KR101512700B1 - A precise access control system for unauthorized traffic in a web server based on user behavior patterns and the control method thereof - Google Patents

Abstract

This invention is related to an unauthorized traffic accurate access control system for the web server based on user behavior patterns and a method thereof. It involves the following steps of: generating link maps by receiving web server addresses by making use of a website link relationship analysis and a network traffic control technology; defining user behavior patterns based on the generated link maps; detecting unauthorized behavior based on the defined user behavior patterns; and controlling access by blocking access to the detected unauthorized behavior and leaving log records. Therefore, the present invention improves the web server′s performance and security by detecting an unauthorized behavior immediately and performing an accurate access control.

Description

TECHNICAL FIELD [0001] The present invention relates to a non-traffic access control system for a web server based on a user behavior pattern, and a control method therefor,

The present invention relates to an unauthorized traffic fine access control system and control method for a web server based on a user behavior pattern, and more particularly, to a web server that defines a user behavior pattern by analyzing a site map when providing access control functions of a web server, The present invention relates to a web server precision protection system and a method for controlling access to a web server for an unauthorized access after discriminating unauthorized activity based on a web page movement path of a user.

Since the existing web service access control service judged and processed the user's abnormal behavior using only simple information such as the number of clicks or the number of login failures, it was unsafe from the intelligent web collection robot or the hacking program, There is a limitation in providing an intelligent service.

In addition, main program codes for detecting abnormal behavior of a user installed in the existing web service access control service have been a constraint on the maintenance and extension of the web server and cause a deterioration of the service quality of the web server Has come.

According to the present invention, the present invention provides a method and apparatus for generating a link map by receiving an address of a web server, defining a user action pattern based on the generated link map, detecting unauthorized activity based on a defined user action pattern, And to control access to them.

Through the description of the present invention, a web server can include a plurality of web sites, and each web site can include a plurality of web pages. And the website may have a sitemap for that website.

Korean Patent Registration No. 10-0894331 (Apr. 14, 2009) discloses a system for detecting an abnormal behavior of a web application attack, wherein the intrusion detection system includes information about a web request, a response of the web server, The present invention relates to a system for determining whether an access to a specific web page is normal or not by analyzing a similarity of a web log string using a pattern matching algorithm of Ratcliff and Metzener.

In addition, Korean Patent Registration No. 10-1084681 (November 11, 2011) relates to a behavior pattern modeling system for network traffic for botnet detection. The network traffic traffic modeling system for the botnet detects the network traffic based on the destination, And a technique for modeling the network behavior by classifying the communication behavior for each client by performing patterning according to the detailed items of the protocol.

The conventional techniques described above detect the abnormal behavior and block access to a specific web page or model a behavior pattern. However, as described in the present invention, the web site map is analyzed and a normal access route There is no description of a technique for determining whether the user traffic is normal or abnormal based on the generated user behavior pattern.

The present invention has been made in order to solve the above-described problems, and it is an object of the present invention to provide a Web server capable of detecting unauthorized activity occurring on a Web server using link- And to provide a method and system for controlling access to unauthorized traffic of a web server based on a user behavior pattern capable of improving stability.

According to another aspect of the present invention, there is provided a method of generating a web service, the method comprising: generating a map by receiving a web server address and generating a link map; defining a user action pattern defining a user action pattern based on the generated link map; The present invention provides a system and method for controlling unauthorized traffic by performing a process of detecting an unauthorized activity to be detected and an access control step of blocking access to the detected unauthorized activity and leaving a log record.

In addition, the present invention provides a system and method for unauthorized traffic access control of a web server based on a user behavior pattern, which can efficiently detect a user behavior pattern using a web site analyzer and an unauthorized activity detector, and detect unauthorized activity It has its purpose.

