KR102022058B1 - Method and system for detecting counterfeit of web page - Google Patents

Abstract

The present invention relates to an image-based web page forgery detection method and system, comprising: accessing a web site more than a predetermined number of times during a preset period of time, collecting an image for the web page every time; Computing a numerical result value for each of the images by comparing each image with the original image of the web page, and storing it in a storage medium, and learning using the numerical result value for each of the images stored in the storage medium Generating and storing a model in a training model database, and extracting feature points for the images of the web pages collected thereafter, calculating information for determining forgery and forgery by comparing the feature points with the feature points of the original image, and calculating the forgery. Judgment information and training stored in the learning model database By comparing the models, it is possible to provide a web page forgery detection method comprising the step of determining whether the forgery for the subsequently collected web page.

Description

Web page forgery detection method and system {METHOD AND SYSTEM FOR DETECTING COUNTERFEIT OF WEB PAGE}

The present invention relates to a web page forgery detection method and system for determining whether the web page forgery based on the image.

Recently, the number of websites that can put netizens at risk such as malware dissemination sites and fraudulent shopping malls has exceeded 12,000 in relation to the security vulnerability of domestic websites. All over the website is a trap.

In addition, the latest hacking techniques are becoming more sophisticated methods of distributing malicious code through websites.

In general, this method usually hacks a website and hides the code linked to the malware host server in the homepage when the user's PC accesses it. By bypassing the detection system by encrypting the code, Is at its core.

In addition, hacking methods that use Google's search engine to attack a large number of websites exposed to vulnerabilities are still on the rise.

In the past, if only Microsoft Windows security update was properly received, web virus damage could be minimized. In recent years, comprehensive security update of application and database on web server itself is urgently needed.

Although various security devices and software have been developed in the background of this era, the reason why it is not free from the threat of attack and propagation through the network is because of the convenience of the web.

This convenience is often an attacker's useful evasion technique.

When attacked by a hacking attack using the above-mentioned evasion technique, it is not usually found by administrators, and it is artificial in the system in order to leak and view various kinds of information active in the service of the web server for a long time, and to obtain additional information generated additionally. Parasitic

In addition, the attacker has widely used the method of modifying the initial web page (default web page) to send malicious programs to normal users who access the web server or service using the control given to him.

In addition, in the case of the method for checking forgery and alteration of the webpages used in the past, it is only a level that alerts and recovers the forgery of the homepage by simply comparing the checksum using a HASH algorithm. In the web structure, the probability of false positives is so high that simply comparing the checksum has become an artifact of the old generation.

Republic of Korea Patent No. 10-0912794 (registered August 18, 2009)

The present invention provides a web page forgery detection system and method that can determine whether the web page forgery based on the image of the web page.

In addition, the present invention provides a web page forgery detection system and method for digitizing the image of the web page, and can determine whether the forgery of the web page using the digitized result value.

The present invention provides a web page forgery detection system and method that can be recovered by using the original web page file when the web page is forged.

In order to solve the above-mentioned problem, the web page forgery detection method according to an embodiment of the present invention accesses a web site more than a predetermined number of times during a predetermined period, and collects an image for the web page every time. And calculating a numerical result value for each of the images by comparing the collected images with the original images of the web page, and storing the calculated numerical values for each of the images, and storing each of the images stored in the storage medium. Generating a training model using the result value and storing the training model in a training model database, and extracting feature points for the images of the collected web pages, and calculating the information for forgery determination by comparing the feature points with those of the original image. And the calculated forgery information and the learning model Emitter may comprise determining whether the forgery of the web pages is collected through the subsequent comparison of the learning model stored in the database.

The storing in the storage medium according to an embodiment of the present invention may calculate the numerical result value for each of the images through the feature point matching or histogram comparison and analysis of each image and the original image for the web page collected during the predetermined period. Can be.

According to an embodiment of the present invention, the collecting may include calculating an access timeout time when the web site is accessed, and storing an image of the web page generated by accessing the web site within the access timeout time. It may include storing in the collection.

In order to solve the above-mentioned problem, a web page forgery detection system according to an embodiment of the present invention accesses a web site more than a predetermined number of times during a predetermined period, and collects an image for the web page every time. An image collecting unit, a modeler unit which calculates a numerical result of each of the images by comparing the collected images with the original images of the web page, and stores the calculated values in the storage medium, and each of the images stored in the storage medium. The machine learning unit generates a training model by using the numerical result of and stores the training model in the training model database, and extracts feature points for the images of the collected web pages, and compares the feature points with the feature points of the original image. Calculating judgment information, and calculating the forgery judgment And whether the forgery of the web pages that are collected after the learning model through the comparison between the learning model stored in the database may include a judge to determine forgery.

