KR101085509B1 - Computer screen scanning system and method for digital forensics - Google Patents

Abstract

PURPOSE: A computer screen scanning system and method for digital forensics is provided to prevent the generation of security accident by transmitting, collecting, and analyzing computer screen information in high speed. CONSTITUTION: A screen image receiver(131) reorganizes a screen image which is received from a network adaptor of a user computer by the user computer, a screen image identification number, and a transmission time. A screen image classifier(132) classifies the re-organized image and includes the classified image in an image group object. An image storage(134) changes the image group object into a file and stores the changed file to an image storage. A text extractor(135) extracts text from the image.

Description

COMPUTER SCREEN SCANNING SYSTEM AND METHOD FOR DIGITAL FORENSICS}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to digital forensics, and in particular, computer screen scanning for digital forensics that can collect, store, and analyze screen information of a user's computer at high speed necessary for digital forensics, which performs security accident prevention and investigation in the information and communication field. It's about the system.

Due to the rapid increase in security incidents due to illegal information access or information leakage by internal users and external intruders, the damages to individuals, companies, and public institutions are enormous, and various security-related technologies have been developed to prevent them. have.

Various technical methods have been developed and introduced to collect user computer screens as a means to prevent internal data access and leakage and to follow up, and these technologies focus on the ability to simultaneously transmit and collect user screens.

Among various methods, the method of using the screen capture program API causes a system delay caused by the system load generated during screen capture. For this reason, by setting a long capture period of the program, there is a problem that does not come close to the purpose of simultaneous simultaneous transmission.

In addition, the memory copy method through direct access to the video memory saves some of the system load, but there is a problem in that the simultaneous transmission is limited due to the system load that occurs during the program copying the memory, checking the screen, and analyzing the screen segment. .

In addition, there is a problem in that a method of installing the screen signal duplication and transmission device between the computer monitor and the main body must bear the inconvenience of installation, maintenance and improvement.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is possible to perform simultaneous simultaneous collection, transmission, and recording of computer screens without incurring a delay in using a computer at the same level without the need for computer-specific screen signal replication and transmission devices. It is an object of the present invention to provide a computer screen scanning system for digital forensics that can implement a method and a system used therein to provide related information in a security incident prevention and investigation process.

In order to achieve the above object, a computer screen scanning system for digital forensics according to the present invention comprises: at least one user computer; And a test computer for collecting, storing, and analyzing screen images received through the network from the user computer, wherein the user computer comprises a screen image identical to a screen image provided by a real display adapter and a real monitor from a computer operating system. A virtual display adapter and a virtual monitor virtually generated to receive the distribution; And a network adapter for packetizing the screen image distributed from the virtual monitor and transmitting the packetized screen image to the inspection computer through a network.

delete

The inspection computer may further include: a screen image receiver configured to reconstruct the screen image received from the network adapter of the user computer according to a user computer, a screen image identification number, and a transmission time using packet header information of the screen image; The reconstructed image generated by the screen image receiving unit is classified into image groups according to a user computer, a screen image identification number, and a transmission time by using tag information of the image, and the classified images are classified into user computer screens and time zones. A screen image classification unit included in the image group object; An image storage unit for monitoring the image group object and converting the image group object into a file based on a set period or threshold capacity and storing the image group object in an image storage; A text extraction unit for extracting text from an image stored in the image storage; The text extractor may include a text indexer configured to index text extracted from the text extractor based on an image, text content, and the number of times of extracting the text, and then classify the extracted text into an image-text associated index storage and a text index storage.

In addition, the image storage unit or the text extraction unit may further include an image compression unit for receiving the image from the user's computer screen or time zone to form a group and compress it into a separate file.

In order to achieve the above object, a computer screen scanning system for digital forensics according to the present invention comprises: at least one user computer; An inspection computer for collecting, storing and analyzing screen images received from the user computer through a network; It comprises a screen image generating device including any one or more of the RGB Matrix Switcher, DVI Matrix Switcher, CCTV, DVR to generate a screen image, the inspection computer in the form of a packet through the network from the screen image generation equipment Receiving a screen image, or receiving a screen image through an image dedicated cable, and collects and stores the received screen image, characterized in that for analysis.

