KR20130032754A - Method, system and computer readable recording medium for web-page monitoring - Google Patents

Abstract

PURPOSE: A webpage falsification identifying method, a system thereof, and a computer-readable recording medium thereof are provided to identify the falsification of a webpage without installing a module or application in a user terminal. CONSTITUTION: A web server(120) receives a webpage request from a user terminal(100) and inserts a detection script and an intrinsic identifier of a webpage into the webpage corresponding to the request. The web server transmits a normal identification value calculated by applying the detection script and the intrinsic identifier to the webpage to a falsification identifying server(130). The falsification identifying server compares the normal identification value with an identification value transmitted from the user terminal based on the intrinsic identifier in order to determine the falsification of the webpage. [Reference numerals] (100) User terminal; (120) Web server; (130) Falsification identifying server;

Description

METHOD, SYSTEM AND COMPUTER READABLE RECORDING MEDIUM FOR WEB-PAGE MONITORING

The present invention relates to a web page modulation identification method, a system and a computer-readable recording medium, and more particularly, to detect a unique identifier of a web page and an insertion value inserted into a specific web page to generate an identification value of the web page. The present invention relates to a web page modulation identification method, a system and a computer-readable recording medium capable of determining whether a web page is tampered with at a user terminal without installing a separate application using a script.

Due to the development of information and communication technology, information transmission in modern society is mostly done using the web. Using these points, hacking for malicious purposes is increasing rapidly, and web page forgery is increasing day by day. Web page forgery by hacking refers to the act of transforming web page file information from malicious intention on the network. In 2008, 15,940 total hacking incidents reported / received to the Internet Infringement Response Center 2,204, or 13.8% of the total, are on the rise. Such web page forgery is generally performed for the purpose of spreading malicious codes / programs for hacking, unauthorized collection of personal information, posting advertisements, arranging reward mechanisms based on clicks, and arranging search results.

Various technologies have been developed to prevent / prevent such web page forgery. Korea Patent Registration No. 10-1044291 (Real-time tampering detection and recovery system of real-time webpage, June 28, 2011.), forgery recovery using a forgery recovery server that stores the original web page files provided by the web server and web server The server compares the currently provided web page file stored in the web server with the stored original web page file to determine whether the web page is forged, and if the web page is forged, the web is modified using the stored original web page file. A technique for restoring pages is proposed.

However, such a prior art can only detect web page forgery due to hacking at the web server side, and when the web page is tampered with by malicious code or program installed on the user terminal at the user terminal, or from the web server. Although normally transmitted to the terminal, there is a problem in that it is impossible to detect that the web page is forged on the delivery path.

In addition, the prior art as described above may be applied to a static web page whose contents do not change, but a dynamic web page dynamically generated / provided based on a user's request There is a problem that is difficult to apply.

In addition, in the case of the prior art as described above, the original web page file must be stored separately, and forgery is identified by comparing the original web page file with the entire currently provided web page file, thus requiring a lot of system resources and performing in real time. There is a problem that is difficult.

Meanwhile, in order to identify / detect web page forgery on a user terminal, various security / vaccine applications, modules, etc. have been developed and serviced. However, in the case of such technology, a separate application, module, etc. must be installed on the user terminal, and Since only a known type of malicious code is inserted into a web page or the like, there is a problem that it is difficult to identify an unknown type of web page forgery.

An object of the present invention is to solve the above-mentioned problems of the prior art.

An object of the present invention is to provide a web page modulation identification method, a system and a computer-readable recording medium capable of identifying forgery of a web page without installing a separate application or module in a user terminal.

It is another object of the present invention to provide a web page modulation identification method, system and computer readable recording medium capable of identifying that a web page normally transmitted from a web server is forged on a delivery path or on a user terminal.

It is still another object of the present invention to provide a web page forgery identification method, system and computer readable recording medium capable of providing an optimized webpage forgery identification function with minimum system resources.

In order to achieve the above-described object of the present invention and to achieve the specific effects of the present invention described below, the characteristic structure of the present invention is as follows.

