KR101464736B1 - Security Assurance Management System and Web Page Monitoring Method - Google Patents

Abstract

Provided are an information security management system and a homepage forgery detection method using the system. The information security management system includes: an information security management server which collects website data by accessing a target information security domain through a predetermined uniform resource identifier (URI), and determines whether the website is forged or not by analyzing the collected data. The information security management server generates a first block tree from the collected data and determines the forgery through block hashing.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information security management system,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information security management system, and more particularly, to a technology for detecting forgery of a home page.

Information protection means securing the confidentiality, integrity and availability of information by protecting information assets from disclosure, disclosure, modification and destruction, and various threats such as delays and disasters. The purpose of information protection is to prevent threats and accidents of information assets in advance, to detect problems in progress, and to correct problems in the system based on past history of problems. Examples of such infringement include non-intentional infringement by operator error, information leakage due to insider's intentional intentions, and information leakage by hacking of external intruder.

Conventionally, in order to protect information in an enterprise, it is common to establish security devices in various layers and stages and to link them together. Such security devices include, for example, access control devices using fingerprints, passwords, security solutions through software or hardware, setting up internal policies and guidelines, operation and auditing.

On the other hand, the information protection solution established for the protection of information in the enterprise needs to comply with the international standard for information protection management system established by the International Organization for Standardization (ISO) / ISO 27001 standard for international certification. ISO 27001 is validated through rigorous screening and verification of 11 areas, 133 items related to information security such as information security policy, physical security and information access control.

The present invention provides an effective up / down monitoring function for a web site which is subject to information protection management by using an information protection management system operated in accordance with ISO 27001 regulation.

Further, the present invention provides a method for monitoring forgery and tampering with a web site, which can detect and analyze at a high speed compared to a conventional web site forgery detection technique.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood from the following description.

In order to achieve the above object, an information protection management system according to an aspect of the present invention accesses an information protection target domain through a designated URI (Uniform Resource Identifier) to collect data of a web site, analyzes the collected data The information protection management server generates a first block tree from the collected data and performs block hashing on the first block tree to determine whether the web site is forged or not .

Here, the information protection management server may compare the hash value of each block node with the second block tree generated previously for the URI of the first block tree to determine whether the forgery or falsification has occurred.

Here, the information protection management server compares each block node in the first block tree with a block node at the same depth in the second block tree, and if the block node having the same hash value is searched, The flag of the block node can be set to be normal.

Here, the information protection management server may select only the block nodes whose flags of the parent node are not normal among the block nodes of the first block tree.

Here, the information protection management server may determine whether the web site is forged or not by inspecting whether or not an unauthorized script is inserted into the web site.

Here, the information protection management server may receive the URI information through the user terminal, and may transmit a forgery test result to the user terminal in response to the URI information.

According to another aspect of the present invention, there is provided a method for detecting a web site forgery in an information protection management system, comprising: collecting data of a web site by accessing an information protection target domain through a designated URI (Uniform Resource Identifier); Extracting HTML tags by parsing the collected data, and constructing the extracted HTML tags on a block basis to generate a first block tree; And comparing the hash value with a second block tree previously generated for the web site to determine whether the website is forged or falsified.

The step of determining whether the web site is forged or falsified includes: calculating a hash value of the first block tree; Selecting sequentially the block nodes of the first block tree in order of depth and comparing the hash values with the block nodes of the same depth in the second block tree; If a block node having the same hash value is found, setting a flag of two block nodes having the same hash value as normal; And setting a flag of all the block nodes of the same depth of the block node of the first block tree and the block node of the second block tree to be abnormal if a block node having the same hash value at the same depth of the second block tree is not found ; ≪ / RTI >

The step of determining whether the website is forged or falsified may further include selecting only a block node whose flag of the parent node is abnormal among the block nodes of the first block tree as a hash value comparison object.

Here, if a link is retrieved from the collected data, the method may further include adding a web page corresponding to the link to an inspection target list.

The step of determining whether the web site is forged or falsified includes the steps of determining that the block node has been modified when the flags of the block nodes of the first block tree are abnormal and the flags of the child nodes are all normal, A step of judging that the block node is newly created when the flag of the block node of the one block tree is abnormal and the child node is not present, and a step of judging that the flag of the block node of the first block tree is abnormal and one or more flags Determining that the child node whose flag is abnormal is determined to have been modified if the child node is abnormal.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG.

The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. It is provided to fully inform the owner of the scope of the invention.