In order to achieve the above object, a computer screen scanning system for digital forensics according to the present invention comprises: at least one user computer; And a test computer for collecting, storing and analyzing screen images received from the user computer through a network, wherein the computer screen scanning system includes a plurality of test computers, and the user computer and the test computer, or a plurality of test computers. The inspection computer is characterized in that the screen image transmission and reception between each other by any one of the UDP / IP method and the TCP / IP method.

In addition, the one test computer may have a function of copying or distributing the screen image received from the user computer to another test computer.

In addition, the user computer may have a function of notifying whether the transmitted screen image is compressed, transmitting only an update pixel of the screen image, obtaining authorization for blocking screen image transmission, and notifying real-time simultaneous recording of the screen image.

In addition, the inspection computer may search for or search for one or more of the screen image generation time, the user computer on which the screen image is generated, the user computer monitor identification number on which the screen image is generated, and the indexed text in association with the screen image. It can be provided with the function provided on condition.

In addition, the inspection computer may include a function of controlling whether one or more of a screen image of the user computer is scanned, a scanning period, a scanning quality, and a scanning area.

Meanwhile, in order to achieve the above object, the computer screen scanning method for digital forensics according to the present invention includes the steps of distributing the same screen image as the screen image provided on the actual monitor of at least one user computer and transmitting the same to the inspection computer; ; Reconstructing the transmitted screen image by the inspection computer according to a user computer, a screen identification number, and a transmission time using packet header information of the screen image; Classifying and storing the reconstructed image generated by the inspection computer into image groups according to a user computer, a screen identification number, and a transmission time by using tag information of the image; Extracting text from the stored image at the inspection computer; Indexing and storing the extracted text on the basis of the extracted text, the extracted image, the text content, and the number of times of extraction; And inputting a search condition of at least one of a user computer, a monitor of the user computer, a screen image generation time, and indexed text to the inspection computer to search and search the user computer.

According to the present invention, it is possible to more easily perform the information security incident prevention and investigation process by providing a function of high-speed, continuous transmission, collection and analysis of a plurality of computer screen information without a separate collection device or computer performance degradation. have.

1 is a conceptual diagram of a computer screen scanning system for digital forensics according to the present invention.
2 is a block diagram of a user computer in accordance with the present invention.
3 is a block diagram of an inspection computer according to the invention.
4 is a flow chart illustrating a computer screen scanning method for digital forensics in accordance with the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, in order to prevent illegal access and leakage of managed information such as high technology, state secrets and military security, it is necessary to monitor and track "exchange between user and computer" or "exchange between computer and data medium." Among them, the present invention relates to the "exchange of information between a user and a computer", and the technical goal of the various methods of monitoring the exchange of information between a user and a computer is to monitor the user's computer performance and communication system without affecting the overall system. There is no point of security vulnerability in the scope or method of surveillance.

1 is a conceptual diagram of a computer screen scanning system for digital forensics according to the present invention, FIG. 2 is a block diagram of a user computer according to the present invention, and FIG. 3 is a block diagram of an inspection computer according to the present invention.

As shown in the figure, the computer screen scanning system for digital forensics according to the present invention is largely connected to the user computer 110, the user computer 110 connected to a network network 120 consisting of an internal network or the Internet network, etc. It comprises a screen image generating equipment 150 connected to the computer 130 and the inspection computer 130 by a network 120 or an image dedicated cable 151.

The user computer 110 refers to one or more computers accessible to management target information.

The inspection computer 130 refers to a computer for receiving, collecting, storing, and analyzing screen images in a packet form from the user computer 110 through the network 120.

The inspection computer 130 receives the screen image in the form of a packet from the screen image generating apparatus 150 through the network 120 or receives the screen image through the image-only cable 151 and receives the screen image. Image information may be collected and stored for analysis.

The screen image generating device 150 refers to an RGB matrix switcher, a DVI matrix switcher, a CCTV, a DVR, etc., capable of generating a screen image.

On the other hand, the user computer 110, specifically, in addition to the computer operating system 111, keyboard / mouse 112, high-speed data bus 113, the actual display adapter 114 and the actual monitor 115, the actual display adapter ( The virtual display adapter 116, the virtual monitor 117, and the virtual monitor 115, which are virtually generated so that the screen image having the same resolution and number of colors as the screen image provided from the computer operating system 111 is provided by the computer 110. And a network adapter 118 for packetizing the screen image distributed by the virtual monitor 117 and transmitting the packetized screen image to the inspection computer 130 through the network 120. In the case of the virtual display adapter 116 and the virtual monitor 117, it is generated in software to receive the screen image.

