KR101565942B1 - Method and Apparatus for detecting ID theft - Google Patents

Abstract

According to one desirable embodiment of the present invention, a theft ID is detected just after the theft ID is logged-in in case of ID theft to prevent additional damage. A theft ID detecting method comprises: a step of storing login log data by a login ID in case of a login attempt generated for a preset time; a step of classifying the login log data accumulated for the preset time by the login ID; a step of extracting a successful login ID; and a step of calculating a plurality of information by adding a weighted value to each information.

Description

FIELD OF THE INVENTION [0001]

FIELD OF THE INVENTION The present invention relates to a method and apparatus for detecting a forgery ID. And more particularly to a method for detecting an attempt to steal an identity that has attempted to log in within 24 hours.

Generally, when using the Internet service provided by the Internet service provider, the user is authenticated through the ID and the password and is provided with the service.

The login information used by the users to authenticate themselves can be variously configured as needed, but a method using an ID and a password is the most widely used.

As the number of such Internet services increases, IDs and passwords are leaked and others steal them frequently. However, the subscribers rarely know about this. As a result, malicious users are creating various service accounts using leaked personal information, and the damage and the risk are increasing.

Therefore, various measures are needed to prevent access attempts that are illegitimate by stealing or hacking the login information of other persons.

KR 2009-0089616

In a preferred embodiment of the present invention, when the identity theft occurs, an attempt is made to prevent further damage by detecting the identity theft immediately after login of the ID that is stolen.

As a preferred embodiment of the present invention, a method for detecting a forgery ID in a web service providing server includes storing login log data for each login ID in a login attempt occurring within 24 hours; Classifying login log data accumulated for a predetermined period by login ID; Extracting a log-in ID that is the same as the log-in ID in which the log-in attempted to log in within the 24 hours among the log-in IDs classified and log-in log data, and succeeded in log-in; The login ID is reclassified for each IP and at least one of the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information for each of the reclassified IPs And a step of calculating information.

In another preferred embodiment of the present invention, the forgery ID detecting device includes a login ID classifying unit for classifying login log data stored within 24 hours and log log data stored cumulatively for 90 days by login ID, respectively; A comparison unit comparing the login log data stored within the 24 hours classified by the login ID with the login log data cumulatively stored for 90 days classified by the login ID and determining whether they match; An IP classification unit for reclassifying the log-in ID of the log-in IDs that match the log-in log data to the IP-based log-in succeeding log-in, and an IP / 16 miss ratio, And an ID stealing IP list generating unit for generating an id list of ID stealing in which the login ID stealing is estimated by calculating a mistake rate and a cookie mistake rate.

Preferably, the password change IP list list is calculated by calculating a password change rate, an IP / 16 miss rate, an agent miss rate, and a cookie miss rate for each reclassified IP, And a password change IP list generation unit for generating a password change IP list.

And a tamper notification unit for extracting login IDs that have been successfully logged in from the password-changed IP list or the password-changed IP list and notifying the user of the stealing information.

In a preferred embodiment of the present invention, the log data generated in the recent log-in attempt is compared with the past accumulated log data to quickly detect a case in which a password change attempt is made among the IDs and the IDs to prevent additional damage in advance have.

Figure 1 shows the number of stolen IDs of the login IDs used to create spam at a particular web site.
2 shows an example of the entire flow of ID abuse.
Figs. 3 to 4 show a whole system diagram for detecting an ID that is stolen, according to a preferred embodiment of the present invention.
Fig. 5 shows an internal configuration diagram of a forgery-ID detecting apparatus according to a preferred embodiment of the present invention.
FIG. 6 shows an example of classifying login data by login ID in a forgery-ID detecting apparatus according to a preferred embodiment of the present invention.
7 to 8 illustrate an example in which at least one of the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information is calculated for each IP in the forgery-ID detecting apparatus / RTI >
FIG. 9 illustrates an example of a method for detecting a forgery ID in a web service providing server according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the number of stolen IDs of the login IDs used to create spam at a particular web site.

An example shown in FIG. 1 shows an example in which a service of a specific Internet Web site is exposed using a fraudulent ID (hereinafter referred to as ID) and information of a customer is extracted. One example shown in FIG. 1 shows the number of IDs used in creating gambling spam and the stolen hijacked date on the Internet portal site. In Fig. 1, the x-axis shows the number of IDs stolen, and the y-axis shows the number of IDs stolen.

Figure 1 shows the frequency and the stolen date that IDs used to create gambling spam in online cafes on May 21, 2013 were stolen. On May 20, 2013 and May 21, 2013, IDs used to create gambling spam in online cafes were the most abused.

