KR102521677B1 - System and method for monitoring phising damage - Google Patents

Abstract

According to an embodiment disclosed in the present document, a phishing damage monitoring system comprises: an extraction unit that extracts phishing server information corresponding to a phishing application; a dummy data generation unit that generates dummy data including virtual information and target information corresponding to a target device; a processing unit that executes the phishing application based on a user input and transmits the dummy data to a phishing server corresponding to the phishing server information through the phishing application; and a monitoring unit that monitors malicious information that the target device receives from an operating subject of the phishing server.

Description

Phishing damage monitoring system and method {SYSTEM AND METHOD FOR MONITORING PHISING DAMAGE}

Embodiments disclosed in this document relate to a phishing damage monitoring system and method.

Recently, communication terminal devices that perform smartphone functions by applying mobile operating systems such as Windows Mobile, i-OS (Operating System), and Android have become popular.

In a communication terminal device to which such a mobile operating system is applied, various information processing services are provided to users by executing various application programs based on the corresponding mobile operating system. Further, a communication terminal device to which a mobile operating system is applied has a browser as an application program, and provides information on various web sites to users by executing the corresponding browser and accessing Internet web sites through communication. Communication terminal devices to which such a mobile operating system is applied frequently attempt to establish a communication connection based on a URL entered when receiving a text message, receiving a multi-media message, receiving an e-mail, or transacting content by executing an application program.

However, since the communication connection based on the URL received in this way does not check whether or not the site to be accessed is harmful, there may be cases in which communication access is made to harmful sites such as phishing sites, domestic and foreign obscene sites, and speculative sites. Among them, access to phishing sites is becoming a social problem because it often leads to financial crimes. For example, if the text message contains URL information that induces access to a phishing site disguised as a financial institution, the communication terminal device can easily access the phishing site according to the URL information, and personal information is leaked by this phishing site. It happens frequently.

In general, technologies for preventing phishing damage include technologies for blocking harmful short messages received by communication terminal devices or technologies for blocking access to phishing sites by URL information included in harmful short messages, but phishing applications There was a problem that there was no way to deal with the case where personal information was already leaked by

In addition, in order to prevent further damage to the victim, after personal information is leaked, the perpetrator's attempt to harm is monitored in real time, so that the victim cannot be prevented from being threatened by the perpetrator in advance and cannot be protected.

According to an embodiment disclosed in this document, a phishing victim monitoring system includes an extractor for extracting phishing server information corresponding to a phishing application; a dummy data generating unit generating dummy data including virtual information and target information corresponding to a target device; a processing unit that executes the phishing application based on a user input and transmits the dummy data to a phishing server corresponding to the phishing server information through the phishing application; and a monitoring unit that monitors the offense information received by the target device from an operating entity of the phishing server.

According to an embodiment, the monitoring unit may issue a warning to the victim when the target device receives the abuse information.

According to an embodiment, the monitoring unit may perform the warning to block the operating entity by transmitting the offending information to the victim and blocking the offending information.

According to an embodiment, the target information may include relationship name information.

According to an embodiment, the perpetrator information may include at least one of a phone number, a profile, an email, an account number, and an IP address of the operating entity.

According to an embodiment, the dummy data generator may generate the dummy data based on at least one of software, a programming language script, and a user input.

According to an embodiment, the dummy data generating unit may include at least one of a phone book generating module, a text message generating module, and a unique identification number generating module.

According to an embodiment, the processing unit may include at least one of a mobile device, a virtual machine, and an emulator.

According to an embodiment, the processing unit may be configured to be physically separated from the extraction unit, the dummy data generation unit, and the monitoring unit.

According to an embodiment, the phishing damage monitoring system may further include a database for storing and managing existing damage information.

According to an embodiment, the phishing victim monitoring system may further include an application acquisition unit that obtains the phishing application from the victim terminal or the database based on phishing application information corresponding to the phishing application.

According to an embodiment, the application acquisition unit obtains the phishing application from the database based on a result of comparing the phishing application information with data of the database.

According to the embodiment, the monitoring unit may update the data of the database based on the offense information.