According to one of the above objects of the present invention, it is possible to provide an effective up / down monitoring function for a web site to be subjected to information security management.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a general schematic diagram of an information protection management system according to an embodiment of the present invention; FIG.
2 is a block diagram illustrating a detailed configuration of an information protection management server according to an embodiment of the present invention.
3 is a flowchart illustrating a process of operating an information protection management system according to a PDCA management method in an information protection management server according to an embodiment of the present invention.
4 is a flowchart illustrating a process for monitoring forgery of a home page in an information protection management server according to an exemplary embodiment of the present invention.
5 and 6 are views for explaining a method of constructing a block tree using HTML tags collected by an information protection management server according to an embodiment of the present invention.
FIG. 7 is a diagram for explaining a method for determining whether a homepage forgery or falsification is made using a constructed block tree.

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role.

The user terminal described in this specification includes a smart phone, a laptop computer, a tablet device, a digital broadcasting terminal, a PDA (personal digital assistant), a portable multimedia player (PMP) .

1 is an overall schematic diagram of an information protection management system according to an embodiment of the present invention.

1, the information protection management system of the present invention is implemented through an information protection management server 100, and is provided with at least one user terminal 200 interlocked with the information protection management server 100, The target domain 300 is set and the information protection check is performed to transmit the result to the user terminal 200.

Specifically, the information protection management server 100 can receive information such as an object to be checked and an item to be checked from the user terminal 200 connected through a network. At this time, a separate application may be installed in the user terminal 200 for command transmission or transmission / reception of data between the information protection management server 100 and the user terminal 200, and the application may be transmitted from the information protection management server 100 Downloaded to the user terminal 200 or downloaded through a separate application market.

In this case, the object to be checked may be a specific domain in the enterprise or an individual website operated in the domain. At this time, the user terminal 200 can provide a domain or web site to be checked in the form of a URI (Uniform Resource Identifier).

The information security management server 100 periodically or non-periodically checks the check target in accordance with a preset value. The check result may be transmitted to the user terminal 200 through the application UI installed in the user terminal 200 or a predetermined e-mail address.

Hereinafter, the detailed configuration and functions of the information security management server 100 of the present invention will be described.

2 is a block diagram illustrating a detailed configuration of the information security management server 100 according to an embodiment of the present invention.

2, the information protection management server 100 of the present invention includes a collection unit 110, an analysis unit 130, a management unit 150, an authentication unit 170, and a reporting unit 180 . In addition, it may include storage means such as a collection data DB 120, an analysis data DB 140, and a control item DB 160 in order to store set, collected, and processed information.

The information protection management server 100 can perform various functions such as prevention activities, management activities, quality assurance, and detection of infringement signs in order to protect information. Here, the preventive activity includes the function of monitoring the forgery of the homepage, and the block structure of the collected data is used to perform block hashing at a high speed, and malicious code or illegal payment code illegally embedded on the homepage It can be found and removed.

Management activities may also include PDCA management functions. Here, PDCA management is one of the methods of operating the information protection management system. It establishes the infringement incident response system (Plan), implements and operates the established response system on the system (Do), monitors the operation status in real time And checking and correcting various improvements obtained in the above operation process to the information protection management system in operation to improve and correct the problem (Act). This may include activities to quantitatively manage the security status of an organization, such as security levels and improvement plans.

Quality assurance activities may include activities such as collecting logs through real-time management of information protection targets and normalizing and analyzing them. In addition, an activity of detecting an infringement symptom may include an activity of anticipating and blocking a hacking or infringement symptom using a scenario-based infringement symptom detection algorithm.

Such an information protection activity may be performed on the information security management server 100 as shown in FIG. 3, such as security planning 10, data collection 20, periodic measurement / indication 30, It can be operated as a structure in which the process is repeatedly circulated.

First, in the security planning step 10, definition of a security control item, definition of a security policy, definition of a symptom detection rule, and definition of falsification detection can be performed. This process can be performed by the management unit 150. In the definition process of security control items, security items, security objectives, measurement methods, and measurement periods can be set. In the definition process of security policy, security policy items are defined and security policy contents are inputted. In the process of defining the symptom detection rules, various hacking scenarios are modeled and rules are set for them. In the forgery detection definition process, the monitoring target is input and the monitoring target is managed. Various items defined in this process can be stored in the control item DB 160.

