KR101793829B1 - Distributed users behavior simulation system through a forced injection script to the browser - Google Patents

Abstract

The present invention relates to a distributed user behavior simulation system through forced script injection to a browser and, more specifically, to a user behavior simulation system, which is capable of injecting a user produced script composed of five modules including an injection tool, a browser, a distributed script execution module and an IP change tool, has two or more clouds forcefully inject the script to the browser, and simulates a user behavior therethrough. To this end, the distributed user behavior simulation system through the forced script injection to the browser comprises: a mobile terminal to which a mobile base station allocates an IP by a set unit; a client receiving the IP allocated to the mobile terminal from the mobile terminal and making a script; and a relay server receiving the script from the client and distributing the received script to other connected clients.

Description

Distributed user behavior simulation system through a forced script injection into a browser [

The present invention relates to a distributed user behavior simulation system through forced injection of a script into a browser, and more particularly to a user system composed of five modules including an injection tool, a browser, a distributed script execution module, a relay server and an ip change tool It is possible to inject the produced script, and at least two or more clients are forced to inject the script into the browser.

Recently, the number of websites that could put malicious code distribution sites and fraudulent shopping malls at risk for the security vulnerability of domestic websites has exceeded 12,000. Web sites are all 'traps'.

In addition, the latest hacking techniques are becoming more sophisticated in how they distribute malicious code through websites.

Generally, in this case, when a user's PC accesses a website after hacking, most of the code linking with the malicious code host server is hidden in the homepage. In the course of developing the website, a simulation of xss and csrf attacks It is crucial to provide information to web site developers so that they can test and detect vulnerabilities and supplement them.

Even though various security equipment and software have been developed in the background of this situation, why the web is not free from the threat of attack and propagation through the network is due to various convenience of the web. This convenience is often a useful Evasion technique for attackers.

In case of being attacked by the hacking attack using the avoiding technique, it is not usually found by the administrators. In order to obtain and obtain additional information that is generated in the service of the web server for a long period of time, .

In addition, an attacker widely uses methods of modifying the initial web page (default web page) to send a malicious program to a normal user accessing a web server or a service using the control right given to the user.

Korean Patent No. 10-0912794 (Web Threat Management System and its Method for Hacking Analysis and Website Forgery Monitoring in Real Time Web Server) Korean Patent No. 10-0867306 (Web site tampering check system and method using image analysis technique)

A problem to be solved by the present invention is to propose a method for checking whether or not an exploited structure has been exploited in order to increase the user experience of a web browser and for convenience.

Another problem to be solved by the present invention is to provide a method for protecting a web browser from hacking using a malicious script.

Another problem to be solved by the present invention is to propose a method for confirming whether or not a web browser can detect it in advance when accessing the web browser using various routes.

The problem to be solved by the invention is to execute a malicious script simulation test at a client terminal to detect a hacking attack and warn an administrator to detect a security hole as a flow of an original attack and to detect an internal web server program and a problem The purpose of this paper is to propose an automatic analysis and real - time analysis of an external infringement accident without a high level of experience.

A distributed user behavior simulation system for injecting a forced script into a browser of the present invention comprises a mobile terminal that receives an IP allocated from a mobile station in a predetermined unit, receives an IP allocated by the mobile terminal from the mobile terminal, And a relay server that receives a script from the client and distributes the received script to another connected client.

The distributed user behavior simulation system through the forced script injection to the browser of the present invention executes a malicious script simulation test at the client terminal to detect a hacking attack and warns the administrator to detect a security hole as a flow of the original attack And diagnoses the problems on the internal web server program and the source code, thereby automatically analyzing and real-time analyzing an external invasion accident without a high degree of experience, and is capable of blocking a website attack by a hacker in the future.

Figure 1 illustrates a distributed user behavior simulation system via forced script injection into a browser in accordance with an embodiment of the present invention.
FIG. 2 illustrates an example of accessing a web site using a script according to an embodiment of the present invention.
FIG. 3 illustrates an example of executing a distributed script for a plurality of clients according to an embodiment of the present invention.
FIG. 4 shows a screen of a client (a browser proposed by the present invention) according to an embodiment of the present invention.
FIG. 5 illustrates a screen of a mobile terminal according to an exemplary embodiment of the present invention.
FIG. 6 shows an IP_CHANGE_V5 (IP change) application installed in a mobile terminal.
7 shows an activation screen for an executable file installed in the client.
FIG. 8 illustrates a screen of a client according to an embodiment of the present invention.
9 is a view for explaining injection according to the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The foregoing and further aspects of the present invention will become more apparent from the following detailed description of preferred embodiments with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the embodiments of the present invention, examples of which are illustrated in the accompanying drawings.

In addition, using the distributed script execution function, which is one of the functions of this tool, it is possible to detect the operation and error of the web site including the various behaviors of the website user who is falsified on the target website without any error. This tool is able to simulate the behavior of all visitors during a website service.