According to an aspect of the present invention, there is provided a web page modulation identification method comprising the steps of: (a) receiving a web page request transmitted from a user terminal by a web server; (b) the web server inserts a detection script including a unique identifier of the web page into a web page corresponding to the request and transmits the detected script to the user terminal, and the unique identifier of the web page and the detection script are transmitted to the web page. Transmitting a normal identification value calculated and applied to the modulation identification server; And (c) the tamper identification server receives a web page unique identifier and a web page identification value transmitted from the user terminal, and from the user terminal and the normal identification value transmitted from the web server based on the web page unique identifier. And comparing the transmitted identification values to determine whether the web page has been tampered with, wherein the detection script is executed on a web browser of the user terminal to calculate an identification value of the web page, Web page modulation identification method is provided, characterized in that for transmitting the calculated identification value to the modulation identification server.

According to another aspect of the present invention, there is provided a web page modulation identification method, comprising: (A) a web server receiving a web page request transmitted from a user terminal; And (B) the web server inserting a detection script into a web page corresponding to the request to the user terminal by inserting a detection script including a unique identifier of the web page and a normal identification value calculated by applying the detection script to the web page. And transmitting, wherein the detection script is executed on a web browser of the user terminal to calculate an identification value of the web page and compare the normal identification value to determine whether the web page is tampered with. A page modulation identification method is provided.

According to still another aspect of the present invention, in a web page modulation identification system, a web page request transmitted from a user terminal is received, and a detection script including a unique identifier of the web page is included in a web page corresponding to the request. A web server inserted and transmitted to the user terminal, and transmitting a unique identifier of the web page and a normal identification value calculated by applying the detection script to the web page to a modulation identification server; And receiving a web page unique identifier and a web page identification value transmitted from the user terminal, comparing the normal identification value transmitted from the web server with the identification value transmitted from the user terminal based on the web page unique identifier. And a tamper identification server for determining whether a web page has been tampered with, wherein the detection script is executed on a web browser of the user terminal to calculate an identification value of the web page, and the web page unique identifier and the calculated identification value. Web page modulation identification system is provided, characterized in that for transmitting to the modulation identification server.

According to still another aspect of the present invention, in a web page modulation identification system, a web page request transmitted from a user terminal is received, and the web page corresponding to the request has a unique identifier and a detection script of the web page. And a web server for inserting a detection script including a normal identification value calculated for the page and transmitting the detection script to the user terminal, wherein the detection script is executed on a web browser of the user terminal to determine the identification value of the web page. A web page tamper identification system is provided, characterized in that it is calculated and compared with the normal identification value to determine whether the web page has been tampered with.

As described above, according to the present invention, the forgery of the web page can be identified without installing a separate application or module in the user terminal.

Further, according to the present invention, there is an effect that it is possible to identify that the web page normally transmitted from the web server is forged on the delivery path or on the user terminal.

In addition, according to the present invention, it is possible to provide an optimized web page forgery identification function using a minimum of system resources.

1 is a block diagram of a web page modulation identification system according to a preferred embodiment of the present invention.
2A is a block diagram of a web server in a preferred embodiment of the present invention.
2B is a block diagram of a modulation identification server according to a preferred embodiment of the present invention.
3 is a flowchart illustrating a web page modulation identification process performed in a web page modulation identification system according to an exemplary embodiment of the present invention.
4 is an exemplary diagram showing an exemplary HTML code that can be applied to a web page modulation identification system according to a preferred embodiment of the present invention.

DETAILED DESCRIPTION The following detailed description of the invention refers to the accompanying drawings that show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention.

[Preferred Embodiment of the Present Invention]

In the embodiment of the present invention, the term "web page" means any kind of web page that can be displayed on the user terminal using a web browser of the user terminal, and the extension of the language or web page file constituting the web page. It is not limited by.

The term "web page forgery" or "web page tampering" also includes any irregular behavior on the original web page, such as altering the contents of the original web page file or inserting new code that is not included in the original web page file. Collectively.

Complete system configuration

1 is a block diagram of a web page modulation identification system according to a preferred embodiment of the present invention. Hereinafter, the configuration and function of the web page modulation identification system according to the present invention will be described with reference to FIG. 1.

As shown in FIG. 1, the entire system including the web page modulation identification system according to the present invention may include a user terminal 100, a network 110, a web server 120, and a modulation identification server 130. Can be.

The user terminal 100 accesses the web server 120 through the network 110 and requests a web page inputted according to a user's operation to the web server 120 and is transmitted from the web server 120 according to the request. It receives a web page file and displays it through a web browser. The user terminal 100 is a personal information communication device that is generally used, as well as a desktop computer, a notebook computer, a workstation, a palmtop computer, a personal digital assistant (PDA), a web pad, a smart phone. Any digital device having a memory means and a microprocessor equipped with a computing capability, such as a mobile communication terminal including a phone, can be adopted as the user terminal 100 according to the present invention. The user terminal 100 itself included in the entire system according to the present invention generally does not have a separate application / module other than a web browser for performing web surfing and displaying a web page. The above detailed description will be omitted.