In the next step, data collection 20 can be done. The data collection is processed by the collection unit 110, and in the data collection step, data such as logs required are collected periodically or non-periodically as needed. At this time, the collected data is systematically stored and managed in the collected data DB 120. Data collected in real-time include logs of the information protection system, log and status information of the information protection management server 100 and the third party servers associated therewith, logs of the network, status information and traffic information, Content, and non-real-time collected data may include security policy information and security activity tracing data.

Then, the information protection object can be measured in real time based on various collected data and displayed on a dashboard (30). The analysis unit 130 may perform the real-time measurement based on the defined security control item, a symptom detection execution rule, and a web page forgery detection detection definition. The measurement result may be stored in the analysis data DB 140 or displayed on the dashboard through the reporting unit 180. At this time, the contents displayed on the dashboard may include, for example, a score relative to the goal per security item, a detailed status of the content of the problem, a symptom detection result, or a web page forgery monitoring result. At this stage, exception processing for details of problem contents, exception processing for monitoring result of forgery of web page, and handling of occurrence problems can be performed.

In the next step, the security policy is improved based on the measured result (40). The improvement of the security policy is processed through the management unit 150. Such an improvement process may include resetting the security control item, resetting the security policy, and resetting the forgery detection target. The history management for the resetting may also be performed at this stage.

Through the information security management of such a virtuous cycle structure, the present invention enables overall security management in the administrative, physical, environmental, and technical fields, enables the security policy to be changed at all times in accordance with the changed security level, The security reliability of the system can be quantified according to an objective criterion.

4 is a flowchart illustrating a method for detecting forgery of a homepage in the information protection management system of the present invention.

Referring to FIG. 4, the information protection management system of the present invention can detect and respond to a forgery or falsification of a homepage being operated on a domain that is an information protection target in real time.

To this end, the management unit 150 of the information protection management server 100 receives domain information to be subjected to forgery detection and stores the domain information in the control item DB 160. At this time, the target domain may be input through the user terminal 200 in the form of a URI, or may be input through a separate administrator terminal connected to the information protection management server 100.

Then, the collecting unit 110 accesses the target domain using the input URI and crawls the homepage data (S102). At this time, the root page of the homepage can be designated as the first crawling target.

Thereafter, the analysis unit 130 parses the collected data to extract necessary data (S104). The extracted data may include HTML tags, images, URIs of internal links, contents, and the like.

The analysis unit 130 generates a block tree for the web page using the extracted HTML tag (S110). In this case, the generated block tree is a tree structure in which a start tag and a closing tag pair of an HTML document are converted into one block node, and another tag pair is included in each block node, into a child node. For reference, each block constituting the block tree is referred to as a block node.

Fig. 5 shows an example of the structure of such a block node. Referring to FIG. 5, a block node may be composed of Node, Depth, Parent, Order, Hash, and Flag items. Here, Node is the node number, Depth is the depth of the corresponding node based on the root node of the block tree, Parent is the node number of the parent node of the corresponding node, Means the order of the corresponding node among the nodes. Hash is a hash value of the corresponding block node, and Flag is a flag for setting a result of checking whether the node is forged or falsified. If the Flag value of a specific block node is set to be the same, it is determined that the corresponding block node and its child nodes are not forged. Therefore, it is not necessary to perform a test for a block node whose flag is normal and its child nodes The number of comparative tests and the inspection time can be shortened.

A method of constructing a block tree for an arbitrary web page using block nodes having such a structure will be described below with reference to FIG.

Referring back to FIG. 4, if there is no previous check result for the same URI, that is, if the check for the corresponding URI is the first (S112), the hash value And stores it in the hash (S114). On the other hand, if there is a previous check result for the corresponding URI, that is, if a previously generated block tree exists for the URI, the analyzer 130 compares the hash value of the new block tree with the previous block tree (S116). For reference, the comparison of hash values between blocks in such a block tree will be referred to as block hashing. If the block hashing result between the previous block tree and the new block tree is detected (S118), the analysis unit 130 extracts the changed information and stores the modified information in the analysis data DB 140 (S122). If no change is detected, it is determined whether the corresponding page is normal or abnormal, as in the previous inspection result of the home page. For example, if the page is judged to be normal in the previous inspection, the inspection result for the page may be determined to be normal (S120). The block hashing method will be described later in detail with reference to FIG.

The above process is repeated until all the internal links added to the inspection target list are inspected (S180, S182). At this time, the inspection target list stores internal links extracted from the collected data, and may be implemented in a queue form.