According to an embodiment disclosed in this document, a method for monitoring phishing damage includes extracting phishing server information corresponding to a phishing application; generating dummy data including virtual information and target information corresponding to a target device; executing the phishing application based on a user input and transmitting the dummy data to a phishing server corresponding to the phishing server information through the phishing application; and monitoring abuse information received by the target device from an operator of the phishing server information.

According to an embodiment, when the target device receives the abuse information, it may further include performing a warning to the victim.

The phishing victim monitoring system and method according to the embodiments disclosed in this document can obtain the phishing application through the database even if the victims delete the phishing application, and thus leaked information even when the phishing application cannot be obtained from the victim. and monitor phishing damage.

In addition, the phishing damage monitoring system and method according to the embodiments disclosed in this document can prevent additional leakage of personal information that may occur during execution of a phishing application using a virtual machine or the like.

In addition, the phishing damage monitoring system and method according to the embodiments disclosed in this document have dummy data transmitted to the phishing server by the phishing application, thereby avoiding the perpetrator's suspicion and reducing the risk of the work being discovered.

In addition to this, various effects identified directly or indirectly through this document may be provided.

1 is a diagram showing an operating structure of a phishing victim monitoring system according to an embodiment disclosed in this document.
2a and 2b are block diagrams of a phishing victim monitoring system according to one embodiment disclosed in this document.
3 is a diagram illustrating a process of transmitting dummy data to a phishing server according to an embodiment disclosed in this document.
4 is a flowchart illustrating a method for monitoring phishing damage according to an embodiment disclosed in this document.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that this is not intended to limit the present invention to the specific embodiments, and includes various modifications, equivalents, and/or alternatives of the embodiments of the present invention.

In this document, the singular form of a noun corresponding to an item may include one item or a plurality of items, unless the context clearly dictates otherwise. In this document, "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "A, Each of the phrases such as "at least one of B or C" may include any one of the items listed together in the corresponding one of the phrases, or all possible combinations thereof. Terms such as "first", "second", or "first" or "secondary" may simply be used to distinguish a given component from other corresponding components, and may be used to refer to a given component in another aspect (eg, importance or order) is not limited. A (e.g. first) component is said to be “coupled” or “connected” to another (e.g. second) component, with or without the terms “functionally” or “communicatively”. When mentioned, it means that the certain component may be connected to the other component directly (eg by wire), wirelessly, or through a third component.

Each component (eg, module or program) of the components described in this document may include singular or plural entities. According to various embodiments, one or more components or operations among corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg modules or programs) may be integrated into a single component. In this case, the integrated component may perform one or more functions of each of the plurality of components identically or similarly to those performed by a corresponding component of the plurality of components prior to the integration. . According to various embodiments, operations performed by modules, programs, or other components are executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations are executed in a different order, omitted, or , or one or more other operations may be added.

As used in this document, the term "module" or "...unit" may include a unit implemented in hardware, software, or firmware, and may include, for example, logic, logic block, component, or circuit. can be used interchangeably. A module may be an integrally constructed component or a minimal unit of components or a portion thereof that performs one or more functions. For example, according to one embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document may be implemented as software (eg, a program or application) including one or more instructions stored in a storage medium (eg, memory) readable by a machine. For example, the processor of the device may call at least one command among one or more commands stored from a storage medium and execute it. This enables the device to be operated to perform at least one function according to the at least one command invoked. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-temporary' only means that the storage medium is a tangible device and does not contain a signal (e.g. electromagnetic wave), and this term refers to the case where data is stored semi-permanently in the storage medium. It does not discriminate when it is temporarily stored.

1 is a diagram showing an operating structure of a phishing victim monitoring system according to an embodiment disclosed in this document.

Referring to FIG. 1, the phishing damage monitoring system 100 protects the victim's leaked information leaked by the phishing application and monitors the victim's information received from the perpetrator to protect the victim from harm such as additional threats from the perpetrator. there is.

The phishing damage monitoring system 100 transmits dummy data including virtual information and target information to a phishing server ( 10), the leaked information can be protected by neutralizing the previously leaked personal information to prevent further leakage.

For example, the phishing damage monitoring system 100 transmits dummy data to the phishing server 10 and uses various methods such as pushing data from the phishing server 10, overwriting the data, and preventing data from being recognized. Through this, leaked information can be protected.