The computer operating system 111 recognizes the virtual display adapter 116 as a clone monitor to provide the same screen image as the actual display adapter 114 to the virtual display adapter 116. Therefore, the computer operating system 111 distributes the same screen image to the virtual display adapter 116 via the high speed data bus 113, which is transmitted to the actual display adapter 114. The high speed data bus 113 is a data bus that provides a connection between a CPU, memory, and other devices and display adapters that are PCI-Express, PCI, AGP, or the like in the main board of the user computer 110.

In this case, the method of transmitting the screen image from the computer operating system 111 to the virtual display adapter 116 has a lower level of computer resources than the screen capture program API method and the copy method through direct access to the video memory, which is an improved method. It is desirable to provide the same level of screen transmission as the method of installing a hardware-based screen signal replication and transmission device between the computer monitor and the main body.

For reference, the user computer 110 may not convert the number of pixels and the number of colors of the screen during screen image transmission to increase the preservation value as evidence. However, in order to improve transmission efficiency, it is preferable to apply an image compression method or a method of transmitting only changed screen pixel information at a limited level in order to prevent overlapping of the same pixel information.

In addition, the user computer 110 may include a function of compressing the transmitted screen image, transmitting only an update pixel of the screen image, obtaining authorization for blocking screen image transmission, and notifying real-time simultaneous recording of the screen image. Do.

For example, the authority check to prevent the user using the user computer 110 from blocking the screen image transmission of the user computer 110 that is arbitrarily used without the approval of the administrator with the security management authority or the approval of the inspection computer 130. It is to have a security function for.

In addition, it is preferable to have a function of informing the user that the computer screen image is simultaneously recorded in real time after logging in to the computer operating system 111 or at a set interval, and inducing the user to give up when the user has an illegal intention. .

The inspection computer 130 may include a screen image receiver 131, a screen image classifier 132, an image storage unit 134, a text extractor 135, an image compressor 136, an image storage unit 137, Text indexing unit 138, image-text associative index storage 139, and text index storage 140.

The screen image receiving unit 131 reconstructs the screen image received from the network adapter 118 of the user computer 110 according to the user computer, the screen image identification number, and the transmission time using the packet header information of the screen image. .

The screen image classifying unit 132 checks the user computer screen image and the generation time using the image information of the image reconstructed by the screen image receiving unit 131 by using the tag information of the image. The images are classified by image groups according to the transmission time, and the classified images are included in the corresponding image group object 133. As a result, since the image group object 133 is composed of a user computer screen image and separate objects divided by time zones, one or more screen images are arranged in each image group object 133 in chronological order.

The image storage unit 134 monitors the image group object 133 in real time, converts the file into a file based on a preset period or threshold capacity, and stores the image group object 133 in the image storage 137.

The text extractor 135 extracts text from an image stored in the image storage 137. For example, the text may be extracted from the stored image using an optical character recognition algorithm in which morphological characteristics, colors, neural network theory, and statistical methods are considered.

The text indexer 138 indexes the text extracted by the text extractor 135 in consideration of the image, text content, and the number of times the text is extracted, and then the image-text association index storage 139 and the text. The index storage 140 stores them separately. Specifically, among the indexed data, the identifier, the text content, the number of text identification, the text risk, and the text identification time of the individual text are stored in the text index storage 140, and the individual images and the text index storage 140 of the image storage 137 are stored. Associations between the individual texts of < RTI ID = 0.0 >) < / RTI >

The text extraction unit 135 and the text indexing unit 138 may be operated simultaneously with the image storage unit 134, or may be operated only at the time required by the administrator for post-security analysis or other purposes. When operated simultaneously with the image storage unit 134, an operation method such as an operation method, a pixel change pattern method, or a setting cycle method according to a constant operation method condition may be separately set.

The image compressing unit 136 receives an image from the image storing unit 134 or the text extracting unit 135 and organizes the image into individual files according to user computer screen information or time zone criteria.