Looking at the trend of FIG. 1, it can be seen that the stealing ID is most abused on the day or the day before.

2 shows an example of the entire flow of ID abuse.

The hackers 210 may take out the login ID and the password from the first Internet portal site (e.g., Daum) 200 (S210). In this case, the hacker 210 attempts to log in to the second Internet portal site (e.g., Naver) 201 with the ID and password obtained from the first Internet portal site (e.g., Daum)

If the login is successful, the hacker 210 may sell or distribute the ID and the password to another hacker 220 (S230). Thereafter, the hacker 220 attempts to log in using the purchased ID and PW to abuse the service of the Internet web site, change the password or change the user's contact, use the cache used by the user online have.

Figs. 3 to 4 show a whole system diagram for detecting an ID that is stolen, according to a preferred embodiment of the present invention.

The system for detecting a stolen identity includes the Internet network 300, a service provider 310, a user 320 and a stolen ID detection device 330. [

The service provider 310 includes an Internet portal site or the like for providing an Internet service to the user 320.

The terminal supporting the Internet service used by the user 320 includes a multimedia device, a computer, a notebook, a handheld device, a smart phone, a mobile phone, and a terminal, and may be a wired / wireless communication support terminal, a video processing device, a camcorder, And can be implemented in the form of a terminal including functions of a display unit, a communication unit, a user input receiving unit, and an output unit.

In a preferred embodiment of the present invention, in the system of the type as shown in FIGS. 3 to 4, the forgery-ID detecting apparatus 330 detects the login ID and / or the ID used by the user 320 when using the Internet service provided by the service provider 310, Or an ID that steals passwords.

The forgery ID detecting device 330 is connected to the Internet network 300 as shown in FIG. 3 and can be implemented separately from the service provider 310.

Also, as shown in FIG. 4, the ID-for-ID detector 330 may be implemented by a service provider in the form of a web service providing server or a terminal supporting the Internet service. In this case, the web service provision server may be further implemented to use the information of the various databases 331 used by the service provider 310. For example, it is possible to determine whether the ID is stolen by using the log data or the basic access situation information of the past predetermined period (for example, 90 days) stored in the database 331. [

Fig. 5 shows an internal configuration diagram of a forgery-ID detecting apparatus according to a preferred embodiment of the present invention.

As a preferred embodiment of the present invention, the stealing ID detecting apparatus 500 determines whether or not the log data generated within 24 hours and the log data cumulatively stored for 90 days match. Regarding the IDs that are successfully logged in among the matching login IDs, the IP list in which the ID is stolen and the IP list in which the password is changed are generated by performing reclassification by IP.

In detail, the forgery ID detecting apparatus 500 includes a login ID classifying unit 510, a comparing unit 520, an IP classifying unit 530, an IP stealing IP list generating unit 540, and a password changing IP list generating unit 550. . The features of each configuration are as follows.

The log-in ID classification unit 510 classifies log data of the log-in attempt ID within 24 hours by log-in ID. Also, login log data accumulated in the database 521 used by the service provider (see FIG. 3 and 310) is classified by login ID. An example of an implementation of the login ID classification unit 510 is shown in FIG.

As a preferred embodiment of the present invention, the log data includes login ID information, IP information, IP / 16 information, agent information, cookie information, password information, login success information, browser information, do.

The service provider (see FIG. 3, 310) can cumulatively hold and manage log data for login attempts for a period of time less than the maximum period for which current law is granted. As an example, a service provider (see FIG. 3, 310) can accumulate and manage log data for login attempts for 90 days.

The comparing unit 520 determines whether there is substantially the same environment as the log-in environment in the last 24 hours among the log-in environments for the past predetermined period (e.g., 90 days) for each log-in ID.

To this end, the comparison unit 520 compares login log data stored within 24 hours for each login ID with log log data stored cumulatively for a predetermined period of time (e.g., 90 days).

As a preferred embodiment, the comparison unit 520 compares the IP / 16 information, the agent information, and the cookie information of the log-in attempting to log in within 24 hours with the log-in ID in which the login attempt has been made for the past predetermined period of time (e.g., 90 days) IP / 16 information, agent information, and cookie information match.

The comparator 520 detects that the log-in attempt has occurred in the same environment in the past 24 hours and the log-in ID has been retrieved within the last 24 hours.

Thereafter, the IP classification unit 530 performs the reclassification of the login IDs extracted by the comparison unit 520 based on the IP standard. Refer to Figs. 7 to 8 for an example in which IP classification unit 530 performs reclassification on the basis of IP.

FIG. 7 shows an example of calculation of variables for generating an IP list for identity stealing after reclassification based on an IP standard, and FIG. 8 shows an example of calculation of variables to generate an IP list whose password is changed .