According to an embodiment of the present invention, there is provided a method for precisely controlling unauthorized traffic of a web server based on a user behavior pattern, the method comprising: a map generation step of receiving a web server address and generating a link map; A user behavior pattern defining step of defining a user action pattern based on the generated link map; An unauthorized activity detection step of detecting unauthorized activity based on the defined user action pattern; And an access control step of blocking access to the detected unauthorized activity and leaving a log record. The map generating step may include receiving an Internet address of a target web server for map generation; Downloading a web page from a web server and extracting a link list from the downloaded page; Forming a link relationship using the extracted link list; Downloading the linked web page until the link list is no longer found, extracting the link list from the downloaded page, and forming the link relationship using the extracted link list; And storing the link relationship in a database if the link list is no longer found, wherein the user behavior pattern definition step includes a step of, in the site map generated through the website analyzer, The method according to claim 1, characterized in that the data format includes a behavior pattern of a user as an action for moving a departure page, a destination page and a page, Generating a route table by calculating a normal route that can reach all web pages based on a behavior pattern; Extracting a destination page by analyzing the received request message after receiving the request message of the user; Calculating a user path based on the destination page extracted in the step; And detecting the unauthorized behavior by comparing the user path with a normal path in the path table. The step of calculating the user path based on the destination page may include searching all the source pages of the destination page, The source page corresponding to the destination page is searched again by using the searched source page as the destination page, and the user inflow path for the given initial destination page is calculated repeatedly until the source page no longer appears.

According to still another aspect of the present invention, there is provided a system for controlling access to unauthorized traffic in a web server based on a user behavior pattern, the system comprising: a web site analyzer; Unauthorized activity detectors; A user interface module; And a memory configured to generate a site map of the web server using the web site analyzer, define a user action pattern based on the generated site map, store the user action pattern in a database, And detects the unauthorized activity by comparing the user behavior pattern with the user behavior pattern. The web site analyzer may further comprise: a web document collection module; Web document analysis module; Link relationship formation module; Site map storage module; Or a combination thereof, and the unauthorized-activity detector comprises: a packet receiving module; Packet analysis module; A group identification module; Session management module; Unauthorized activity detection module; Path calculation module; Behavior pattern load module; Log module; Or a combination thereof. In addition, the unauthorized traffic fine access control system of the user behavior pattern-based web server may include at least one of the following: a web server which can move a user in a site map generated through the web site analyzer, Wherein the data format includes an action for moving a departure page, a destination page, and a page, the action pattern of the user, and searches all the departure pages of the destination page, Calculates a user's inflow path for a given initial destination page by repeating the searched origination page as a destination page, the source page corresponding to the destination page again until the departure page no longer appears, and the databaseIt is implemented in the storage means mounted on the unit, and may be implemented in a separate storage means coupled to an electrical or optical cable, and is characterized in that it is possible to implement the cloud system through server virtualization and storage virtualization in the network.

The present invention relates to an unauthorized traffic fine access control system and method for a web server based on a user behavior pattern, and uses a web site link analysis and a network traffic control technique to generate a link map , Defines a user action pattern based on the generated link map, detects unauthorized activity based on the defined user action pattern, blocks access to unauthorized activity, and performs access control to leave a log record. It is possible to improve the performance and stability of the web server by detecting the unauthorized activity occurring immediately and performing the precise access control.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1A is an exemplary diagram illustrating a configuration of a unauthorized traffic fine access control system of a web server based on a user behavior pattern according to an embodiment of the present invention; FIG.
FIG. 1B is a flowchart illustrating a method for controlling unauthorized traffic fine access of a web server based on a user behavior pattern according to an embodiment of the present invention. Referring to FIG.
FIG. 2A is an exemplary diagram illustrating a structure of a Web site analyzer according to an embodiment of the present invention; FIG.
FIG. 2B is a flow chart illustrating a method for generating a site map in a web site analyzer according to an embodiment of the present invention; FIG.
3 is an exemplary diagram for explaining a configuration of a database constituting a site map according to an embodiment of the present invention;
4 is an exemplary diagram illustrating a data format of a user behavior pattern according to an embodiment of the present invention;
5 is an exemplary diagram illustrating a state diagram and a diagram of a defined user behavior pattern according to an embodiment of the present invention in a user behavior pattern data format;
FIG. 6A is an exemplary diagram illustrating a structure of an unauthorized person detector according to an embodiment of the present invention; FIG.
FIG. 6B is a flowchart for explaining a method for detecting unauthorized conduct according to an embodiment of the present invention; FIG.
FIG. 7 is an exemplary diagram illustrating an example of a user behavior pattern for membership enrollment according to an embodiment of the present invention; FIG.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout.