That is, the image compression unit 136 is configured to group the images received from the image storage unit 134 or the text extraction unit 135 into groups according to user computer screen information or time zone or other criteria, and compress them into individual files. This function is to provide an effect of saving disk resources of the inspection computer 130.

The computer screen scanning system according to the present invention may be provided with a plurality of inspection computers 130 to provide a system load and an uninterrupted service according to an image analysis process. In this case, one surveillance computer 130 transmits the received screen image to another surveillance computer 130 in the form of copying or distributing the screen image. In this case, the user computer 110 and the test computer 130, or the plurality of test computers 130 may transmit and receive the screen image between any one of the UDP / IP method and the TCP / IP method.

The TCP / IP transmission method has an advantage of requesting retransmission of data in the case of a reception error using the Three Way Handshake principle. However, it is desirable to provide the UDP / IP method as a basic option because the high transmission efficiency characteristics provided by the UDP / IP method with unidirectional high-speed data transmission are more in line with the operation concept of the computer screen scanner system. However, it is more preferable to apply a screen pixel correction algorithm conforming to the screen transmission concept in order to correct transmission errors when the UDP / IP method is applied.

The inspection computer 130 may search for one or more of the screen image generation time, the user computer on which the screen image is generated, the user computer monitor identification number on which the screen image is generated, and the indexed text in association with the screen image. It is desirable to have a function for providing a search condition.

In addition, the inspection computer 130 preferably has a function of controlling whether one or more of a screen image of the user computer 110 is scanned, a scanning period, a scanning quality, and a scanning area.

4 is a flowchart illustrating a computer screen scanning method for digital forensics according to the present invention.

First, a screen image identical to the screen image provided on the actual monitor of the user computer 110 is distributed and transmitted to the test computer 130 (S110).

Subsequently, the screen image received by the inspection computer 130 receiving the screen image is reconstructed according to the user computer, the screen identification number, and the transmission time by using the packet header information of the screen image (S120).

Subsequently, the inspection computer 130 classifies and reconstructs the image generated by reconstructing the image group according to a user computer, a screen identification number, and a transmission time by using tag information of the image (S130).

Subsequently, the inspection computer 130 extracts text from the stored image (S140).

Subsequently, the inspection computer 130 indexes and stores the extracted text on the basis of the extracted text, the extracted image, the text content, and the number of times of extraction (S150).

Finally, the inspector inputs one or more search conditions among the user computer, the monitor of the user computer, the screen image generation time, and the indexed text to the test computer 130 to search and search the user computer (S160).

That is, when an inspector inputs a search condition, that is, a search option, to the inspection computer 130 for the purpose of analyzing a security incident or collecting evidence data, the inspector checks the search result that satisfies the search selection condition on the inspection computer 130. To provide.

The inspection computer 130 searches the image storage 137, the image-text associative index storage 139, and the text index storage 140 when the inspection computer 130 determines whether it owns the scanning material corresponding to the search option. The search results are provided to the inspector. In the process, when the other inspection computer 130 retains the scanning data, the inspection option is relayed to the other inspection computer 130 and the other inspection computer 130 relays the search results to the inspection computer 130. Will reply.

On the other hand, while the computer screen scanning system for digital forensics according to the present invention has been described according to a limited embodiment, the scope of the present invention is not limited to a specific embodiment, it will be apparent to those skilled in the art in connection with the present invention. Various alternatives, modifications, and changes can be made within the scope of this.

Accordingly, the embodiments disclosed in the present invention and the accompanying drawings are not intended to limit the technical spirit of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by the embodiments and the accompanying drawings. . The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

110: user computer 111: operating system
112: keyboard / mouse 113: high-speed data bus
114: real display adapter 115: real monitor
116: virtual display adapter 117: virtual monitor
118: network adapter 120: network
130: inspection computer 131: screen image receiving unit
132: screen image classification unit 133: image group object
134: image storage unit 135: text extraction unit
136: image compression unit 137: image storage
138: text indexing unit 139: image-text association index storage
140: text index storage 150: screen image generating equipment
151: Video dedicated cable

