KR20160000565A - Apparatus and method for protecting personal information leakage - Google Patents

Abstract

Provided are a device and method for blocking personal information leakage. An application is selected, and one or more rights requested by the application are classified based on pre-learned data. The classified rights are analyzed, and a risk of the application is calculated. Through system call hooking, occurrence of a personal information access event or a file access event is monitored in real time. As a result of the monitoring, when the personal information access event or the file access event occurs, a risk of the application is controlled to be alarmed.

Description

[0001] APPARATUS AND METHOD FOR PROTECTING PERSONAL INFORMATION LEAKAGE [

Embodiments of the present invention relate to an apparatus and method for preventing the leakage of personal information.

In recent years, as a smart phone that has added computer support functions such as internet communication and information search to a mobile phone, a smart phone capable of installing an application desired by a user has appeared, and the range of the business through the internet use environment and the Internet is becoming very diverse .

For example, smartphone users can view the data on the desired product through the Internet at the place where they are currently located, while avoiding the hassle of having to directly visit the retailer or acquire information about the product through TV or catalog, You can order or reserve what you want from it.

However, in the process of using the various functions of the smart phone or the wireless Internet in this way, it is possible to prevent a malicious attack such as a request for purchase of a commodity terminal or an internet site (for example, The personal information stored in the personal computer can be exposed.

Accordingly, in order to prevent the leakage of personal information from the smartphone, it is necessary to determine whether the authenticated user has been accessed and provide services according to the authenticity, and thus it is necessary for each individual to freely use various programs and the Internet using the smartphone safely to be.

The system call is hooked to the APIs (Application Program Interfaces) mainly used in the malicious application among the existing methods of blocking personal information leakage, and when the API is called, the outflow path is whitelisted white-list), the method of blocking the leakage of personal information is applied.

However, it is troublesome for the user to directly manage the whitelist access policy. Even if the general user is interested in security, it is not easy to judge the right and wrong of the access path of the app and the information leaked from the information.

One embodiment of the present invention relates to an apparatus and method for blocking personal information leakage by classifying malicious applications through a support vector machine (SVM) classification algorithm and combining a real-time monitoring method through system call hooking .

One embodiment of the present invention monitors the leakage of personal information in real time through system call hooking by a repackaged malicious application without knowing the user and applies an SVM classification algorithm based on the authorization list of the application in order to increase the accuracy of the malicious application So as to improve the accuracy of the judgment.

The personal information leakage prevention apparatus according to an embodiment of the present invention includes an application selection unit for selecting an application, one or more privileges requested by the application based on previously learned data, and analyzing the classified one or more privileges A monitoring unit for monitoring in real time whether a personal information access event or a file access event occurs through a system call hooking, and a monitoring unit for monitoring the personal information access event or the file access event, And a determination unit for controlling the risk of the application to be alarmed when the file access event occurs.

According to an aspect of the present invention, the classifier may classify the at least one privilege using a SVM (Support Vector Machine) classification algorithm, and analyze the classified at least one privilege to quantify the risk of the application.

According to an aspect of the present invention, the classifier may quantify the risk by the one or more privileges.

According to an aspect of the present invention, the classifier may determine the risk ranking by the one or more privileges.

According to an aspect of the present invention, the classifying unit may detect the number of one or more rights among the one or more rights, the risk rankings being within a predetermined rank, and may quantify the risk of the application according to the detected number.

According to an aspect of the present invention, the determination unit may control information about whether the personal information access event or the file access event is generated by the application, and information about the risk of the application.

According to an aspect of the present invention, the determination unit may determine whether the personal information access event or the file access event generated by the application is generated, and whether the privilege invoked through the system call hooking is permitted by the application It is possible to control so that the information about whether or not it is an alarm.

An application rights classification apparatus according to an embodiment of the present invention includes an entire sample data generation unit for generating total sample data by dataizing all rights to be invoked in the kernel, A data classifying unit for classifying whether or not abnormalities are generated and generating sample data, a data learning unit for learning the classified sample data using a SVM (Support Vector Machine), and comparing the whole sample data with the learned sample data And determining a classification accuracy of the sample data.