In addition, the phishing victim monitoring system 100 transmits dummy data including virtual information and target information to the phishing server 10, and the target device 30 receives from the operating entity 20 of the phishing server 10 By monitoring perpetrator information, the victim can be protected from further harm by the perpetrator.

The phishing server 10 may include a server that receives or stores leaked data by transmitting and receiving data to and from a phishing application used in a phishing crime. In addition, the operator 20 of the phishing server 10 may include an assailant who leaks personal information of the victim using the phishing application and/or the phishing server 10 and threatens the victim based on the leaked information. there is. Hereinafter, the operating entity 20 of the phishing server 10 may be referred to as the perpetrator.

The target device 30 may be a communication terminal (eg, mobile device, PC, tablet, etc.), server, etc. owned or managed by an operator (eg, user, corporation, etc.) of the phishing damage monitoring system 100. there is. The target device 30 may receive offense information from the operating entity 20 of the phishing server 10 .

For example, the target device 30 may be a mobile device and may be a virtual machine or emulator running on a PC or the like. The target device 30 may receive a text message or phone call from the perpetrator, SNS service (eg, Twitter, Meta, etc.), messenger service (eg, KakaoTalk, Line, etc.), email service (eg, KakaoTalk, Line, etc.) For example, by logging in with an account such as Google, Naver, etc.), the perpetrator may receive a message, e-mail, etc. from the perpetrator.

2a and 2b are block diagrams of a phishing victim monitoring system according to one embodiment disclosed in this document.

Referring to FIGS. 2A and 2B , the phishing damage monitoring system 100 may include an extraction unit 110 , a dummy data generator 120 , a processing unit 130 and a monitoring unit 140 . According to an embodiment, the phishing damage monitoring system 100 may be a hardware device such as a processor or a central processing unit (CPU), or may be software or a program implemented by a hardware device.

According to an embodiment, the extractor 110 may extract phishing server information corresponding to a phishing application. In this case, the phishing application may include an application used to damage the victim by phishing. The phishing application may be set to leak personal information of the victim to the phishing server 10, and the extractor 110 may extract the phishing server information through data transmitted from the phishing application. The phishing server information may include, for example, an IP band used for communication or a site address (URL). For example, the phishing server information may include virtual private server (VPS) information, command & control (C&C) information, an IP address, an access route, log transmission details, and the like.

According to an embodiment, the extractor 110 may analyze leaked data transmitted to the phishing server 10 by a phishing application. Leaked data may include, for example, the victim's phone number data, text message data, photo data, video data, messenger data, and the like. The extraction unit 110 may analyze the leaked data and check the file format and file capacity of the data transmitted to the phishing server 10 .

For example, the extractor 110 may extract and analyze phishing server information and/or leaked data of the phishing application based on a result of decompiling the phishing application. Decompilation may refer to a process of converting a program file (eg, an APK file or an IPA file) into a code implemented in a computer programming language (eg, Java, C++, C, etc.). In the case of decompiling a program file, codes implemented in a programming language can be checked, and by analyzing the code, a driving method of the program file, a server address used, and information transmitted through the program file can be checked. Accordingly, the extractor 110 may extract leaked data transmitted by the phishing application and/or phishing server information used for phishing by analyzing the decompiled code of the phishing application.

Also, the extractor 110 may check whether the dummy data is normally transmitted to the phishing server 10 through the phishing application. For example, the extraction unit 110 decompiles the phishing application and analyzes the communication packet, similar to the process of analyzing the phishing server information and/or leaked data, so that the data to be transmitted (eg, dummy data) is phishing. It can be checked whether the data is normally transmitted to the server 10 . Through this, the phishing damage monitoring system 100 can check whether the process of neutralizing the previously leaked personal information in the phishing server 10 is normally performed.

According to an embodiment, the dummy data generator 120 may generate dummy data including virtual information and target information corresponding to a target device. Virtual information may include, for example, a photo that cannot be identified or cannot be identified, a contact in the form of an unused phone number, a document with meaningless content, unidentifiable SMS data, and a unique identification number in an unused form. Such data may be data corresponding to leaked data mainly transmitted from the phishing application to the phishing server 10 .

