divided into a page string and a parameter string to form a list of parameter strings using the page string as a key.
The parameters included in the parameter string are classified into fixed or variable parameter types according to the format of parameter values,
Even if deleted from the link statement, a parameter (hereinafter, referred to as a dummy parameter) in which the same web page is searched by the link statement is removed from the parameter string.
Duplicate parameter strings, or parameter strings in which both fixed and variable parameters do not exist, are removed from the list,
Personal information exposure response system, characterized by retrieving a series of web pages by increasing the variable parameters in the parameter string remaining in the list.
The method of claim 3, wherein the search unit,
If the parameter value of the parameter is an integer, it is classified as a variable parameter, and if the parameter value of the parameter is not an integer, it is classified as a fixed parameter, and the parameter value of the variable parameter is determined as the maximum value of the parameter of the same parameter name,
And a variable parameter is converted into a fixed parameter according to the frequency of overlap of the parameter string in the list by the same parameter.
The method of claim 3, wherein the search unit,
If the web page is searched with the parameter string with parameters removed and the searched web page exists and the signature and page size of the searched web page are the same as the web page before removal, the removed parameter is determined as a dummy parameter. Personal information exposure response system.
The method of claim 1,
Threat index value _k is personal information corresponding exposure system characterized in that the estimated by [Formula 1] of the Web page k.
[Equation 1]

Where n is the number of types of personal information, S is the fact index with 0 or 1, C is the number of exposed personal information, P is the weight according to the type of personal information, and W is the vulnerability of the webpage.
The method of claim 6,
Personal information exposure response system, characterized in that the reliability index of the website is calculated by [Equation 2].
[Formula 2]

Where R is the number of responses, Total is the number of exposures, and W is the weight of the response period.
The method of claim 7, wherein
Personal information exposure response system, characterized in that the risk level of the website is calculated by [Equation 3].
[Equation 3]

Where n is the number of exposed web pages on the website, T is the reliability of the website, and value is the threat index of the web page.
The method of claim 1,
The management unit according to the search group personal information exposure response system, characterized in that for varying the visit period for the website belonging to the search group.
In the personal information exposure response method of the system for retrieving a web page provided by a website on the Internet to collect and manage the personal information exposure information of the website,
(a) accessing the website and searching for a webpage where personal information is exposed, but retrieving only the new webpage when the user visits the website again;
(b) analyzing the searched web pages to calculate a threat index of the web page indicating the exposure level of the personal information and a fact index of the web page determining whether the personal information is exposed;
(c) calculating a reliability index of the web site by receiving whether the web page corresponds to the searched web page;
(d) the system calculating a risk level of the website using the reliability index of the website; And
(e) the system categorizing the website into a search group using the risk level, and changing the exposure response policy of the website according to the search group.
The method of claim 10, wherein in step (a),
Search all the webpages of the linked website from the website's homepage,
If the web page is a dynamic web page, the parameter string of the link text of the dynamic web page is analyzed, and the parameter is increased to retrieve a series of web pages linked by the link text, but the maximum value of the parameter is the previous visit of the website. Personal information exposure response method characterized by increasing from.
The method of claim 11, wherein the step (a),
(a1) dividing the link statement into a page string and a parameter string to construct a list of parameter strings using the page string as a key;
(a2) dividing a parameter included in the parameter string into a fixed or variable parameter type according to a parameter value format;
(a3) removing a parameter (hereinafter, referred to as a dummy parameter) from which the same web page is searched by the link statement even if deleted from the link statement, from the parameter string,
(a4) removing duplicate parameter strings, or parameter strings in which neither fixed parameters nor variable parameters exist, from the list, and
and (a5) retrieving a series of web pages by increasing the variable parameters in the parameter string remaining in the list.
The method of claim 12, wherein step (a2) comprises:
(a21) if the parameter value of the parameter is an integer, dividing it into a variable parameter, and if the parameter value of the parameter is not an integer, dividing it into a fixed parameter,
(a22) determining the parameter value of the variable parameter as the maximum value of the parameter of the same parameter name, and
and (a23) converting the variable parameter into a fixed parameter according to the overlapping frequency of the parameter string in the list by the same parameter.
A computer-readable recording medium having recorded thereon a program for performing the personal information exposure response method according to any one of claims 10 to 13.

Images