According to an aspect of the present invention, the whole sample data generation unit may generate the entire sample data by listing up the risk rank for the entire rights.

According to one aspect of the present invention, the classifier may classify whether the one or more rights are normal or abnormal by applying a weight to the frequency called by the malicious application.

A method for blocking personal information leakage according to an exemplary embodiment of the present invention includes a step of selecting an application, a step of classifying one or more privileges requested by the application based on previously learned data, analyzing the classified one or more privileges, A step of monitoring in real time whether a personal information access event or a file access event is generated through a system call hooking in real time and a monitoring result of the personal information access event or the file access event The risk of the application is alarmed.

A method of classifying an application privilege according to an exemplary embodiment of the present invention includes generating all sample data by summing up all privileges called in the kernel and generating normalized or abnormal abnormalities of one or more privileges requested by a sample application, Generating classified data by classifying whether or not the classified sample data is classified into a plurality of classified sample data, learning the classified sample data using SVM (Support Vector Machine), and comparing the sampled sample data with the learned sample data, .

According to an embodiment of the present invention, it is possible to classify a malicious application through a support vector machine (SVM) classification algorithm, and to combine a real-time monitoring method with system call hooking to block private information leakage.

According to the embodiment of the present invention, the leaked personal information is monitored in real time through system call hooking by the repackaged malicious application without knowing the user, and the SVM classification algorithm based on the authorization list of the application is executed in order to increase the accuracy of the malicious application It is possible to increase the accuracy of the judgment.

1 is a block diagram illustrating a configuration of a personal information outflow blocking apparatus according to an embodiment of the present invention.
2 is a diagram showing an example of classifying categories of SVMs.
3 is a diagram illustrating an example of selecting a hyperplane in the SVM classification algorithm.
4 is a block diagram illustrating a configuration of an application rights classification apparatus according to an embodiment of the present invention.
5 is a diagram showing an example of total sample data.
6 is a flowchart illustrating a personal information leakage prevention method according to an embodiment of the present invention.
7 is a flowchart illustrating an application privilege classification method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and accompanying drawings, but the present invention is not limited to or limited by the embodiments.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The terminology used herein is a term used for appropriately expressing an embodiment of the present invention, which may vary depending on the user, the intent of the operator, or the practice of the field to which the present invention belongs. Therefore, the definitions of these terms should be based on the contents throughout this specification.

The apparatus and method for blocking private information according to an exemplary embodiment of the present invention monitors personal information leaked unintentionally by a malicious application repackaged in real time through system call hooking, The SVM classification algorithm can be applied based on the authorization list of the application to increase the accuracy of the risk.

1 is a block diagram illustrating a configuration of a personal information outflow blocking apparatus according to an embodiment of the present invention.

1, the personal information outflow blocking apparatus according to an exemplary embodiment of the present invention includes an application selecting unit 110, a classifying unit 120, a monitoring unit 130, and a determination unit 140.

1, the classification unit 120, the monitoring unit 130, and the determination unit 140 in addition to the application selection unit 110 may be provided with an alarm (alarm) for alarming the risk of the application, And an application module 100, but each module may be independently driven.

The application selection unit 110 receives an application.

For example, the user can select a specific application to install the application through the application market of the smartphone. The application selection unit 110 receives a selection signal generated according to the selection of the user, .

The classifying unit 120 classifies one or more privileges requested by the application based on previously learned data, and analyzes the classified one or more privileges to calculate the risk of the application.

The classification unit 120 may classify the at least one privilege using a SVM (Support Vector Machine) classification algorithm, and may analyze the classified at least one privilege to quantify the risk of the application.

The Support Vector Machine (SVM), which is generally referred to throughout the present invention, is one of the machine learning techniques. SVM (Support Vector Machine) classification algorithm is used to find a point for separating the data for a given data .

FIG. 2 is a diagram illustrating an example of classifying categories of SVMs, and FIG. 3 is a diagram illustrating an example of selecting a hyperplane in the SVM classification algorithm.