In an embodiment, the dummy data generator 120 may generate virtual information having a data format (eg, phone number format) expected to have been leaked by a phishing application. The dummy data generator 120 may randomly generate data through software, a programming language script, etc., which will be described later, instead of based on the leaked data analyzed by the extractor 110 .

In another embodiment, the dummy data generator 120 may generate virtual information to correspond to the format of data leaked by the phishing application analyzed by the extractor 110 . For example, if leaked data analyzed by the extraction unit 100 has a .txt extension, the dummy data generator 10 may create a file having a .txt extension.

According to an embodiment, the target information may be information corresponding to the target device 30 . Unlike virtual information (eg, a phone number that does not actually exist), which is information that does not actually exist, the target information may include information that actually exists. For example, the target information may include an actual phone number and profile of the target device 30 .

According to an embodiment, the target information may include relationship name information. Relationship title information may include titles indicating family relationships (eg, mom, dad, younger brother, etc.), titles indicating friendships (eg, girlfriend, boyfriend, best friend, etc.) . The dummy data generator 120 may generate target information by matching actually existing information (eg, phone number) with relationship name information (eg, mom-010.xxxx.xxxx). At this time, the relationship title information is intended to virtually represent the relationship with the victim and is irrelevant to the actual relationship with the victim. In general, since the perpetrator is highly likely to threaten someone who has a close relationship with the victim, when generating target information, the dummy data generator 120 uses a name that indicates a close relationship with the victim (eg, mother, girlfriend, etc.)

According to an embodiment, the dummy data generator 120 may generate dummy data based on at least one of software, a programming language script, and a user input. The software may include programs that automatically generate virtual information having various data formats. The programming language script may include code implemented in a programming language, and the programming language may include, for example, Java, Python, Ruby, C, C++, and the like. A programming language script can automatically generate virtual information having a corresponding data type, for example, when a data type is entered into a code. Also, the dummy data generating unit 120 may generate dummy data by storing data input by the user in Excel or the like.

The dummy data generator 120 may randomly generate dummy data using software, a programming language script, or the like, regardless of the leaked data analyzed by the extractor 110 . Also, the dummy data generator 120 may generate virtual information to correspond to the leaked data analyzed by the extractor 110 (eg, to have the same extension).

According to an embodiment, the dummy data generating unit 120 may include at least one of a phone book generating module, a text message generating module, and a unique identification number generating module. The phone book generation module may generate a virtual phone number having a phone number format that is not actually used. The text message generation module may generate an arbitrary text message. At this time, an arbitrary text message may include text such as a list of meaningless strings. The unique identification number generation module may generate a unique identification number in an unused format. At this time, the unique identification number (International Mobile Equipment Identity, IMEI) may include a unique serial number of the mobile device.

According to the embodiment, each of the phone book generating module, text message generating module, and unique identification number generating module may automatically generate dummy data through software, programming language scripts, etc., and manually generate dummy data based on a user input. can also create

According to an embodiment, the processing unit 130 may execute a phishing application based on a user input so that dummy data is transmitted to the phishing server 10 by the phishing application.

According to an embodiment, the processing unit 130 may include the extraction unit 110, the dummy data generation unit 120, and the monitoring unit 140 in one physical configuration (eg, PC), as shown in FIG. 2A. . In another embodiment, the processing unit 130 may be configured to be physically separated from the extraction unit 110, the dummy data generation unit 120, and the monitoring unit 140, as shown in FIG. 2B. For example, the extraction unit 110, the dummy data generation unit 120, and the monitoring unit 140 may be configured in A PC, and the processing unit 130 may be configured in B PC.

According to an embodiment, the processing unit 130 may cause the phishing application to transmit dummy data to the phishing server 10 by itself by executing the phishing application. Since the data is transmitted from the phishing application to the phishing server 10, the perpetrator will not be able to predict that it is due to the operation of the phishing damage monitoring system 100, and accordingly, the perpetrator will not be discovered and the leaked information is stably protected and phishing Damage monitoring is possible.

According to an embodiment, the processing unit 130 may include at least one of a mobile device, a virtual machine, and an emulator. In this case, the mobile device may be a device in which personal information is not stored, rather than a victim device. However, depending on the case, the phishing damage monitoring system 100 may perform a phishing damage monitoring task in the victim device, and in this case, the processing unit 130 and the victim device may be substantially the same.