7, in the ID shoplifting IP list generator 540, the IP shuffling rate (IP_miss), the agent miss rate (Agent_miss), and the cookie mistake rate (S_rate) are calculated for each IP reclassified by the IP classifying unit 530 (Cookie_miss) to generate a list of ID stealing IP lists whose login ID theft is estimated.

For example, if the IP is 3.3.1.3, the login success rate (S_rate) is very low at 10%, the IP / 16 miss rate (IP_miss) is 90%, the agent miss rate (Agent_miss) is 95%, and the cookie mistake rate (Cookie_miss) 90%. ≪ / RTI >

In this case, the ID shoplifting IP list generating unit 540 can estimate that the login ID is stolen if the predetermined condition is satisfied.

For example, when the login success rate S_rate is 30% or less and the IP / 16 misfire rate IP_miss is 80% or more, the login success rate S_rate is 30% or less and the agent misissue Agent_miss is 70% A case where the login success rate (S_rate) is 20% or less and at the same time the cookie mistake rate (Cookie_miss) is 80% or more can be set as a specific condition.

In the case where the web service provision server sets the stolen ID estimation condition to a case where the login success rate (S_rate) is 30% or less and the agent miss rate (Agent_miss) is 70% or more, 3.3.1.3 IP shown in FIG. 7 is estimated to be a stolen IP .

When the ID stealing IP list generating unit 540 also uses a plurality of pieces of information among the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information by IP, Weights can be assigned to each piece of information.

The ID stealing IP list generating unit 540 may add the 3.3.1.3 IP to the ID stealing IP list. Thereafter, it is possible to notify the user of the abuse through the abuse notification unit (not shown).

5, 550) generates a password change IP list (550 in FIG. 5) by the IP classification unit 530 in accordance with the password change rate Chg_rate, IP / 16 miss rate IP_miss, ) And a cookie mistake rate (Cookie_miss), thereby generating a password change IP list list in which login ID theft and password change are estimated.

8, the password change rate (Chg_rate) is calculated as 90%, the IP / 16 miss rate (IP_miss) 90%, the agent miss rate (Agent_miss) 95%, and the cookie mistake rate (Cookie_miss) 90% in case of 3.3.1.3 IP .

In a preferred embodiment of the present invention, the password change IP list generation unit (FIG. 5, 550) generates a password change IP list list in which login ID theft and password change are estimated based on a specific condition.

For example, when the password change rate Chg_rate is 80% or more and the IP / 16 miss rate IP_miss is 80% or more, the password change rate Chg_rate is 80% or more and the agent miss rate Agent_miss is 70% , The case where the password change rate (Chg_rate) is 80% or more and the cookie mistake rate (Cookie_miss) is 80% or more can be set as the specific condition.

When the password change rate (Chg_rate) is set to 80% or more and the IP / 16 miss rate (IP_miss) is set to 80% or more at the web service provision server, the login ID stealing and password change estimation conditions are set to 3.3.1.3 IP is estimated to be a stolen IP.

5 and 550 may also use a plurality of pieces of information among the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information for each IP In this case, weights can be assigned to each piece of information.

Although not shown in FIG. 5, as a preferred embodiment of the present invention, the forgery-ID detecting apparatus 500 includes an ID list or a password-changing IP list generating unit 550 generated by the IP list generating unit 540 (Not shown) for extracting login IDs that have been successfully logged in from the generated list of password change IP lists and notifying the user of the fact of theft.

FIG. 6 shows an example of classifying login data by login ID in a forgery-ID detecting apparatus according to a preferred embodiment of the present invention.

Theft detection device classifies login data by login ID. In this case, examples of login data include password change, IP, IP / 16, Agent and Cookie information.

7 to 8 illustrate an example in which at least one of the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information is calculated for each IP in the forgery-ID detecting apparatus / RTI >

FIG. 7 shows an example of calculating the variables considered for creating an IP list for which identity theft is estimated. FIG. 8 shows an example of calculating the parameters to be considered for generating an IP list in which ID stealing and password change are estimated.

FIG. 9 illustrates an example of a method for detecting a forgery ID in a web service providing server according to a preferred embodiment of the present invention.

As a preferred embodiment of the present invention, the web service providing server compares the log data of the login ID in which the login attempt occurred within 24 hours to the login log data accumulated for a preset period to detect the forgery ID (S910 to S930 ).

The log data includes at least one of login ID information, IP information, IP / 16 information, agent information, cookie information, password information, and login success / failure information remaining at the time of login attempt.

To do this, the login log data is first stored and classified according to the login ID in the login attempt occurring within 24 hours (910). Then, the login log data accumulated for a predetermined period (for example, 90 days) is classified according to login IDs (920).