Referring to FIGS. 2 and 3, the SVM classification algorithm can be displayed in a vector space and can be classified into linear or nonlinear. 2 and 3, a polygon consisting of connecting lines of vectors located on the basis of the same category is referred to as a convex hull, and other vectors in the convex hull do not affect group classification, Vectors located outside can have a big impact.

As shown in FIG. 2, the outermost vectors are referred to as support vectors, and the lines and the planes that divide the support vectors are referred to as hyperplanes.

As shown in FIG. 3, a plurality of hyperplanes H1, H2, and H3 may be generated. However, H2, which is a hyperplane having the longest distance from the support vector, can effectively classify the two groups.

Referring again to FIG. 1, the classifier 120 may quantify the risk by the one or more privileges, and determine a risk ranking by the one or more privileges.

For example, the classifier 120 may detect the number of one or more privileges among the one or more privileges, the risk rankings being within a predetermined rank, and may quantify the risk of the application according to the detected number.

As a specific example, the classifying unit 120 may classify rights (for example, network use, telephone call, telephone number access, system tool access, etc.) requested by the selected application based on previously learned data .

In this case, the classification unit 120 can quantify the risk by the authority requested by the application. For example, among the above privileges, the network use is 80% (risk rank 1), the telephone number access is 79% Risk ranking 3), and so on.

In addition, the classifying unit 120 may manage the risk level of the application according to the sum of the risks or the sum of the risk scores among the rights requested by the application.

The classification unit 120 can quantify and classify the risk of the application or the risk according to the authority by applying the SVM classification algorithm.

For example, the classifier 120 may determine that the risk of the application is 80% if three or more of the rights requested by the application are within the risk rank 10. As another example, the classifier 120 may determine the risk of the application to be 80% if two or more of the rights requested by the application are within the risk rank 10.

As described above, the classifier 120 digitizes information on the risk of the application based on the SVM classification algorithm. The classifier 120 detects the occurrence of a personal information leakage event or a file access event in the monitoring unit 130 Wait.

The monitoring unit 130 monitors in real time whether a personal information access event or a file access event occurs through a system call hooking.

System call hooking will be briefly described to facilitate understanding of the present invention as follows.

A system call is an interface for accessing a kernel mode from a user mode according to an application request for a service provided by an operating system kernel. In order to access the system call, it is necessary to know the address of the system call table, find the address of the system call table, intercept the function call or message event, .

The monitoring unit 130 monitors in real time whether a personal information leakage event or a file access event occurs through system call hooking irrespective of the privileges granted to the application, And informs the determination unit 140 whether or not an event has occurred.

If the personal information access event or the file access event occurs as a result of the monitoring, the determination unit 140 controls the risk of the application to be alarmed.

For example, the determination unit 140 may control the application to inform the user of information about the occurrence of the personal information access event or the file access event, and the risk of the application.

Specifically, the determination unit 140 can notify the user of the information about the access to certain personal information generated by the application and the numerical information about the risk of the application.

As another example, the determination unit 140 may determine whether the personal information access event or the file access event generated by the application is generated, and whether the privilege invoked through the system call hooking is permitted by the application It is also possible to control so that the information about whether or not it is an alarm.

Specifically, the determination unit 140 may notify the user that information about access to certain personal information has been generated by the application, and that the called privilege has not been granted to the application. In this case, the determination unit 140 may inform the user that the risk of leakage of personal information is very dangerous.

Alternatively, the determination unit 140 may provide the user with information on which access to the personal information has been generated by the application, numerical information indicating whether the called privilege has the permission granted to the application or a certain degree of risk You can also alarm.

Hereinafter, an apparatus for classifying rights of an application using an SVM classification algorithm according to one aspect of the present invention will be described.

4 is a block diagram illustrating a configuration of an application rights classification apparatus according to an embodiment of the present invention.

4, an application rights classification apparatus 400 according to an aspect of the present invention includes an entire sample data generation unit 410, a classification unit 420, a data learning unit 430, and a determination unit 440 do.

The application authority classifying apparatus 400 may be a device for learning the risk judgment of the classifying unit 120 of FIG. 1 described above. The application authority classifying apparatus 400 can learn a risk value by each authority allowed in the application or learn how much the risk of the application is when the whole authority requested by the application includes a specific authority.