According to an embodiment, the virtual machine and/or the emulator may include a program enabling driving of a mobile application on a PC. In general, a phishing application may be a mobile application, and the mobile application may not be executed on a PC due to a compatibility problem or the like. Accordingly, the phishing damage monitoring system 100 may enable the phishing damage monitoring task by executing the phishing application in the virtual machine using a virtual machine, an emulator, or the like that enables the driving of the mobile application.

When the phishing damage monitoring system 100 protects leaked information and monitors phishing damage on the victim device, the victim device may still have the phishing application installed and the victim's personal information may remain, so additional unintended personal information leakage may occur. There is a possibility. On the other hand, when an emulator or a virtual machine is used as the processing unit 130, the victim's personal information data is not stored, so additional leakage can be prevented. Accordingly, the phishing victim monitoring system 100 does not need to have a separate proxy server to enhance security, and thus, efficient work is possible in terms of time and cost. In addition, in the phishing victim monitoring system 100, the operation of the processing unit 130 may be possible in a device such as a device (eg, a PC) in which operations of the extraction unit 110 and the monitoring unit 140 are performed depending on the case. You can do your work efficiently.

According to the embodiment, the monitoring unit 140 may monitor offense information received by the target device 30 from the operating entity 20 of the phishing server 10 . Since the perpetrator misunderstands the dummy data transmitted to the phishing server 10 as the victim's leaked data and inflicts harm such as intimidation on the victim based on the data (eg, target information) included in the dummy data, the monitoring unit ( 140) may monitor offense information through the target device 30.

The dummy data flowed into the phishing server 10 neutralizes the previously leaked data in various ways, and the dummy data excluding the target information is composed of virtual information so that the perpetrator uses the data existing in the phishing server 10 Even if the harm is done, the information will be transmitted only to the target device 30 in practice. In this way, the phishing victim monitoring service 100 may monitor the phishing damage by inducing the attacker to perform the attack on the target device 30 .

According to the embodiment, the perpetrator information may include at least one of the perpetrator's phone number, profile, e-mail, and account number. This is only an example, and is not limited thereto as long as it is a means for specifying the perpetrator.

According to the embodiment, the monitoring unit 140 may issue a warning to the victim when the target device 30 receives abuse information. The monitoring unit 140 may warn the victim so that the victim can prepare in advance and prevent the perpetrator from harming the victim.

According to the embodiment, the monitoring unit 140 may warn the operating entity 20 to be blocked by blocking the offending information by transmitting the offending information to the victim. For example, when the target device 30 receives a threat message from the number 010-xxxx-xxxx, the monitoring unit 140 may deliver the number 010-xxxx-xxxx to the victim. The victim can block the perpetrator by forwarding the number to the victim as well as to nearby acquaintances to block the number.

The phishing damage monitoring system 100 blocks the perpetrator's phone number, e-mail address, IP address, etc. based on the perpetrator information, thereby blocking the path through which the perpetrator may harm the victim and/or the victim's acquaintances, thereby threatening, etc. can make it impossible to do. For example, even if the perpetrator sends a threatening message to the victim's phone number, the victim can block the perpetrator, so that the perpetrator cannot check the threatening message sent by the perpetrator.

In addition, when the target device 30 receives offence information, the phishing damage monitoring system 100 may further proceed with the leakage information protection process through transmission of the above-described dummy data based on the offence information. Through this, the phishing damage monitoring system 100 can further increase the effectiveness of leaked information protection.

According to the embodiment, the phishing damage monitoring system 100 may further include a database 150 . The database 150 may be configured separately from components such as the extractor 110 .

According to an embodiment, the database 150 may store and manage existing damage information. The phishing damage monitoring system 100 may collect and manage information related to phishing damage of various victims and various perpetrators and store it in the database 150 . At this time, the damage information may include information such as the phishing application used for the phishing damage, account number, phone number, threatening message, website, perpetrator profile, etc. Information such as a phishing server address corresponding to the phishing application, an account number of the perpetrator, and a profile may be matched and stored.