If an image is extracted by parsing in step S104 (S130), the analyzer 130 compares the hash value with the corresponding image extracted and stored in the existing test (S132). If the hash value is the same, If it is not the same, it is determined that the corresponding image is forged and the fact of image change is recorded (S134). Thus, it is possible to detect image forgery such as changing the file name of the image inserted in the homepage or inserting another image as the same image file name.

If the link is extracted by HTML parsing in step S104 (S150), the analyzer 130 determines whether the extracted link is an internal link or an external link (S152). If the extracted link is an internal link, And adds it to the target list (S154).

Meanwhile, if the content extracted in step S104 is analyzed (S170), if there is another tag in the content, it is determined whether a link is included in the tag (S172). At this time, if the included tag is an internal link, the link is added to the inspection target list (S174). If the included tag is an external link, it is recorded that the external link is found in the content (S176).

For reference, in a case of a bulletin board or the like, even if the frame of the web page does not change, the content posted on the bulletin board continuously changes, so it is impossible to precisely grasp whether the bulletin board is forged or falsified by comparing the simple hash value with the previous contents. Therefore, in order to judge the forgery and falsification of the bulletin board, it is possible to check whether or not a script executable in the browser is arbitrarily inserted into the contents in the bulletin board and forgery or falsify it.

After the above searching process is completed, the recorded search results are collected and an inspection report is issued (S184). The inspection report to be issued can be posted on the dashboard by the reporting unit 180.

Next, a method of generating a block tree will be described in detail.

FIG. 6 shows an example of a block tree generated using a web page. The web page T10 is composed of multi-layered HTML tags, and there are <HTML> and </ HTML> pairs at the top level, that is, a pair of tags with a Depth of 1, There are <Head> and </ Head> pairs and <Body> and </ Body> pairs, and the <Script> and </ Script> pairs and the two <Table> and </ Table> , And <Table> and </ Table> pairs exist in a tag pair with a depth of 4.

Here, the analysis unit 130 generates a block node B10 corresponding to the pair of <HTML> and </ HTML> having the Depth of 1 and generates a block node B10 corresponding to the pair <Head> and </ Head> <Script> and </ Script> pairs and two <Table> and </ Table> pairs having the Depth of 3 are generated for each block node (B20, B30) Generates a block node B40 corresponding to the pair of <Table> and </ Table> having a depth of 4, and generates a whole block tree.

At this time, each block node includes a Parent item in which the node number of its parent node is stored, so that it can be determined which block node is a child node of the corresponding block node through the Parent item. For example, since the parents of the three block nodes B40, B50 and B60 having Depth 3 are 3, it can be seen that the block nodes B40, B50 and B60 are child nodes included in the block node B30.

On the other hand, the node number (Node) of each block node can be set to increase in order from the block node B10 having the depth of 1. Also, the Order of each block node can be set to increase steadily in order for all the block nodes in the same Depth. For example, the Order value for three block nodes (B40, B50, B60) with a depth of 3 can be 1, 2, and 3.

Next, a method for determining whether a forgery or falsification is made through block hashing will be described.

FIG. 7 shows a previous block tree T20 and a new block tree T30 generated in the previous test. It is assumed in FIG. 7 that the (3, 2, 1, 2) block nodes of the new block tree T30 have been added since the previous check and the (6, 3, 3, 2) block nodes have been modified. For reference, when the flag value of each block node of the new block tree T30 is the same in the block hash process, the hash value comparison check may not be performed on the corresponding block node and its child nodes.

First, the block nodes of the new block tree T30 are sequentially selected in order of depth, and the hash values are compared with all the block nodes of the same depth in the previous block tree T20. For example, all the nodes of the previous block tree T20 having the same depth as the (1, 1, 0, 1) block node of the new block tree T30 Node is one).

At this time, if a block node having the same hash value at the same depth of the previous block tree T20 is not found, the flag of the corresponding block node of the new block tree and all the block nodes of the same depth of the previous block tree T20 Is set to modify. For example, since hash values of (1, 1, 0, 1) of the new block tree T30 and (1, 1, 0, 1) of the previous block tree T20 are different, Or more. For reference, when the flag is in a modified state, the corresponding block node may be in one of addition, modification, and deletion.

Next, (2, 2, 1, 1), (3, 2, 1, 2) of the previous block tree T20 which is the same Depth as (2, 2, 1, 1) of the new block tree T30 (2, 2, 1, 1) of the new block tree T30 and the blocks 2, 2, 1, 1, 3, 4 of the previous block tree T20 because there is no block node having the same hash value. 2, 1, 2) is modified to modify.