According to an embodiment of the present invention, the network 110 may be configured without regard to communication modes such as wired and wireless, and may include a personal area network (PAN), a local area network (LAN), It may be configured with various communication networks such as Metropolitan Area Network (MAN) and Wide Area Network (WAN).

Meanwhile, the web server 120 according to the present invention transmits the requested web page file to the user terminal 100 in response to a specific web page request transmitted from the connected user terminal 100. 120) The function will be performed. Detailed description of such a general web server function will be omitted, and hereinafter, the description will focus on the original function according to the present invention.

Before looking at the configuration and function of the web server 120 and the modulation identification server 130 according to the present invention, the general concept of the web page modulation identification method that forms the basis of the present invention will be described. In the web page modulation identification method according to the present invention, the identification information generated from the web page transmitted from the web server 120 and normally displayed on the user terminal 100 and transmitted from the web server 120, but in the transmission process or the user terminal Based on the fact that the identification information generated from the forged / modulated web page is different at step 100, the normality of the web page at the time when the web server 120 transmits the requested web page file to the user terminal 100. Generate identification information, and generate identification information of the web page currently displayed on the user terminal 100 by using the detection script included in the web page file transmitted to the user terminal 100 to generate a normal identification It is configured to determine whether the web page is tampered with by comparing with the information.

In order to perform the function as described above, when the web server 120 according to the present invention receives a specific web page request transmitted from the user terminal 100, the web page file of the corresponding web page from the database 122 Extract, insert a detection script into the extracted web page file, and transmit the inserted web page file to the user terminal 100. On the other hand, if the requested web page is a dynamic web page, the web server 120 does not extract the stored web page file, but generates a dynamic web page corresponding to the request based on the basic data stored in the database 122. It is configured to insert the detection script into the generated dynamic web page.

At this time, it is more preferable that the detection script inserted into the web page file is inserted with a unique identifier of the corresponding web page so that it can be used in a web page tampering determination process. The web page unique identifier may be a unique information for identifying a web page, may be a uniform resource locator (URL) address of the web page, or may be identification information set in advance by the web server 120, or It may be identification information generated in real time by the web server 120 at the time of transmission of the web page and assigned to the web page. Details of the detection script according to the present invention will be described later with reference to FIG. 2A.

In addition, the web server 120 according to the present invention, when the web page file inserted with the detection script is transmitted to the user terminal 100, or before the transmission of the detection script is a corresponding web page file (that is, the detection script is And a calculated normal identification value applied to the inserted web page file) and transmits the calculated normal identification value and the unique identifier of the corresponding web page to the modulation identification server 130. The unique identifier and the normal identification value of the web page are used in the process of identifying whether the web page has been tampered with.

The modulation identification server 130 according to the present invention receives / stores a unique identifier and a normal identification value for a specific web page transmitted from the web server 120, and the user terminal 100, more precisely, the user terminal 100. The unique identifier of the web page displayed in the web browser of the current user terminal 100 transmitted from the detection script executed through the web browser of the user terminal 100 and the identification of the current web page calculated according to the execution of the detection script. Receive a value and compare the normal identification value of the web page with the same unique identifier with the identification value sent from the detection script to determine whether the web page has been tampered with.

Further, more preferably, the modulation identification server 130 according to the present invention receives the unique identifier and the normal identification value from the web server 120, and then the user terminal 100 within a preset time (for example, 10 seconds). If the identifier and the identification value of the web page is not transmitted from the web page may be configured to determine that the web page has been modified. In this case, that is, when the detection script inserted in the web page transmitted to the user terminal 100 does not operate normally, since the detection script is likely to be deleted or corrupted by the web page tampering, the web page tampering is performed based on this. It is reasonable to be configured to judge.

If it is determined that the web page has been tampered with, and it is determined that the web page has been tampered with, the modulation identification server 130 transmits the web page tampering information (including the web page identifier) to the web server 120 and / or the user terminal 100. It may be further configured to generate and transmit. In an embodiment implemented in this manner, the web server 120 receives the web page tampering information and which web page has been tampered with the included web page identifier, and which web page is sent to which user terminal 100. May be configured to transmit information related to the manager terminal (not shown) and / or the user terminal 100 by determining whether the information has been modified. In addition, the detection script running on the web browser of the user terminal 100, when the web page modulation information is transmitted from the modulation identification server 130, receives it and generates a certain warning message and outputs it through the user terminal 100. It is configured to.