In the past, it was possible to minimize the damage of web viruses mainly by receiving MS Windows security update, but recently, comprehensive security update for application and database for web server itself is urgent.

No matter how well-crafted code is, it can not defend all the behavior of visitors to your website. Setting up many scenarios to simulate behaviors such as voting and manipulation of visitors, such as an observer tool, is a necessary step to improve Web service quality. This type of manipulation by unification of visitors can not be defended by code.

Because there are too many scenarios, it is only possible to simulate various scenarios that can be predicted, and to make statistics based on the results, and to make them consistently manage and check manuals.

In the context of the present invention, "script" refers to various javascript libraries using javascript and javascript. Also, "client" refers to a web browser to which an ip change and a script injection function are added.

Figure 1 illustrates a browser forgery pre-simulation test system in accordance with an embodiment of the present invention. Hereinafter, a browser forgery pre-simulation test system according to an embodiment of the present invention will be described in detail with reference to FIG.

Referring to FIG. 1, a distributed user behavior simulation system using a forced script injection in a browser includes a mobile terminal, a relay server, and a client. Of course, other configurations than the above-described configuration may be included in the distributed user behavior simulation system through forced script injection to the browser proposed by the present invention.

For example, a web site server is a web site server that requires a pre-check in a distributed user behavior simulation system through a forced script injection into a browser.

The relay server 105 authenticates the clients 110, 110a to 110c and controls the client 110. [ The relay server 105 determines whether or not the connected client 110 has normally connected. In addition, the relay server 105 filters malicious code and distributes the script to a plurality of connected clients. To be more specific, the relay server 105 distributes a script provided from a specific client to another connected client.

The client 110 creates a script and accesses the website server using the created script. The client 110 connects using the script provided from the relay server 105. To be more specific, the client 110 accesses the website server (or web site) using the created script, and provides the created script to the relay server 105. Further, the client 110 accesses the web site by using the script provided by the relay server in addition to the script created by the client.

The mobile terminals 115 and 115a to 115c are allocated an IP using the installed Android application and provide the assigned IP to the client 110. [ In connection with the present invention, the mobile terminal is assigned a new IP to provide a new IP to the client once the created script is repeated. Generally, when a connected client repeatedly performs the same operation, the web site judges that duplication is executed when the IPs are the same, and filters the same. Accordingly, in order to solve such a problem, the present invention provides a mobile terminal that receives a new IP at a predetermined interval and provides the allocated IP to a client.

The client connects to the web site by using the created script, and accesses the web site by using the IP provided by the mobile terminal in a predetermined unit. In this case, even if a client executes a single script, the number of users who access the relay server can simultaneously execute a script created by another client provided by the relay server in addition to the script created by the client, so that the number of execution of the script increases sharply.

In other words, when a client accessing a web site using the same script uses a same IP, the browser recognizes the client as a single client. On the other hand, when browsing through a different IP, the browser recognizes the client as a different client. Therefore, it is possible for one client to access the browser server in a different form multiplied by the number of IPs provided to the mobile terminal and the number of scripts provided from the relay server.

If the cookie is manipulated and the header information is manipulated, it is recognized as a completely different client (client), and the web site administrator can not distinguish even if the same operation is repeated.

In the present invention, when a user accesses a relay server using a specific browser, the script is moved to a web site to be operated and a script capable of controlling the web site is created. Scripts written by the client are functions that are not found on the target web site.

Malicious scripts have evolved to avoid filtering by writing script code to be added on the bulletin board. However, the method proposed by the present invention injects a script into a browser showing a target web site.

FIG. 2 illustrates an example of accessing a web site using a script according to an embodiment of the present invention. Referring to FIG. 2, the jquery script is further injected into the daum.net website, and the jquery function is called to access and manipulate the daum.net website.

FIG. 3 illustrates an example of executing a distributed script using a plurality of clients according to an embodiment of the present invention. In particular, in FIG. 3, three clients connect to a relay server, and the relay server sends an execution command for a specific script to each connected client, and each client accesses a specific web site to execute a script. For example, the script's command is "Search for 'Yahoo Service' keyword on Naver," or "Search Google" keyword on Naver.

Hereinafter, a process of a client accessing a web site will be described.

FIG. 4 shows a screen of a client (a browser proposed by the present invention) according to an embodiment of the present invention. 4, the client includes two executable files and a dll file, and the executable files are choeen_browser and Choeenserver. Of course, the executable file may vary depending on the client's browser.

FIG. 5 illustrates a screen of a mobile terminal according to an exemplary embodiment of the present invention. Referring to FIG. 5, an IP_CHANGE_V5 app is installed in the mobile terminal. IP_CHANGE_V5 The application requests IP allocation to the external server according to the request of the user of the mobile terminal, and allocates the IP from the mobile base station and changes the ip of the client. Of course, the IP_CHANGE_V5 app is not assigned the same IP from the external server but is assigned a different IP each time.