According to the embodiment, the monitoring unit 140 may update the data of the database 150 based on the offense information. In addition, the monitoring unit 140 may update the data of the database 150 by also reflecting information used for the victim's phishing damage. For example, if application A was used for the victim's phishing damage, the account number of the perpetrator received by the target device 30 is B, and the account number matched to application A is C in the data of the existing database 150, The monitoring unit 140 may add the account numbers of B and C to application A and match them.

According to the embodiment, the monitoring unit 140 continuously accesses the perpetrator and/or the phishing server 10 based on the data of the existing database 150 in order to keep the data of the database 150 updated. Changes in information can be checked and, if any, changes can be reflected to update the data.

The phishing damage monitoring system 100 can improve the effectiveness of phishing damage monitoring by updating data in the database 150 when phishing damage occurs. In addition, the phishing damage monitoring system 100 can respond more immediately based on the data of the database 150 when a new phishing damage occurs.

According to an embodiment, the phishing damage monitoring system 100 may further include an application obtaining unit 160 .

According to an embodiment, the application acquisition unit 160 may obtain a phishing application from the victim terminal or the database 150 based on phishing application information corresponding to the phishing application. The application acquisition unit 160 may transmit the acquired phishing application to the extraction unit 110 and/or the processing unit 130 . The phishing application information may include, for example, file information related to the phishing application (eg, HASH value, application name, etc.) or information such as an account number used for phishing damage, a phone number, a perpetrator's profile, and the like.

For example, if the victim does not delete the phishing application from the victim device, the application acquirer 160 may receive the phishing application from the victim device. The application acquirer 160 and the victim device may communicate by wire or wirelessly, and the phishing application may be received through commonly used communication methods such as Bluetooth communication, Wi-Fi communication, and USB communication.

According to an embodiment, the application obtaining unit 160 may obtain a phishing application from the database 150 based on a result of comparing information of the phishing application with data of the database 150 .

For example, if the victim deletes the phishing application from the victim device, the application acquirer 160 cannot directly receive the phishing application from the victim device. In this case, the application acquisition unit 160 may estimate the phishing application used for the phishing damage by comparing the data of the database 150 with the phishing victim information, and receive the phishing application from the database 150 . Through this, the phishing victim monitoring system 100 may acquire the phishing application to protect leaked information and perform phishing damage monitoring even when the victim deletes the phishing application.

As an example, the application acquisition unit 160 compares the data of the database 150 with at least one of the account number, phone number, threat message, website, perpetrator's profile, and HASH value of the APK file used for the phishing damage. The phishing application may be acquired based on. Such phishing damage information may be obtained from the victim, and may include various types of information related to phishing damage. For example, if data matching the account number information obtained from the victim exists in the database 150, it can be estimated that the application matching the data is a phishing application used for the phishing damage.

3 is a diagram illustrating a process of transmitting dummy data to a phishing server according to an embodiment disclosed in this document.

Referring to FIG. 3 , the dummy data generator 120 may generate dummy data through software, programming language scripts, and user input. The dummy data generator 120 may transmit the generated dummy data to the processor 130 .

Upon receiving the dummy data, the processing unit 130 may execute a phishing application based on a user input and transmit the dummy data to the phishing server 10 through the phishing application.

4 is a flowchart illustrating a method for monitoring phishing damage according to an embodiment disclosed in this document.

Referring to FIG. 4 , the phishing damage monitoring method includes extracting phishing server information corresponding to a phishing application (S100), generating dummy data including virtual information and target information corresponding to a target device (S200). , Running the phishing application based on the user input, transmitting dummy data to the phishing server through the phishing application (S300), and monitoring the abuse information received by the target device from the operating entity of the phishing server (S400) can include

In step S100, the extractor 110 may extract phishing server information of a phishing application used to damage the victim by phishing.

In step S200 , the dummy data generator 120 may generate dummy data including virtual information and target information corresponding to the target device 30 .

In step S300 , the processing unit 130 may execute the phishing application based on the user input and transmit dummy data to the phishing server 10 through the phishing application.

In step S400 , the monitoring unit 140 may monitor abuse information received by the target device 30 from the operating entity 20 of the phishing server 10 .

According to an embodiment, the phishing victim monitoring method may further include, when the target device receives the victim information, performing a warning to the victim (S500).