Claims (11)

delete A computer screen scanning system,
One or more user computers 110;
Including the inspection computer 130 for collecting and storing the screen image received through the network 120 from the user computer 110,
The user computer 110,
A virtual display adapter 116 and a virtual monitor 117, wherein the real display adapter 114 and the real monitor 115 are virtually generated to receive the same screen image as the screen image provided from the computer operating system 111;
A computer screen for digital forensics comprising a network adapter 118 for packetizing the screen image distributed from the virtual monitor 117 and transmitting the packetized screen image to the inspection computer 130 through the network 120. Scanning system. The inspection computer 130 of claim 2,
A screen image receiver 131 for reconstructing the screen image received from the network adapter 118 of the user computer 110 according to the user computer, the screen image identification number, and the transmission time by using the packet header information of the screen image;
The reconstructed image generated by the screen image receiving unit 131 is classified into image groups according to a user computer, a screen image identification number, and a transmission time by using tag information of the image, and the classified images are divided into user computer screens and time zones. A screen image classifier 132 to include the divided image group object 133;
An image storage unit 134 for monitoring the image group object 133 and converting the image group object 133 into a file based on a set period or a threshold capacity and storing the image group object in the image storage 137;
A text extraction unit 135 for extracting text from an image stored in the image storage unit 137;
The text extracted by the text extractor 135 is indexed based on the extracted image, text content, and the number of extractions of the text, and then separately stored in the image-text associated index storage 139 and the text index storage 140. And a text indexing unit (138) for digital forensics. The method according to claim 3,
The image storage unit 134 or the text extraction unit 135 is provided with an image compression unit 136 for compressing them into individual files by grouping according to the criteria of the user computer screen or time zone, characterized in that it further comprises Screen scanning system for digital forensics. A computer screen scanning system,
One or more user computers 110;
An inspection computer (130) for collecting and storing screen images received from the user computer (110) through the network (120);
Including a screen image generating device 150 including any one or more of RGB Matrix Switcher, DVI Matrix Switcher, CCTV, DVR to generate a screen image,
The inspection computer 130 receives the screen image in the form of a packet from the screen image generating device 150 through the network 120 or receives the screen image through the image-only cable 151 and receives the received screen image. Computer screen scanning system for digital forensic, characterized in that the collection and storage to analyze. A computer screen scanning system,
One or more user computers 110;
Including the inspection computer 130 for collecting and storing the screen image received through the network 120 from the user computer 110,
The computer screen scanning system is provided with a plurality of inspection computer 130,
The user computer 110 and the test computer 130, or a plurality of test computer 130 is a digital forensics characterized in that the screen image transmission and reception between each other by any one of the UDP / IP method and the TCP / IP method Computer screen scanning system. The method of claim 6,
The one inspection computer 130 has a function of copying or distributing the screen image received from the user computer (110) to another inspection computer (130). The method according to claim 2,
The user computer 110 has a function of notifying whether the transmitted screen image is compressed, transmitting only an update pixel of the screen image, obtaining authorization for blocking screen image transmission, and notifying real-time simultaneous recording of the screen image. Computer screen scanning system for forensics. The method according to claim 3,
The inspection computer 130 may search for one or more of the screen image generation time, the user computer on which the screen image is generated, the user computer monitor identification number on which the screen image is generated, and the indexed text in association with the screen image. A computer screen scanning system for digital forensics characterized in that it has a function of providing a search condition. The method according to claim 3,
The inspection computer 130 has a function of controlling whether one or more of a screen image of the user computer 110 is scanned, a scanning cycle, a scanning quality, and a scanning area. The computer screen scanning for digital forensics may be performed. system. As a computer screen scanning method,
Distributing the same screen image as the screen image provided on the actual monitor of the one or more user computers and transmitting the same to the test computer;
Reconstructing the transmitted screen image by the inspection computer according to a user computer, a screen identification number, and a transmission time using packet header information of the screen image;
Classifying and storing the reconstructed image generated by the inspection computer into image groups according to a user computer, a screen identification number, and a transmission time by using tag information of the image;
Extracting text from the stored image at the inspection computer;
Indexing and storing the extracted text on the basis of the extracted text, the extracted image, the text content, and the number of times of extraction;
And searching the user computer by inputting a search condition of at least one of the user computer, the monitor of the user computer, the screen image generation time, and the indexed text to the inspection computer. Scanning method.

Images