FIG. 6 shows an IP_CHANGE_V5 (IP change) application installed in a mobile terminal. It is possible to receive an IP from an external server by the installed IP_CHANGE_V5 app as shown in FIG.

Fig. 7 shows a screen in which an executable file installed in the client is activated. For example, a temporary file created by a client user is temporarily called a 'script source file', and a file extension is called 'choeen'. The temporary file is encrypted and can be decrypted only by the client. The 'script source file' is a separately distributable form.

The executable file relays the IP fluctuation provided from the IP fluctuation app installed in the mobile terminal. In other words, the executable file has a function of changing the IP of the client to an IP provided from the mobile terminal and connecting to the browser server.

8 (a) shows a screen of a client. This will be described in detail. 8 (b) shows a screen of the relay server. According to Fig. 8 (b), information on the client connected to the relay server is displayed on the right side.

Fig. 8 (c) shows a browser screen accessed by the client. As shown in Fig. 8 (c), all the unique functions of the browser are displayed, and a general search function is also possible.

Fig. 8 (d) shows another screen of the browser connected by the client. FIG. 8 (d) is a screen in which a 'request' tab is located next to the 'Web' tab. The request can check the value requested by the client to the http server in real time.

8 (e) shows another screen of the browser connected by the client. 8 (e) is a screen in which a 'header' tab located next to the 'request' tab is clicked. The header can identify the request responder and the like.

Fig. 8 (f) shows another screen of the browser connected by the client. FIG. 8 (f) is a screen in which the 'Cookies' tab located next to the 'Header' tab is clicked. A cookie can check the contents of a cookie generated when a web browser is visited in real time. Hereinafter, the part arranged on the left side of the client screen will be described.

Fig. 8 (g) shows another screen of the browser connected by the client. Fig. 8 (g) is a window for performing login and performing connection with a relay server. As described above, the Choeenserver file proposed by the present invention can be used after connection with the relay server.

8 (h) shows another screen of the browser connected by the client. FIG. 8 (h) is a screen which is clicked on the 'Console' tab located next to the 'Login' tab. The console is responsible for displaying a variety of information that can be used for debugging. In other words, the console displays errors, results after execution, and so on.

Fig. 8 (i) shows another screen of the browser connected by the client. 8 (i) is a screen in which the 'Proxies' tab located next to the 'Console' tab is clicked. A proxy can be bypassed using a proxy server. As shown in FIG. 8 (j), the proxy proposed in the present invention performs a function of sequentially calling several thousands of proxy lists in a state where they are listed on a notepad at a time. In other words, a user-written script is automatically changed once the routine is run.

8 (k) shows another screen of the browser connected by the client. 8 (k) is a screen where the 'HTML' tab located next to the 'proxy' tab is clicked. HTML allows you to easily create a script by checking the attributes of the clicked object.

Fig. 8 (l) shows another screen of the browser connected by the client. 8 (1) is a screen in which the 'Header' tab located next to the 'HTML' tab is clicked. The header can be requested with the desired header value. The http protocol server responds to the header value you want and displays the results differently.

The lower part of the screen shown in Fig. 8 (m) is a part for creating a script, turning a routine, storing it, and recycling it.

Fig. 8 (n) shows another screen of the browser connected by the client. Fig. 8 (n) is a part for storing the script as a file and reading the list, and the script created as shown in Fig. 8 (o) is stored in a specific folder.

Fig. 8 (p) shows another screen of the browser connected by the client. 8 (p) is a window in which a script created by the user is actually executed by adding various options. Repeat the loop and repeat the loop once, then change to another setting automatically.

8 (q) shows another screen of the browser connected by the client. 8 (q) is a window in which a script can be executed. The created script is added to the script loop by clicking the add button.

9 is a view for explaining injection according to the present invention.

According to FIG. 9, in the conventional case, the web server receives the response data in the http protocol format from an ordinary browser browser. The present invention includes a web server, a modified browser, and a script injection part. and a step of injecting a script added by the user in the process of receiving the response data is added.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the scope of the present invention .

105: Relay server 110: Client
115: mobile terminal

Claims (5)

delete delete Creating a script by a client and transmitting the created script to a relay server;
Accessing a web site using the script created by the client;
Receiving a new IP from a mobile terminal to which the client is connected; And
And accessing the web site using the IP provided by the client and the created script.
The client receiving a script created by another client from the relay server;
Accessing a web site using the script provided by the client;
Receiving a new IP from a mobile terminal to which the client is connected; And
And accessing the web site using the IP and the script provided by the client.
5. The method according to any one of claims 3 to 4,
Wherein the mobile terminal provides the IP address allocated by the mobile station to the client.

Images