Then, among the login IDs classified in the login log data accumulated during the predetermined period, the login ID that has attempted to log in within 24 hours is identified with the login ID having the same login log data. Preferably, it is possible to determine whether the IP / 16 information, the agent information, and the cookie information among the log data are the same. Thereafter, the log-in ID that is successfully logged in among the identified log-in IDs is extracted (S930, S931).

When the login ID is extracted, the extracted login ID is reclassified by IP (S933). Thereafter, at least one or more pieces of information of the login success rate, the password change rate, the IP / 16 miss rate, the miss rate of the agent, and the cookie miss rate information are calculated (S940) (S941) or generates a list of the IDs of the robbers (S943).

One example of a variable that is calculated to generate the list of the stolen IDs is shown in one embodiment of FIG. 8, a variable for generating an IP list of the IDs for which a password change attempt has been made (S941).

Thereafter, an IP list of the stolen ID where the password change attempt has been made is generated (S941) or a stolen ID list is generated (S943), and the user is notified of this (S950).

The method of the present invention can also be embodied as computer readable code on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. The computer-readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner.

The present invention has been described above with reference to preferred embodiments thereof. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (13)

A method for detecting a fraudulent ID at a web service provision server, the method comprising:
Storing login log data for each login ID in a login attempt occurring within a predetermined time;
Classifying login log data accumulated for a predetermined period by login ID;
Extracting a log-in ID that is the same as the log-in ID in which the log-in attempted to log in within the predetermined period of time and log-in log data, and succeeded in log-in;
The login ID is reclassified for each IP and at least one of the login success rate, the password change rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate information for each of the reclassified IPs Calculating a weighted value for each piece of information when calculating information and calculating a plurality of pieces of information. The method according to claim 1, wherein the login log data
Wherein the login information includes at least one of login ID information, IP information, IP / 16 information, agent information, cookie information, password information, and login success / failure information remaining at the login attempt. The method of claim 1, wherein extracting the login ID comprises:
The log-log data is generated based on whether the IP / 16 information, the agent information, and the cookie information match the IP / 16 information, the agent information, and the cookie information of the log-in attempting to log in within the predetermined time Whether the IDs are the same or not. delete 2. The method of claim 1, wherein the calculating
Further comprising the step of generating a list of ID stealing IP lists by calculating the login success rate, the IP / 16 miss ratio, the agent miss rate, and the cookie mis-rate for each of the reclassified IPs, The method comprising: 2. The method of claim 1, wherein the calculating
And generating a password change IP list by calculating a password change rate, an IP / 16 miss rate, an agent miss rate, and a cookie miss rate for each of the reclassified IPs A method for detecting a forgery ID. The method according to claim 1,
Wherein the predetermined period is set to be equal to or less than a longest period allowed to hold personal information in the web service provision server under the current law. 2. The method of claim 1, wherein storing login log data comprises:
Wherein the login log data is updated and stored by the login ID at the predetermined time period. A login ID classifying unit for classifying login log data stored within a predetermined time and log log data cumulatively stored for 90 days by login ID;
A comparison unit comparing the log-in log data stored within a predetermined time period classified by the log-in ID with the log-log data stored cumulatively for a predetermined period classified by the log-in ID, and determining whether they match;
An IP classification unit for reclassifying login log data stored within the preset time to an IP standard;
The information processing apparatus according to any one of claims 1 to 3, further comprising: an information obtaining unit configured to calculate at least one of the login success rate, the IP / 16 miss rate, the agent miss rate, and the cookie miss rate for each reclassified IP, Wherein the ID stealing IP list generating unit generates the ID stealing IP list generating unit, wherein the ID stealing IP list generating unit generates the ID stealing IP list for each of the recalled IP success rate, the IP / 16 miss rate, the agent miss rate, and the cookie mistake rate The weighted value of each piece of information is calculated and calculated. The method of claim 9, further comprising: calculating a password change rate, an IP / 16 miss rate, an agent miss rate, and a cookie miss rate for each of the reclassified IPs, Further comprising: a password change IP list generation unit for generating an IP list list. 11. The method of claim 10,
Further comprising a fraud notification unit for extracting log-in IDs succeeding in log-in from the ID-falsification IP list or the password-changing IP list and notifying the user of the fraudulent use. The method according to claim 9, wherein the login log data
Wherein the authentication information includes at least one of login ID information, IP information, IP / 16 information, agent information, cookie information, password information, and login success / failure information. 10. The apparatus of claim 9, wherein the comparing unit
And comparing whether the IP / 16 information, the agent information, and the cookie information coincide with each other by the login ID.

Images