FIG. 1A is an exemplary diagram for explaining a configuration of a unauthorized traffic fine access control system of a web server based on a user behavior pattern according to an embodiment of the present invention.

1A, the unauthorized traffic fine access control system 10 of the user behavior pattern-based web server of the present invention is a system for accessing the unauthenticated traffic of the web server 20 of the user 40 accessing the web server 20 via the Internet 30, It is possible to detect an abnormal accessing operation using a tool including an intelligent web collecting robot, a hacking program, or a combination thereof, and perform precise access control to improve the performance and stability of the web server 20, The web site analyzer 100, the unauthorized activity detector 200, the user interface (U / I), and the user interface (U / I) A module 300, a memory 400, and a database 500. For reference, the database 500 may be embodied in a storage unit installed in the system of the present invention, or may be implemented as a separate storage unit connected with an electric or optical cable. In addition, the database 500 may be implemented as a server system As shown in FIG.

The unauthentic behavior detector 200 detects unauthorized activity based on the link map generated by the web site analyzer 100. The unauthentic behavior detector 200 detects an unauthorized activity based on the link map generated by the web site analyzer 100, . In addition, the user interface module 300 is connected to the input / output device so that a system operator can manually or automatically access the system of the present invention to manually input additional information and control commands, or perform unauthorized access precision access control processing, . The memory 400 updates and stores a user behavior pattern frequently used in detecting unauthorized activity from the database 500 and stores the updated user behavior pattern in the database 500. [ The system of the present invention can prevent the connection delay phenomenon between the user and the web server as much as possible and detect unauthorized activity at a faster speed.

For reference, in the above embodiment, each constituent means constituting the unauthorized traffic precision access control system is described only for convenience of explanation, and substantially all the constituent means may be processed by any constituent means, , Or may be configured to process the constituent means in combination. In addition, the components generally used in the implementation of the system of the present invention are not necessarily necessary for explaining the gist of the present invention, so they are omitted.

FIG. 1B is a flowchart for explaining an unauthorized traffic fine access control method of a web server based on a user behavior pattern according to an embodiment of the present invention. As shown in FIG. 1B, A user action pattern definition step (S102) for defining a user action pattern based on the generated link map (S101), a user action pattern definition step (S102) for defining a user action pattern based on the generated link map, (S103) for detecting an unauthorized activity in the unauthentic behavior detector (200), and an access control step (S104) for blocking access to the detected unauthorized activity and recording a log in the web server And performs precise access control for unauthorized traffic that has an abnormal access behavior.

2A is an exemplary diagram illustrating a structure of a web site analyzer according to an exemplary embodiment of the present invention.

As shown in FIG. 2A, the web site analyzer 100 according to the present invention is used to perform the map generation step. The structure includes a web document collection module 110, a web document analysis module 120, A link relation forming module 130, and a site map storing module 140. [

The web document collection module 110 is a module for collecting web pages constituting a web server, and the web document analysis module 120 analyzes the web pages of the collected web server to extract a link list. The link relation forming module 130 forms a link map according to the relation between the extracted link lists of the web server, and the site map storing module 140 stores the link relation and the site map in the database (500).

 In addition, the user may directly access the website analyzer through the user interface module 300 to form or modify the link relation of the web site.

FIG. 2B is a flowchart illustrating a method for generating a site map in the web site analyzer 100 according to an embodiment of the present invention. As shown in FIG. 2B, (S201), a web page is downloaded from a web server using the web document collection module (S202), and a link list (S203); forming a link relation using the link relation formation module based on the link list extracted in the step (S204); and if the link list is not found any more (S205). If the link list is no longer found in the step (S205), the site map storage module It is configured to include a step (S206) for recording using a link between the database. That is, a method of generating a site map is a method of downloading a specific page, extracting a link list existing on the page, downloading a link page of the extracted link list, and extracting a new link list existing in the link page. By repeating the above process until there is no more new link list, all link relationships to the web page can be created.