According to an embodiment of the present invention, the forgery detection system has a connection period of the web site is set, and further comprising a scheduler unit for connecting to the web site by operating the image collection unit and the forgery determination unit according to the access period. Can be.

According to an embodiment of the present invention, the forgery detection system is to install a recovery file storage for storing the recovery web page file, and a recovery agent on the web site, the web page is forged as a result of the determination of the forgery determination unit The web page recovery unit may further include a web page recovery unit configured to transmit a repair web page file stored in the repair file store through communication with the repair agent when determined to be determined.

According to an embodiment of the present invention, the modeler may calculate a numerical result value for each of the images through a feature point matching or histogram comparison analysis between the images of the web pages collected during the predetermined period and the original image.

According to an embodiment of the present invention, the image collecting unit calculates an access timeout time when accessing the web site, and collects an image for the web page only when the web site is accessed within the access timeout time. .

According to the aforementioned problem solving means of the present invention, by digitizing the image of the web page, by providing a web page forgery detection system and method that can determine whether the forgery of the web page using the digitized result value, Can respond sensitively to attacks.

In addition, according to the above-described problem solving means of the present invention, by building a learning model based on the image of the web page, by providing a system and method that can respond to the web page forgery attack using the built learning model, In addition to minimizing forgery and judgment time, the load on the network can be minimized.

1 is a block diagram showing the overall configuration of a web page forgery detection system according to an embodiment of the present invention.
2 is a flowchart illustrating a process of generating, by the web page forgery detection system according to an embodiment of the present invention, a learning model for determining forgery for a web page.
3 is a flowchart illustrating a process in which a web page forgery detection system according to an embodiment of the present invention generates a learning model for determining a forgery for a web page.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to assist in a comprehensive understanding of the methods, devices, and / or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification. The terminology used in the description is for the purpose of describing embodiments of the invention only and should not be limiting.

Hereinafter, a web page forgery detection system will be described with reference to the accompanying drawings.

1 is a block diagram showing the overall configuration of a web page forgery detection system according to an embodiment of the present invention.

As illustrated in FIG. 1, the web page forgery detection system is largely comprised of an image collector 100, a modeler 102, a machine learning unit 104, a forgery determination unit 106, a storage medium 108, and a learning model. Database 110 and the like.

The image collection unit 100 may access a web site at predetermined intervals, for example, 5 to 10 minutes, and collect web page images for each period. In detail, the image collection unit 100 accesses a web site using access information of a pre-stored web site, for example, URL information by using a preset period, and then downloads a web page for the web site using a multi-threaded downloader. The image may be received and stored in the storage medium 108. Accordingly, the storage medium 108 may store an image of a web page for each period.

In addition, the image collection unit 100 is set to the access timeout time for the web site, and when the access time calculated after calculating the access time (access time) to access the web site is within the access timeout time The image of the web page may be stored in the storage medium 108 by determining that a normal web site is accessed.

The image collection unit 100 according to the embodiment of the present invention may be implemented using a web crawler, a bot, a web spider, an ant, a web robot, a web browser, but is not limited thereto.

The modeler 102 calculates a numerical result value for each web page image by applying a numerical algorithm to each image of a web page for each period collected for a predetermined period, and stores the calculated numerical result value in the storage medium 108. Can be stored. Specifically, the modeler unit 102 extracts a feature point for each of the image of the web page and the periodic image of the web page, for example, the contour of the image, and then compares the contour of the original image with the contour of the collected web page image. After calculating the numerical result value or extracting the color distribution (histogram) of the original image and the collected web page image based on this can be calculated and stored in the storage medium 108 the numerical result value for the color distribution.

To this end, the modeler 102 according to an embodiment of the present invention may store and manage the original image for the web page. In detail, the modeler 102 may store and manage feature point information of the original image, for example, an outline, a histogram, and the like.

On the other hand, examples of the algorithm used in the modeler 102 according to an embodiment of the present invention may include, but are not limited to, "feature matching", "compare Histogram", and the like.

In the embodiment of the present invention, the numerical result calculated by the modeler 102 is a moving value of the contour between the collected image and the original image based on the contour of the original image (near distance movement value, distance movement value, similar position value). And the likeness value, or the variation value between the histogram of the original image and the histogram of the collected image.