For example, the application privilege classifying apparatus 400 may be configured such that when the authority requested by the application is four, three of the privileges are dangerous and it is possible that the malicious application is abnormal. The probability of a malicious application is low (normal) because it is a low number or a low weight.

The entire sample data generation unit 410 generates total sample data by converting all rights to be called in the kernel into data.

5 is a diagram showing an example of total sample data.

The whole sample data shown in FIG. 5 may be a result of learning SVM using the sample data.

For example, as shown in FIG. 5, the whole sample data generation unit 410 may list up the risk rank for the entire rights and generate the whole sample data.

The classifying unit 420 classifies whether at least one authority requested by the sample application is normal or abnormal, and generates sample data.

For example, the classifier 420 may classify whether the one or more privileges are normal or abnormal by applying a weight to the frequency called by the malicious application.

In addition, the application privilege classifying apparatus 400 already has information on privileges frequently used by malicious applications or applications accessing personal information (for example, a combination of a risk per authority and a combination of authority risks) It is also possible to use the frequently used privileges of malicious applications as sample data for learning using SVM.

At this time, the classifying unit 420 may classify the rights requested by the sample data as normal or abnormal, and the classifying criterion may be a number of frequently used frequencies in the malicious application, Or if the specific authority is above the frequency ranking, it can be classified as abnormal.

As a concrete example, when it is assumed that the authority required when installing the application "here" is a network communication, a telephone call, a storage capacity, and a system tool, if the authorities of the entire sample data of FIG. 5 are mapped, 1, 2, 12, 15}. The classifying unit 420 may classify the sample data as normal and abnormal.

The data learning unit 430 learns the classified sample data using SVM (Support Vector Machine).

The data learning unit 430 may learn only a part of the sample data, for example, only 20% of the sample data.

The determination unit 440 compares the whole sample data with the learned sample data to determine the classification accuracy of the sample data.

For example, the determination unit 440 may calculate the classification rate of the entire data by comparing how well the learned sample data is classified with respect to the entire sample data.

Hereinafter, a personal information leakage prevention method according to an embodiment of the present invention will be described.

The personal information outflow blocking method according to an embodiment of the present invention can be performed using the above-described personal information outflow blocking apparatus, and will be described from the viewpoint of the personal information outflow blocking apparatus.

6 is a flowchart illustrating a personal information leakage prevention method according to an embodiment of the present invention.

Referring to FIG. 6, the personal information outflow blocking device selects an application (610).

The personal information leakage blocking device classifies one or more privileges requested by the application based on previously learned data (620), and analyzes the classified one or more privileges to calculate a risk of the application (630).

For example, the personal information leakage blocking device may classify the at least one privilege using a SVM (Support Vector Machine) classification algorithm, and analyze the classified one or more privileges to quantify the risk of the application.

As a specific example, the personal information outflow blocking device may quantify the risk by the one or more rights.

Also, the personal information leakage blocking device may be configured to determine a risk ranking by the at least one authority, to detect a number of one or more privileges whose risk rank is within a predetermined rank among the one or more privileges, The risk of the disease can be quantified.

The private information leakage blocking device monitors in real time whether a personal information access event or a file access event occurs through system call hooking (640).

If the personal information access event or the file access event occurs as a result of the monitoring, the private information leakage prevention device controls the risk of the application to be alarmed (650).

For example, the personal information leakage blocking device may control information about the occurrence of the personal information access event or the file access event by the application, and information on the risk of the application.

Hereinafter, an application privilege classification method according to one aspect of the present invention will be described.

The application authority classification method according to an aspect of the present invention can be performed using the application authority classification apparatus described above, and will be described from the viewpoint of an application authority classification apparatus.

7 is a flowchart illustrating an application privilege classification method according to an embodiment of the present invention.

Referring to FIG. 7, the application rights classification apparatus generates total sample data by converting the entire rights to be called in the kernel (710).

The application privilege classifier classifies whether at least one authority requested by the sample application is normal or abnormal and generates sample data (720).

The application authority classifying apparatus learns the classified sample data using SVM (Support Vector Machine) (730).