3 is an exemplary diagram illustrating a configuration of a database constituting a site map according to an embodiment of the present invention.

As shown in FIG. 3, the configuration of the database constituting the site map includes a LINK_TABLE 210 and a LINK_REL_TABLE 220. The LINK_TABLE 210 is a table for storing a list of found links. For example, the LINK_TABLE 210 sets IDs to numbers (0, 1, 2, ...) according to the found order and stores them together with the address of the link. The LINK_REL_TABLE 220 is a table indicating the relationship between links, and is represented using a source (SRC), a destination (DST), and a depth (DEPTH). For example, SRC (0), DST (1), and DEPTH (1) of LINK_REL_TABLE 220 shown in FIG. 3 have a source page index.html, a destination page intro.html, In the destination page (intro.html), it is possible to move by only one page movement. In addition, SRC (1), DST (0), and DEPTH (1) have a starting page as intro.html, a destination page as index.html and a destination page (index.html) It is possible to move only by one page movement.

In this way, the page that has been left before moving is set as the start point (SRC), and the moved page is set as the destination (DST) to express the relationship between the pages. In addition, for a link that the site analysis tool can not extract, such as a flash menu, the user directly inputs a link through the user interface module 300, and the user-defined link directly input by the user is stored in the analyzed database 500).

4 is an exemplary diagram illustrating a data format of a user behavior pattern according to an embodiment of the present invention.

In the second step of the unauthorized traffic fine access control system, a behavior pattern of a user is defined using a site map generated through the web site analyzer 100. The user behavior pattern is an expression of a page movement path in a web server to which a user can move. The user behavior pattern is stored in the data format 530 shown in FIG.

For reference, a behavior pattern is defined for each user group because a user behavior pattern must be applied differently according to a role of a user. A user group can be classified into an unregistered user, a registered user, an administrator, and the like, which is defined differently according to the service policy of the web server. For example, the registered user may be divided into a paying user and a free user, and may be divided into a premium user and a general user depending on the usage of the web server.

In addition, a method of defining a behavior pattern of a user is represented by an action (action) for moving a departure page, a destination page, and a page. The action when the page is moved is divided into a case of simple link and a case of form submission, and a case of simple link is indicated as 'L' and a case of form data submission is indicated as 'S'. If the origin and destination are the same, use a value that returns to the same page when the action is taken to move the web page.

In the data format 530 of the user behavior pattern, < UserActionPatterns > defines user behavior patterns. <patterns> defines a user behavior pattern for page movement, and consists of a list of <path>. The <path> defines a page movement path, src indicates a source page, dst indicates a destination page, and action indicates an operation when a page is moved. The name is used to assign an identification name to the pattern. It can be alphabetic, numeric, -, _, or whitespace. Roles list the names of the roles for which the user behavior pattern is valid. Separators for each role use a comma (,). Also, if this attribute value is not specified, the pattern is applied to the pattern without identifying the user and user roles. position specifies the pattern identification position. If the attribute value is not defined, it is assumed that the value [*] is set by default. In addition, acl designates a control operation in the case of a specific pattern path state, and it includes [access] for passing the packet, [drop] for dropping the packet, and key information about the packet, session and user information [log], [nolog] to exclude from logging, [capture] to copy and store a packet, and the like values can be specified by using a separator (comma). Also, <loop> defines the repetition of the pattern. It can include <path> and <loop>, [maxcount] is the maximum number of repetitions of the loop pattern, and <patterns> mismatch .

5 is an exemplary diagram illustrating a state diagram and a diagram of a defined user behavior pattern according to an embodiment of the present invention in a user behavior pattern data format.

5, assuming that the user behavior pattern is defined as diagram 540 of FIG. 5, the normal path to page 3 is that the path of page1 / page2 / page3 or page1 / page2 / page4 / page3 is valid If any other path move occurs, it is treated as an unauthorized act.