As described above, the detailed configuration and function of the modulation identification server 130 according to the present invention will be described later with reference to FIG. 2B.

Meanwhile, in FIG. 1, the web server 120 and the modulation identification server 130 according to the present invention may be physically implemented in one machine, some or each of which may be physically implemented in another machine, or the same function. There may be a plurality of physical machines that exist in parallel. As such, it will be apparent to those skilled in the art that the present invention can be changed in various ways without being limited to the physical number and location of the machine or database in which each component is installed.

On the other hand, according to the configuration of the embodiment, the web page modulation identification system according to the present invention does not use the modulation identification server 130 as described above, and whether the web page has been tampered with, and is used by the user terminal 100 itself. It may be configured to determine. In such an embodiment, the web server 120 according to the present invention extracts a web page file corresponding to a request sent from the user terminal 100, inserts a detection script into the extracted web page file, and then detects the script. And transmit the inserted web page file to the user terminal 100. In this case, the detection script inserted into the web page file includes the normal detection value by applying the detection script to the web page file, and the detection script is executed through the web browser of the user terminal 100 to execute the current user terminal ( The user terminal 100 determines whether the web page has been tampered with by comparing the identification value of the web page displayed on the web browser of step 100 with the normal identification value calculated / inserted before being transmitted from the web server 120. Done. In the same manner as in the above-described embodiment, when it is determined that the web page has been tampered with, the detection script may be configured to generate a predetermined warning message and output the same through the user terminal 100.

On the other hand, in this embodiment, the unique identifier of the web page may or may not be optionally included in the detection script. That is, since the detection script itself is configured to determine whether the web page has been tampered with, the unique identifier of the web page may not be required to determine whether the web page has been tampered with. When the modulation information of the page is configured to be transmitted to the web server 120 and / or the tamper identification server 130, since identification of the web page is required, the identification information may be configured to be inserted into the detection script.

Web server configuration

2A is a block diagram of a web server in a preferred embodiment of the present invention. Hereinafter, the detailed configuration and function of the web server according to the present invention will be described with reference to FIG. 2A.

As shown in FIG. 2A, the web server 120 according to the present invention may include a detection script managing unit 210, an administrator setting unit 212, and a web page managing unit 214.

The detection script management unit 210 inserts a previously generated / stored detection script or a real-time generated detection script according to a setting in a requested web page file, and performs a function as described above, and detects a unique identifier of the corresponding web page. The identification value is transmitted to the modulation identification server 130. At this time, the detection script management unit 210 also performs a function of including the unique identifier of the web page in the detection script to be inserted into the web page, and according to the configuration of the embodiment to include the identification value in the detection script to be inserted Can be configured.

In addition, in an embodiment configured to generate the unique identifier of the web page in real time, the detection script management unit 210 is configured to perform a function of generating / storing the unique identifier of the web page. When the web page unique identifier is generated / granted in real time, that is, depending on the time of transmission of the web page and the user terminal requesting the web page, it is possible to easily determine whether the web page has been tampered with and the web page has been tampered with. An advantageous effect can be expected in that the user terminal 100 can be identified. For example, when the same web page is transmitted to the user terminal 100 called A, and transmitted to the user terminal 100 called B at about the same time, the terminal A when the web page unique identifier is generated / inserted in real time. Since the identifier of the transmitted web page and the identifier of the web page transmitted to the terminal B are different, it is possible to determine which terminal the web page sent to has been tampered with using the web page identifier, and the corresponding action (modulated web It is possible to easily and quickly disconnect the terminal displaying the page or send a warning / check message to the terminal.

4 is an exemplary view showing a web page file implemented through exemplary HTML code that can be applied to a web page modulation identification system according to a preferred embodiment of the present invention. 4, the detection script according to the present invention will be described in detail. The detection script inserted into the web page file by the detection script management unit 210 according to the present invention is executed when the loading of the web page file in the web browser of the user terminal 100 is completed and is currently displayed in the web browser. The file information of the page (ie, the web page into which the detection script is inserted) is used to calculate an identification value for verifying the integrity of the web page.