The machine learning unit 104 generates a learning model by performing machine learning on numerical result values of a plurality of images stored in the storage medium 108, and generates the learning model of the generated web page into identification information of the web page. The matching may be stored in the learning model database 110. In detail, the machine learning unit 104 may generate a learning model by performing training by setting a moving value or a histogram variation value of the contour as training data.

First, in the case of using the moving value of the contour, the machine learning unit 104 includes the contour moving range value of the normal web page using the moving value of the contour of the image of the web page collected at intervals based on the contour of the original image. A learning model is generated, and when a color distribution (histogram) is used, a learning model including a color distribution variation range value of a normal web page may be generated.

The forgery determination unit 106 generates a learning model and collects an image of a web page (hereinafter referred to as an 'inspection web page image'), and a feature point of an inspection web page image, such as an outline and a histogram. After the extraction, the forgery may be determined by comparing the extracted feature points with the learning models stored in the learning model database 110. Specifically, the forgery determination unit 106 extracts the contour from the image of the inspection web page, and determines how much the extracted contour is moved in the original image. The inspection web page is forged by comparing the determined value with the learning model. Or determine whether the image has been tampered with, or extract a histogram from the image of the inspection web page, and then calculate the degree of variation by comparing the histogram of the extracted image with the histogram of the original image. It can be determined whether it is forged or tampered with.

Web page forgery detection system according to an embodiment of the present invention may further include a scheduler (112).

The scheduler 112 provides an interface for setting an access cycle for the web page of the image collector 100 and the forgery determination unit 106, and according to the access cycle set through the interface. The forgery determination unit 106 may be operated.

In addition, the web page forgery detection system according to an embodiment of the present invention may further include a recovery file storage 116 and a web page recovery unit 114 is stored a plurality of web page files.

The web page recovery unit 114 installs a recovery agent on the web page, and when it is determined that the forgery determination unit 106 determines that the web page is forged, a file storage for recovery through communication with the recovery agent ( The web page may be restored by transmitting the repair web page file stored in 116. Specifically, the web page recovery unit 114 installs a recovery agent on a web server that stores and manages a file related to a web page, and then recovers it through communication with the recovery agent when it is determined that the web page is forged. A plurality of web page files stored in the file storage 116 for the web server may be transmitted to the web server to restore the current web page file to a normal web page file.

In addition, the web page forgery detection system according to an embodiment of the present invention is the access control unit 118 for allowing only authorized access, the data management unit 120 for systematically managing the digitized data stored in the storage medium 108, The storage medium 108, the learning model database 110, and a storage medium manager 122 for managing storage capacity of the plurality of file storages 116 may be further included.

Web page forgery detection system according to an embodiment of the present invention can provide a user interface suitable for the purpose by providing an administrator viewer 124 and the control dashboard 126.

A process of detecting forgery of a web page based on an image by the web page forgery detection system having the above-described configuration will be described with reference to FIGS. 2 and 3.

2 is a flowchart illustrating a process in which a web page forgery detection system according to an embodiment of the present invention generates a learning model for determining a forgery for a web page.

As shown in FIG. 2, the web page forgery detection system first drives the image collecting unit 100 according to a connection period set in the scheduler unit 112 (S200), and stores the image collecting unit 100 by driving the image collecting unit 100. After selecting the web site to be accessed through the search of the medium 108, the web site is connected to the selected web site to generate an image of the web page for the web site (S202).

At this time, the image collection unit 100 of the web page forgery detection system calculates the access time which is the time it takes to access the web site (S204), and determines whether the calculated access time is within the previously stored access timeout time, that is, normal It is determined whether the connection (S206).

As a result of the determination in S206, if it is within the access timeout time, the image collecting unit 100 stores the generated web page image in the storage medium 108 (S208), otherwise proceeds to S200 and proceeds to the next step. .

Thereafter, the image collection unit 100 of the web page forgery detection system determines whether a predetermined time has elapsed (S210).

As a result of the determination of S210, when the preset time has elapsed, the web page forgery detection system drives the modeler 102 to perform numerical operation on the image of the web page (S212). In detail, the modeler unit 102 extracts contour information from a web page image stored in the storage medium 108, and calculates a contour shift value or compares the contour information with the storage medium 108 by comparing the extracted contour information with the contour of the original image. The histogram of the stored web page image is compared with the histogram of the original image to calculate the histogram variation.

Then, the modeler 102 generates a learning model by performing machine learning using a result of performing the digitization operation, that is, a contour shift value or a histogram variation value for each collected web page, and then generates the learning model. It is stored in the database 110 (S214).

A method of detecting forgery for a web page using the learning model generated through the steps as shown in FIG. 2 as described above will be described with reference to FIG. 3.