FIG. 6A is a diagram illustrating an exemplary structure of an unauthorized person detector according to an exemplary embodiment of the present invention. Referring to FIG.

In the third step of the unauthorized traffic fine access control system, unauthorized activity is detected in real time and access control is performed based on the user action pattern defined in the second step. The unauthorized activity detector 200 analyzes a request message for each user to obtain a page movement path of the user and compares the path to a user's action pattern to detect unauthorized activity.

The unauthorized activity detector 200 includes a packet reception module 210, a packet analysis module 220, a group identification module 230, a session management module 240, an unauthorized activity detection module 250, a path calculation module 260, A behavior pattern load module 270, and a log module 280. [

The packet receiving module 210 receives a user request message (hereinafter referred to as a packet) connecting to the web server. The packet analyzing module 220 receives a packet from the packet receiving module 210, Page, and the group identification module 230 identifies a group of user behavior patterns that match the packet. In addition, the session management module 240 manages connection between a user and a web server in a network environment. A user, a web server, and a system of the present invention are connected through the session management module 240, It is possible to calculate the movement path of the user. The unauthorized activity detection module 250 detects an unauthorized activity by comparing a user path and a user action pattern. The path calculation module 260 calculates a user path in the web server, and the action pattern load module 270 ) The user behavior pattern from the database 500 or the memory 400 and provides the unauthorized activity detection module 250 with the uploaded user behavior pattern. Also, the log module 280 generates, stores, and manages a log record of unauthorized activity detected by the unauthorized activity detection module 250.

6B is a flowchart for explaining a method for detecting an unauthorized activity according to an embodiment of the present invention. As shown in FIG. 6B, a method for detecting an unauthorized activity includes first arriving at all web pages (Step S301). In step S301, the normal path is calculated. After receiving the request message (packet) of the user (S302), the request message of the user is analyzed and the destination page is extracted (S303). Here, if the destination page is extracted, information about the service can be known. Therefore, the service information of the user (that is, the service that the user uses through the web site) can be analyzed to guarantee or restrict access to the user's web site have. If there is no session between the user and the web server (S305), a new session is created and registered to connect the user and the web server (S306). The user path is calculated based on the extracted destination page (S307). The obtained user path is compared with the path table to determine whether the corresponding user path is unauthorized (S308). At this time, if the path in the path table differs from the user path, it is determined that the user path is unauthorized, and the user's request message (packet) is discarded (S309). If the user path is found in the path table, it is determined that the user path is not unauthorized, and then the path is stored (S311) and the user's request message (packet) is processed normally (S312).

In the method of calculating the user route, a given page is searched first, all departure pages of a given page are searched, and the searched departure pages are used as a destination page again, and the departure page corresponding to the destination page is searched again. By repeating the above process until the departure page no longer appears, the user path for the given page can be calculated.

FIG. 7 is an exemplary diagram illustrating an example of a user behavior pattern for membership enrollment according to an embodiment of the present invention. Referring to FIG. As shown therein, in order for the subscription to be successful, the user's request is transmitted from the subscription page 610 via the terms and agreement page 620, the subscription authentication page 630, and the personal information input page 640 The registration completion page 650 should be reached. If the authentication fails in the subscription authentication step, the user can go to the authentication failure page 660 and select the link (L) from the authentication failure page to move back to the subscription authentication page. Similarly, if the personal information input page fails, the registration failure page 670 is transited to the personal information input page through the link L. [ The user who accesses through all the paths other than the defined path is determined to be unauthorized and controls the access to the web server through a method such as blocking and protects the web server from unauthorized traffic by leaving a log record have.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I will understand the point. Accordingly, the technical scope of the present invention should be defined by the following claims.