The application privilege classifying apparatus compares the whole sample data with the learned sample data to determine the classification accuracy of the sample data (740).

According to one aspect of the present invention, it is possible to apply the present invention to an application that blocks personal information flowing out of a smartphone, thereby preventing the leakage of personal information.

According to one aspect of the present invention, not only the application but also the security of the device having the Linux kernel can be applied to the security field to provide a numerical value of the security risk.

According to one aspect of the present invention, the risk of a malicious application can be automatically managed by a user by digitizing and alarming the user.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Alarm application module
110: Application selector
120:
130:
140:

Claims (16)

An application selection unit for selecting an application;
A classifier for classifying one or more privileges requested by the application based on previously learned data, and analyzing the classified one or more privileges to calculate a risk of the application;
A monitoring unit for monitoring in real time whether a personal information access event or a file access event occurs through system call hooking; And
A controller for controlling the risk of the application to be alarmed when the personal information access event or the file access event occurs as a result of the monitoring,
And a personal information outflow blocking device.
The method according to claim 1,
Wherein,
A personal information leakage prevention device for classifying one or more privileges using a SVM (Support Vector Machine) classification algorithm, and analyzing the classified privileges to quantify the risk of the application.
The method according to claim 1,
Wherein,
And the risk level is quantified by the one or more privileges.
The method according to claim 1,
Wherein,
And judges a risk rank according to the at least one authority.
5. The method of claim 4,
Wherein,
And detects the number of one or more rights among the one or more rights within the predetermined rank of the risk rankings and quantifies the risk level of the application according to the detected number.
The method according to claim 1,
Wherein,
Information on whether the personal information access event or the file access event is generated by the application, and information on the risk of the application.
The method according to claim 1,
Wherein,
Information about whether or not the personal information access event or the file access event is generated by the application and information about whether or not the privilege invoked through the system call hooking is permitted by the application Information leakage prevention device.
A whole sample data generation unit for generating total sample data by converting all rights to be called in the kernel into data;
A classifier for classifying whether at least one authority requested by a sample application is normal or abnormal and generating sample data;
A data learning unit that learns the classified sample data using a SVM (Support Vector Machine); And
A judging unit for judging classification accuracy of the sample data by comparing the whole sample data with the learned sample data,
And an application authority classifier.
9. The method of claim 8,
Wherein the overall sample data generation unit comprises:
And generates the entire sample data by listing up the risk rankings for the entire authorities.
9. The method of claim 8,
Wherein,
And classifies whether the at least one authority is normal or abnormal by applying a weight to a frequency called by the malicious application.
Selecting an application;
Classifying one or more privileges requested by the application based on previously learned data, and analyzing the classified one or more privileges to calculate a risk of the application;
Monitoring in real time whether a personal information access event or a file access event occurs through system call hooking; And
Controlling the risk of the application to be alarmed when the personal information access event or the file access event occurs as a result of the monitoring
The method comprising the steps of:
12. The method of claim 11,
The step of computing the risk of the application comprises:
Classifying the one or more privileges using a Support Vector Machine (SVM) classification algorithm, and analyzing the classified one or more privileges to quantify the risk of the application
The method comprising the steps of:
12. The method of claim 11,
The step of computing the risk of the application comprises:
Quantifying the risk by the at least one authority
The method comprising the steps of:
12. The method of claim 11,
The step of computing the risk of the application comprises:
Determining a risk ranking for each of the one or more privileges;
Detecting a number of one or more rights among the one or more rights that the risk ranking is within a predetermined rank; And
Quantifying the risk of the application according to the detected number
The method comprising the steps of:
12. The method of claim 11,
Controlling the application to alarm the information about the occurrence of the personal information access event or the file access event and information about the risk of the application
The personal information leakage prevention method further comprising:
Generating entire sample data by converting the entire rights to be invoked in the kernel into data;
Generating sample data by classifying whether at least one authority requested by a sample application is normal or abnormal;
Learning the classified sample data using SVM (Support Vector Machine); And
Determining the classification accuracy of the sample data by comparing the whole sample data with the learned sample data
The method comprising the steps of:

Images