For example, the detection script according to the present invention may include a hash value for all or a predetermined portion of a web page file, a data value for a predetermined portion of the web page file, a time of creation / modification of the web page file, a size of the web page file, And calculating at least one or more of the number of specific tags in the web page as an identification value capable of verifying the integrity of the web page and transmitting the calculated identification value to the modulation identification server 130. The above identification values are only examples and should not be construed as limiting. Since the technical gist of the present invention is not in the identification value calculation itself for verifying the integrity of the web page, various known identification value calculation techniques may be applied. As long as the gist of the present invention is included, it will be obvious to those skilled in the art.

Referring to FIG. 4, in the code of FIG. 4, for example, the detection script may count the number of tag <div> and output the result as an identification value, and coords of the <map> tag whose id is 'logo_ss' You can identify a value and output the value as an identification value, count the number of meta tags, and output the result as an identification value. Meta tag <meta http-equiv = "X-UA-Compatible" content = " It may be configured to output the presence or absence of IE = edge "/> as an identification value. When configured to use the number of tag <div> as the identification value, the normal identification value of the original web page file is '4', so if the identification value calculated as the result of execution of the detection script is 3, the corresponding web page has been tampered with. You can do it. Also, in an embodiment configured to use the coords value of the <map> tag whose id is' logo_ss' as the identification value, the normal identification values of the original web page file are '0,0,0,78', '0,0,210, 78 ', if the identification value calculated as a result of the execution of the detection script is different, it can identify that the web page has been tampered with. In addition, the hash value may be calculated for all or part of the code shown in FIG. 4, and the calculated hash value may be used as an identification value. This hash value calculation algorithm may be adopted as needed by any one of known algorithms such as MD5, SHA1, SHA224, SHA256, SHA348, SHA512.

The generation / insertion of such a detection script (i.e., what algorithm is used to calculate the identification value using the information of the web page file) is set according to a control command transmitted from an administrator terminal (not shown) according to the operation of the administrator. / Can be configured to change. In order to perform such a function, the web server 120 according to the present invention provides an interface for setting a detection script related function to a connected / authenticated manager terminal, and according to a control command transmitted from the manager terminal, the detection script manager ( It may include a manager setting unit 212 for setting the function of the 210.

On the other hand, in order to enhance security, the detection script management unit 210 according to the present invention may be configured to change the type of detection script that is generated / inserted periodically according to the setting. That is, for example, in an embodiment configured such that the type of detection script changes periodically, the detection script management unit 210 determines whether a detection script change cycle arrives, and when the change cycle arrives, the detection script currently used. (For example, a detection script that calculates a hash value as an identification value) is changed to another detection script (for example, a detection script that calculates the number of specific tags in a web page as an identification value) according to a setting. The change of the detection script may be changed sequentially according to a preset change order, or may be configured to change to a detection script selected randomly among the available detection scripts.

On the other hand, the web server 120 according to the present invention is a series of processes for verifying the integrity of the web page only for a specific web page preset (creation / insertion of detection script and calculation / transmission of the web page identifier / identification value) And the like). In order to perform such a function, the web server 120 according to the present invention stores an address list of web pages that are subject to tamper detection in a database, and when a specific web page is requested from the user terminal 100, the requested web The web page manager determines whether the requested web page corresponds to an identification target for tampering or not, based on the URL address of the page, and controls the detection script manager 210 only when the identification target corresponds to the identification target. 214 may be further included.

The manager setting unit 212 provides an administrator interface for setting / controlling a function of the web server 120 to an administrator terminal whose management authority is authenticated, and according to a control command / setting command transmitted from the administrator terminal, A function of controlling overall web page tamper identification function (detection script setting / management, tamper identification target web page information setting / management, etc.) of the user 120 is performed.

Configuration of Tamper Identification Servers

2B is a block diagram of a modulation identification server according to a preferred embodiment of the present invention. Hereinafter, with reference to Figure 2b will be described in detail the configuration and function of the modulation identification server according to the present invention.

As shown in FIG. 2B, the modulation identification server 130 according to the present invention may include a modulation identification unit 220, an identification result report unit 222, and a modulation result analysis unit 224.