In step S500, the monitoring unit 140 may warn the victim when the target device 30 receives the abuse information. According to the embodiment, the monitoring unit 140 may deliver the victim information to the victim to block the victim information and issue a warning to block the operating entity.

In the above, even though all the components constituting the embodiments disclosed in this document have been described as being combined or operated as one, the embodiments disclosed in this document are not necessarily limited to these embodiments. That is, within the scope of the objectives of the embodiments disclosed in this document, all of the components may be selectively combined with one or more to operate.

In addition, terms such as "comprise", "comprise", or "having" described above mean that the corresponding component may be inherent unless otherwise stated, excluding other components. It should be construed as being able to further include other components. All terms, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the embodiments disclosed in this document belong, unless defined otherwise. Commonly used terms, such as terms defined in a dictionary, should be interpreted as consistent with the contextual meaning of the related art, and unless explicitly defined in this document, they are not interpreted in an ideal or excessively formal meaning.

The above description is only an illustrative example of the technical idea disclosed in this document, and those skilled in the art to which the embodiments disclosed in this document belong will be within the scope of the essential characteristics of the embodiments disclosed in this document. Many modifications and variations will be possible. Therefore, the embodiments disclosed in this document are not intended to limit the technical spirit of the embodiments disclosed in this document, but to explain, and the scope of the technical spirit disclosed in this document is not limited by these embodiments. The protection scope of the technical ideas disclosed in this document should be interpreted according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of rights of this document.

10 : Phishing Server
20: operating entity
30: target device
100: phishing damage monitoring system
110: extraction unit
120: dummy data generator
130: processing unit
140: monitoring unit
150: database
160: application acquisition unit

Claims (15)

an extractor for extracting phishing server information corresponding to a phishing application;
a dummy data generating unit generating dummy data including virtual information and target information corresponding to a target device;
a processing unit that executes the phishing application based on a user input and transmits the dummy data to a phishing server corresponding to the phishing server information through the phishing application; and
A monitoring unit configured to monitor offending information received by the target device from an operating entity of the phishing server;
The target device is distinguished from the victim terminal,
The target information includes relationship name information,
The phishing victim monitoring system of claim 1 , wherein the dummy data generation unit further generates the virtual information based on the offender information when the offender information is received. According to claim 1,
The monitoring unit, the phishing damage monitoring system for performing a warning to the victim when the target device receives the offending information. According to claim 2,
The monitoring unit performs the warning to block the operating entity by transmitting the offending information to the victim to block the offending information. delete According to claim 1,
The perpetrator information includes at least one of a phone number, a profile, an email, an account number, and an IP address of the operating entity. According to claim 1,
The dummy data generating unit generates the dummy data based on at least one of software, a programming language script, and a user input. According to claim 1,
The dummy data generating unit includes at least one of a phone book generating module, a text message generating module, and a unique identification number generating module. According to claim 1,
The processing unit includes at least one of a mobile device, a virtual machine, and an emulator. According to claim 1,
The phishing victim monitoring system of claim 1, wherein the processing unit is configured to be physically separated from the extraction unit, the dummy data generation unit, and the monitoring unit. According to claim 1,
A phishing damage monitoring system that further includes a database for storing and managing existing damage information. According to claim 10,
The phishing victim monitoring system further comprises an application acquiring unit acquiring the phishing application from the victim terminal or the database based on phishing application information corresponding to the phishing application. According to claim 11,
The phishing victim monitoring system of claim 1 , wherein the application obtaining unit acquires the phishing application from the database based on a result of comparing the phishing application information with data of the database. According to claim 10,
The monitoring unit phishing damage monitoring system for updating the data of the database based on the offender information. extracting phishing server information corresponding to the phishing application;
generating dummy data including virtual information and target information corresponding to a target device;
executing the phishing application based on a user input and transmitting the dummy data to a phishing server corresponding to the phishing server information through the phishing application;
monitoring abuse information received by the target device from an operator of the phishing server information; and
Further generating the virtual information based on the offense information when the offense information is received;
The target device is distinguished from the victim terminal,
The target information includes relationship name information. According to claim 14,
The method of monitoring phishing damage further comprising the step of performing a warning to the victim when the target device receives the abuse information.

Images