10: Unauthorized traffic precision access control system
20: Web server 30: Internet
40: User 100: Website Analyzer
110: Web document collection module 120: Web document analysis module
130: Link relation forming module 140: Site map storing module
200: unauthorized activity detector 210: packet receiving module
220: packet analysis module 230: group identification module
240: Session management module 250: Unauthorized activity detection module
260: path calculation module 270: behavior pattern load module
280: log module 300: user interface module
400: memory 500: database
510: LINK_TABLE 520: LINK_REL_TABLE
530: Data format of user behavior pattern
540: User behavior pattern diagram
610: Membership Page
620: Terms &amp; Consent page 630: Subscription verification page
640: Enter personal information page 650: Registration completion page
660: Authentication Failed Page 670: Registration Failed Page

Claims (13)

A link map generation step of receiving a web site address from a web server and generating a link map;
A user behavior pattern defining step of defining a user action pattern based on the generated link map;
Detecting an unauthorized activity based on the defined user behavior pattern; And
And an access control step of blocking access to the detected unauthorized activity and leaving a log record. The method according to claim 1,
The link map generation step includes:
Receiving an Internet address of a target web site for generating a link map;
Downloading at least one web page from a web site, and extracting a link list from the downloaded web page;
Forming a map of a link connection relationship using the extracted link list;
Downloading the linked web page until the link list is no longer found, extracting the link list from the downloaded web page, and forming the map of the link connection relationship using the extracted link list are repeatedly performed step; And
And storing the map of the link connection relationship in the database if the link list is not found any more. The method according to claim 1,
The user behavior pattern definition step may include:
A method for controlling access to unauthorized traffic in a web server based on a user behavior pattern, the method comprising: storing a page movement path in a web site in which a user can move in a site map generated through a web site analyzer in a predetermined data format. The method of claim 3,
Wherein the predetermined data format includes:
And displaying the action pattern of the user as an action for moving the departure page, the destination page, and the page. The method according to claim 1,
Wherein the unauthorized activity detection step comprises:
Generating a route table by calculating a normal route that can reach all web pages based on a defined user behavior pattern;
Extracting a destination page by analyzing the received request message after receiving the request message of the user;
Calculating a user path based on the destination page extracted in the step; And
And detecting unauthorized activity by comparing the user route with a normal route in the route table. The method of claim 5,
Wherein calculating the user path based on the destination page comprises:
The source page of the destination page is searched, the searched start page is set as the destination page, the start page corresponding to the destination page is searched again, and the process is repeated until the start page is no longer displayed, Wherein the route calculation unit calculates a route based on a user behavior pattern based on the user action pattern. A web site analyzer for receiving a specific web server address and generating a link map;
An unauthorized activity detector for detecting unauthorized activity based on a user pattern previously defined on the basis of the generated link map and stored in a database; And
A memory for storing a user behavior pattern frequently used in detecting the unauthorized activity in advance from the database and storing the updated user behavior pattern in a predetermined case and providing the database to the unauthorized activity detector immediately, &Lt; / RTI &gt;
Wherein the unauthorized traffic access control system is configured to block access to the detected unauthorized activity and to leave a log. The method of claim 7,
Wherein the website analyzer comprises:
Web document collection module; Web document analysis module; Link relationship formation module; Site map storage module; Or a combination thereof, wherein the unauthorized traffic fine access control system of the web server based on the user behavior pattern comprises: The method of claim 7,
Wherein the unauthorized activity detector comprises:
A packet receiving module; Packet analysis module; A group identification module; Session management module; Unauthorized activity detection module; Path calculation module; Behavior pattern load module; Log module; Or a combination thereof, wherein the unauthorized traffic fine access control system of the web server based on the user behavior pattern comprises: The method of claim 9,
And stores the page movement path in the web page that the user can move in a predetermined data format in the site map generated by the web site analyzer. The method of claim 10,
Wherein the predetermined data format includes:
And the action pattern of the user is displayed as an action for moving the departure page, the destination page and the page. The method of claim 11,
The source page of the destination page is searched, the searched start page is set as the destination page, the start page corresponding to the destination page is searched again, and the process is repeated until the start page is no longer displayed, And the route calculation unit calculates the route based on the route information. The method of claim 7,
The database includes:
The present invention can be embodied as a storage means mounted inside the system or as a separate storage means connected with an electric or optical cable and can be implemented as a cloud system through storage virtualization on a network. Server unauthorized traffic precision access control system.

Images