3 is a flowchart illustrating a process of detecting a forgery of a web page by a web page forgery detection system according to an exemplary embodiment of the present invention.

As shown in FIG. 3, the web page forgery detection system first accesses a web site through the forgery determination unit 106 (S300), and then displays an image (hereinafter referred to as an “inspection web”) of the web page of the accessed web site. Page image ”) (S302).

Then, the web page forgery detection system extracts information of feature points, such as contours and histograms, from the inspection web page image (S304), and changes the movement values of the contours and histograms by comparing the extracted feature points with the feature points of the original image. A value and the like are calculated (S306).

Thereafter, the forgery determination unit 106 determines whether the forgery of the web page is performed by comparing the calculated moving value, the variation value, and the learning model in the learning model database 110 (S308).

As a result of the determination in S308, in the case of forgery, the web page forgery detection system drives the web page recovery unit 114 (S310).

Accordingly, the web page recovery unit 114 recovers a web page in the web site by installing a repair agent on the web site and then transmitting a web page file stored in the repair file store 116 through communication with the repair agent. (S312).

On the other hand, if it is determined that the forgery is not as a result of the determination in S308, the forgery determination unit 106 determines whether the connection period (S314).

As a result of the determination in S314, the forgery determination unit 106 proceeds to S300 to perform a subsequent step in the case of the access cycle, otherwise proceeds to S314 to determine whether the connection cycle continues.

The above description of the present application is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present application. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present application. .

100: image collector
102: modeler part
104: machine learning unit
106: forgery and alteration determination unit
108: storage medium
110: Learning Model Database
112: scheduler
114: web page recovery unit
116: File storage for recovery
118: access control unit
120: data management unit
122: storage medium management unit
124: viewer viewer
126: Control Dashboard

Claims (8)

Accessing a website more than a predetermined number of times during a preset period of time, and collecting an image of the web page each time;
Contours are extracted from each image of the collected web pages for a predetermined period of time, a contour shift value is calculated by comparing the extracted contours with contours of the original image, and the histogram and the respective images of the collected web pages are calculated. Calculating the variation value of the histogram by comparing the histograms of the original image, and storing the result in the storage medium;
A training model including contour movement range values and histogram distribution variation range values of a normal web page is generated by using contour movement values and histogram variation values for each of the images stored in the storage medium, and stored in a training model database. Steps,
After that, the feature points of the contour and histogram of the collected web page images are extracted, and the contour shift value and the histogram variation value, which are information for forgery and judgment determination, are calculated by comparing the feature point with the contour and histogram of the original image. And determining whether the forgery of the subsequently collected web page is compared by comparing the forgery determination information with the contour movement range value and the histogram distribution variation range value of the normal web page, which is the training model stored in the training model database. How to detect web page forgery.
delete The method of claim 1,
The collecting step,
Calculating an access timeout time when the website is accessed;
And storing an image of the web page generated by accessing the web site within the access timeout time and storing the collected image on a storage medium.
An image collection unit which accesses a web site more than a preset number of times for a preset period of time, and collects an image of the web page every time the connection is made;
Contours are extracted from each image of the collected web pages for a predetermined period of time, a contour shift value is calculated by comparing the extracted contours with contours of the original image, and the histogram and the respective images of the collected web pages are calculated. A modeler unit which calculates a variation value of the histogram by comparing the histograms of the original image and stores it in a storage medium;
A training model including contour movement range values and histogram distribution variation range values of a normal web page is generated by using contour movement values and histogram variation values for each of the images stored in the storage medium, and stored in a training model database. Machine learning department,
After that, the feature points of the contours and histograms of the collected web page images are extracted. A forgery determination unit configured to determine whether the forgery of the subsequently collected web pages is compared by comparing the forgery determination information with the contour movement range value and the histogram distribution variation range value of the normal web page which is the training model stored in the training model database. Web page forgery detection system.
The method of claim 4, wherein
The forgery detection system,
And a scheduler configured to access the web site by operating the image collection unit and the forgery determination unit according to the access cycle.
The method of claim 4, wherein
The forgery detection system,
A recovery file store that stores the recovery web page file,
Install a repair agent on the web site, and when it is determined that the web page is forged as a result of the forgery determination unit, the repair web page file stored in the repair file store through communication with the repair agent Web page forgery detection system further comprising a web page recovery unit for transmitting.
delete The method of claim 4, wherein
The image collection unit,
A web page forgery detection system for calculating an access timeout time when accessing the web site, and collecting an image for the web page only when the web site is accessed within the access timeout time;

Images