The modulation identification unit 220 receives the unique identifier and identification value of the original web page transmitted from the web server 120, stores it in the database, and transmits the current identifier transmitted from the user terminal (detection script executed on the web browser of the user terminal). After receiving the unique identifier and the identification value of the web page displayed on the user terminal, by comparing the identification value of the original web page having the same unique identifier and the identification value transmitted from the user terminal 100, whether the web page is tampered with It will perform the function of identifying. In addition, as described above, the modulation identification unit 220 according to the present invention, if a predetermined response is not transmitted for a predetermined time from the user terminal 100 receiving the web page in which the detection script is inserted, the corresponding web page is May be configured to determine as modulated.

When the identification result report unit 222 determines that a specific web page is modified by the modulation identification unit 220, the identification result report unit 222 transmits the web page tampering information as an HTTP response to the user terminal 100. The detection script of the user terminal 100 receives the web page tampering information, generates a warning message, and outputs the warning message through the display unit of the user terminal 100. In addition, the identification result report unit 222 according to the present invention may be configured to generate the modulation information including the identifier of the web page and transmit it to the web server 120, if the tampering of a particular web page is detected. In this embodiment, the web server 120 receives the tampering information, determines which web page has been tampered with using the web page unique identifier included in the received web page tampering information, the unique identifier is the time of the web page transmission, and When generated in real time for each user terminal requesting a web page, the information on which web page transmitted to the user terminal is analyzed, and a corresponding action, that is, a warning message is generated and transmitted to the corresponding user terminal 100. Or, it may be possible to take measures to limit the connection of the user terminal 100, and the like.

Meanwhile, according to an embodiment of the present disclosure, when the detection script executed on the user terminal 100 receives the web page modulation information from the modulation identification server 130, the detection script 130 modulates the modulated web page information. It can be configured to transmit to. In this case, the modulation result analysis unit 224 included in the tamper identification server 130 analyzes the modified web page information transmitted from the detection script to determine what part of the web page has been tampered with. It will analyze the type of module and so on. For analysis of the modulation result, the modulation identification server 130 stores the original web page in a database or, if it is determined that a particular web page has been tampered with, uses the identifier of the web page to send it to the web server 120. Request and receive a web page file corresponding to the web page identifier, and perform analysis of the modulation result by comparing the web page file sent from the detection script with the web page file sent from the web server. In addition, for analysis of the modulation result, the modulation identification server 130 stores the modulation type information according to the type of malicious code / module that modulates the web page in a database, and compares the modulation result analysis content with the modulation type information to malicious It may be configured to identify the type of code and the like. Of course, such modulation type information is updated in real time or periodically by an external analysis server (not shown), and when a web page modulation that does not correspond to the stored modulation type is generated, related information is transmitted to the analysis server for analysis. .

Example of web page tampering identification process

3 is a flowchart illustrating a web page modulation identification process performed in a web page modulation identification system according to an exemplary embodiment of the present invention. Hereinafter, a web page modulation identification process according to the present invention will be described in detail with reference to FIG. 3.

First, the user terminal 100 requests a specific web page to the web server 120 according to the user's operation (S300), and the web server 120 receiving the request extracts a web page file corresponding to the request. In operation S302, a detection script (including a unique identifier of the corresponding web page) is generated and inserted into the extracted web page file.

The web server transmits the web page file in which the detection script is inserted to the user terminal 100 (S304), and at the same time, the unique identifier of the web page and the detection script inserted in the web page are applied to the web page file and calculated. The identification value is transmitted to the modulation identification server 130 (S306).

The detection script included in the web page file transmitted to the user terminal 100 is executed when the loading of the web page file transmitted to the web browser is completed (S308) and is displayed on the current user terminal 100 calculated as a result of the execution. The identification value of the web page and the unique identifier of the included web page are transmitted to the modulation identification server 130 (S310).

The modulation identification server 130 receives a unique identifier indicating a specific web page and an identification value calculated as a result of executing the detection script from the user terminal 100, and has the same identification value transmitted from the web server 120. The normal identification value of the web page file and the identification value received from the user terminal 100 are compared to determine whether the corresponding web page has been tampered with (S312).

If it is determined that the modulation is a certain web page in the specific user terminal 100 is determined (S314), the modulation identification server 130 transmits the web page modulation information to the corresponding user terminal 100 (S316) ), The detection script of the user terminal 100 receives the generated warning message and outputs the warning message through the user terminal 100 (S318).