Likewise, (2, 2, 1, 1), (3, 2, 1, 2) of the previous block tree T20 which is the same Depth as (3, 2, 1, 2) (2, 2, 1, 1), (3, 2) of the new block tree T30 (3, 2, 1, 2) and the previous block tree T20 since there is no block node having the same hash value , 1, 2) are modified to modify.

On the other hand, if a block node having the same hash value is found, the flag of two block nodes having the same hash value and its child nodes is set to be the same. For example, (2, 2, 1, 1), (3, 2, 1, 2) of the previous block tree T20 which is the same Depth as (4, 2, 1, 3) (4, 2, 1, 3) of the new block tree T30 and the child nodes 7 (2, 3, 4, 5) of the new block tree T30 are equal to the hash values of the previous block tree T20 (3, 2, 1, 2) of the previous block tree T20 and the flags of the child nodes 6, 3, 3, 1 of the previous block tree T20 To be the same.

If all nodes are searched in this way, the flag may be set to be the same or modified for each block node.

After all the tests are completed, the flags of the new block tree are checked. If the flags of the parent node are modified and the flags of the child nodes are the same, If the flag of the parent node is modified and the child node is not present, it is determined that the corresponding block node (parent node) is newly created. If the flag of the parent node is modified, If only a part of the child node is a flag, the corresponding child node may be determined to have been modified.

Therefore, it is possible to know which block node of the new block tree has been forged or modified through block hashing.

With this configuration, the present invention has an effect of providing an effective up / down monitoring function for a web site to be subjected to information protection management.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention.

Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments.

The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

Claims (11)

In an information protection management system,
And an information protection management server accessing the information protection target domain through a designated URI (Uniform Resource Identifier) to collect data of the web site and analyze the collected data to determine whether the web site is falsified or not,
The information protection management server generates a first block tree from the collected data and performs block hashing for each block node having the same depth as the second block tree generated for the URI to determine whether the forgery or falsification Judging,
Information security management system.
delete The method according to claim 1,
The information protection management server compares each block node in the first block tree with a block node at the same depth in the second block tree to find a block node having the same hash value, To a normal state,
Information security management system.
The method of claim 3,
Wherein the information protection management server selects only a block node whose flag of the parent node is not normal among the block nodes of the first block tree,
Information security management system.
The method according to claim 1,
Wherein the information protection management server determines whether the web site is forged or not by inspecting whether or not an unauthorized script is inserted into the web site,
Information security management system.
The method according to claim 1,
Wherein the information protection management server receives the URI information through a user terminal and transmits a forgery test result to the user terminal in response to the URI information,
Information security management system.
A method for detecting forgery of a homepage in an information protection management system,
Accessing an information protection target domain through a designated URI (Uniform Resource Identifier) to collect data of a web site;
Extracting HTML tags by parsing the collected data, and constructing the extracted HTML tags on a block basis to generate a first block tree; And
Determining whether the web site is forged or not by comparing hash values of the first block tree with respect to each of the block nodes having the same depth as the second block tree previously generated for the web site;
How to detect forgery of homepage.
8. The method of claim 7,
Wherein the step of determining whether the web site is forged or falsified comprises:
Calculating a hash value of the first block tree;
Selecting sequentially the block nodes of the first block tree in order of depth and comparing the hash values with the block nodes of the same depth in the second block tree;
If a block node having the same hash value is found, setting a flag of two block nodes having the same hash value as normal; And
Setting a flag of all the block nodes of the same depth in the block tree of the first block tree and the block tree of the second block tree to an abnormal value if a block node having the same hash value is not found in the same depth of the second block tree; / RTI &gt;
How to detect forgery of homepage.
8. The method of claim 7,
Wherein the step of determining whether the web site is forged or falsified comprises:
Further comprising the step of selecting only a block node whose flag of the parent node is set to an abnormal value among the block nodes of the first block tree,
How to detect forgery of homepage.
8. The method of claim 7,
Further comprising: adding a web page corresponding to the link to the inspection target list when a link is retrieved from the collected data.
How to detect forgery of homepage.
8. The method of claim 7,
Wherein the step of determining whether the web site is forged or falsified comprises:
Determining that the block node has been modified if the flag of the block node of the first block tree is abnormal and the flags of the child node are all normal;
Determining that the block node is newly created when the flag of the block node of the first block tree is abnormal and the child node is not present; And
Further comprising: determining that a child node of which the flag is abnormal has been modified when the flag of the block node of the first block tree is abnormal and one or more of the child nodes are abnormal,
How to detect forgery of homepage.

Images