Embodiments according to the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape; optical media such as CD-ROM and DVD; magnetic recording media such as a floppy disk; Includes hardware devices specifically configured to store and perform program instructions such as megneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

100: user terminal 110: network
120: Web server 130: tamper identification server

Claims (21)

In the web page modulation identification method,
(a) the web server receiving a web page request transmitted from the user terminal;
(b) the web server inserts the unique identifier and detection script of the web page into the web page corresponding to the request and transmits it to the user terminal, and the unique identifier of the web page and the detection script for the web page. Transmitting the normal identification value calculated and applied to the modulation identification server; And
(c) the modulation identification server receives a web page unique identifier and a web page identification value transmitted from the user terminal, and transmits from the user terminal a normal identification value transmitted from the web server based on the web page unique identifier Comparing the identified identification values to determine whether the web page has been tampered with;
The detection script is executed on a web browser of the user terminal to calculate an identification value of the web page, and transmits the web page unique identifier and the calculated identification value to the modulation identification server, characterized in that the web page modulation identification Way.
In the web page modulation identification method,
(A) the web server receiving a web page request sent from the user terminal; And
(B) the web server inserting the detection script containing the normal identification value calculated by applying the detection script to the web page corresponding to the request and transmits the detection script to the user terminal,
And the detection script is executed on a web browser of the user terminal to calculate an identification value of the web page and compare the normal identification value to determine whether the web page has been tampered with.
The method according to claim 1 or 2,
And the detection script calculates a hash value of the entire or preset portion of the web page as an identification value.
The method according to claim 1 or 2,
And the detection script calculates a data value of a set portion of the web page as an identification value.
The method according to claim 1 or 2,
And the detection script calculates the size of the web page as an identification value.
The method according to claim 1 or 2,
And the detection script calculates the number of preset specific tags in the web page as an identification value.
The method according to claim 1 or 2,
And the web server inserts the detection script into the web page only when the web page requested from the user terminal is included in the web page tampering determination list.
The method according to claim 1 or 2,
And the detection script outputs a warning message to the user terminal if it is determined that the web page has been tampered with.
The method according to claim 1 or 2,
And the detection script transmits the modified web page information to the web server or the tamper identification server when it is determined that the web page has been tampered with.
The method according to claim 1,
In the step (c), the webpage modulation further determines that the webpage has been tampered with if the webpage unique identifier and the webpage identification value are not transmitted from the user terminal within a preset time. Identification method.
A computer-readable recording medium having recorded thereon a program for performing the method of claim 1.
In the web page modulation identification system,
Receives a web page request transmitted from a user terminal, inserts the unique identifier and detection script of the web page in the web page corresponding to the request and sends it to the user terminal, the unique identifier of the web page and the detection script A web server for transmitting a normal identification value calculated and applied to the web page to a modulation identification server; And
Receiving a web page unique identifier and a web page identification value transmitted from the user terminal, and comparing the normal identification value transmitted from the web server with the identification value transmitted from the user terminal based on the web page unique identifier. Includes a tamper identification server that determines whether the page has been tampered with,
The detection script is executed on a web browser of the user terminal to calculate an identification value of the web page, and transmits the web page unique identifier and the calculated identification value to the modulation identification server, characterized in that the web page modulation identification system.
In the web page modulation identification system,
Receiving a web page request sent from the user terminal, and inserts a detection script containing a normal identification value calculated by applying the detection script to the web page corresponding to the request to the web page to transmit to the user terminal Include servers,
And the detection script is executed on a web browser of the user terminal to calculate an identification value of the web page and compare the normal identification value to determine whether the web page has been tampered with.
14. The method according to claim 12 or 13,
And the detection script calculates a hash value of the entire or preset portion of the web page as an identification value.
14. The method according to claim 12 or 13,
And the detection script calculates a data value of a set portion of the web page as an identification value.
14. The method according to claim 12 or 13,
And the detection script calculates the size of the web page as an identification value.
14. The method according to claim 12 or 13,
And the detection script calculates the number of preset specific tags in the web page as an identification value.
14. The method according to claim 12 or 13,
And the web server inserts the detection script into the web page only when the web page requested from the user terminal is included in the web page tampering determination list.
14. The method according to claim 12 or 13,
And the detection script outputs a warning message to the user terminal if it is determined that the web page has been tampered with.
14. The method according to claim 12 or 13,
And the detection script transmits the modified web page information to the web server or the tamper identification server when it is determined that the web page has been tampered with.
The method of claim 12,
And the tamper identification server further determines that the web page has been tampered with if the web page unique identifier and the web page identification value are not transmitted from the user terminal within a preset time.

Images