KR20170041574A - Apparatus and method for protecting malicious site - Google Patents

Abstract

The present invention relates to a technology to detect and block a malicious site in a mobile environment. Disclosed are an apparatus and a method for blocking a malicious site which can control whether to transmit a specific link by including the specific link in a text message by determining whether the specific link is a malicious link or not before transmitting the text message including the specific link to a mobile terminal.

Description

[0001] APPARATUS AND METHOD FOR PROTECTING MALICIOUS SITE [0002]

The present invention relates to a technology for detecting and blocking a malicious site in a mobile environment, and a method for detecting a malicious link in a mobile environment, including transmitting a text message including a specific link (e.g., a web site link) And to control whether or not to transmit a specific link by including it in a text message, and to an apparatus and method for malicious site blocking.

As the function of a mobile terminal has recently been improved, a user can use a mobile terminal to handle financial transactions such as electronic payment, smart banking, and securities transaction in addition to using a communication service such as communication and message transmission between terminals have.

That is, the user stores personal information for a financial transaction such as a security certificate, credit card information, bankbook account information and the like in a mobile terminal, and processes a financial transaction without restriction on a time and place through a mobile terminal.

As a result, the number of users who process financial transactions using a mobile terminal is rapidly increasing, so that hacking damage through a mobile terminal is also rapidly increasing.

Smishing is an example of a typical hacking damage. Smishing is a new mobile hacking technique that combines text messages (SMS) and phishing with text messages.

For example, when a hacker transmits a text message including a specific link (hereinafter referred to as a " Web site link ") that induces a user of a mobile terminal to install a malicious application (e.g., a Trojan horse) The malicious application is installed and executed in the user's mobile terminal, and the user's personal information is transmitted to the hackers in a defenseless state.

In order to solve such a problem, when a text message including a website link is transmitted to a mobile terminal, when a user clicks a link of a website included in a text message, A method of accessing the site link and determining whether or not the malicious site has been detected is transmitted to the user of the mobile terminal.

However, in order to determine whether or not the malicious site is in the cloud, the link of the web site clicked on the mobile terminal must be transmitted to the cloud, and the received cloud accesses the corresponding web site to determine whether or not the malicious site is determined The user has to wait for a long time before receiving the result of determining whether the malicious site is malicious or not.

In addition, as the hackers become more intelligent, even if the user does not click on the website link included in the text message, receiving the text message including the website link may cause hacking damage. Therefore, A technique for determining whether or not a web site link is a malicious site before a text message is received by the mobile terminal is required.

Accordingly, in the present invention, before transmitting the text message including the website link to the mobile terminal, it is determined whether or not the web site link is a malicious site, and whether the web site link is included in the text message and transmitted I would like to propose a way to do this.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide a method and system for transmitting a text message including a specific link (e.g., a web site link) And to control whether or not to transmit a specific link in a text message by judging whether or not the specific link is detected.

Further, it is to be understood that the present invention is not limited to the above-mentioned embodiments, and other and further objects which are not mentioned can be clearly understood by those skilled in the art from the following description .

In order to accomplish the above object, according to a first aspect of the present invention, there is provided a malicious site blocking apparatus comprising: a malicious site registration unit for checking whether a specific link is included in a malicious site list information, Verification unit; A malicious link determining unit determining maliciousness of the specific link using the resource registration information for the specific link when the specific link is not included in the malicious list information; And a malicious link verifying unit for verifying whether or not the specific link is malicious using the verification link when the malicious link determining unit determines that the specific link is malicious.

Wherein the resource registration information includes at least one of a domain for the specific link, an allocation date of the domain, an owner of the domain, an allocation area location of the domain, an owner identifier of the domain, And a service type using the domain.

The malicious link verification unit may generate the at least two verification links using the domain for the specific link if the allocation date of the domain is included in a predetermined free registration use period range.

The malicious link verification unit may include a first connection screen connected to the domain by the first verification link by the first verification link and a second connection screen by the first verification link when the at least two verification links include a first verification link and a second verification link, A result obtained by comparing the second connection screen accessed by the second verification terminal with the second connection screen by the second verification link and the result of checking whether the specific link returned from the first verification terminal and the second verification terminal respectively are matched The maliciousness of the specific link is verified.

The malicious link verification unit may be configured to determine that the specific link is malicious when the first connection screen and the second connection screen are displayed identically and the specific link returned from the first verification terminal and the second verification terminal are identical, The first connection screen and the second connection screen are not displayed identically or the first connection screen and the second connection screen are displayed identically but the first verification screen and the second verification screen are displayed in the same manner, The specific link is judged to be malicious when the specific links returned from the terminal are not the same.

According to a second aspect of the present invention, an operation method of a malicious site blocking apparatus according to the second aspect of the present invention includes the steps of: determining whether a specific link is included in a text message, Identification step; Determining whether the specific link is malicious for the specific link using the resource registration information for the specific link if the specific link is not included in the malicious list information; And a verification step of verifying whether or not the specific link is malicious using the verification link if it is determined in the determining step that maliciousness of the specific link is not determined.

Wherein the resource registration information includes at least one of a domain for the specific link, an allocation date of the domain, an owner of the domain, an allocation area location of the domain, an owner identifier of the domain, And a service type using the domain.

And the verification step includes a generation step of generating the at least two verification links using the domain for the specific link if the allocation date of the domain is included in a predetermined free registration use period range.

Wherein the verification step comprises the steps of: when the at least two verification links include a first verification link and a second verification link, 2 verification link of the first verification terminal and the specific link returned from the first verification terminal and the second verification terminal are compared with each other, And verifying whether or not the specific link is malicious based on at least one of the plurality of links.

Wherein if the first linking screen and the second linking screen are displayed identically and the specific links returned from the first verifying terminal and the second verifying terminal are identical, The first connection screen and the second connection screen are not displayed identically or the first connection screen and the second connection screen are displayed identically but the first verification screen and the second verification screen are displayed in the same manner, The specific link is judged to be malicious when the specific links returned from the terminal are not the same.

According to the apparatus and method for blocking malicious sites according to the present invention, when a text message including a specific link is received in the embodiment of the present invention, before the text message is transmitted to the terminal, Determining whether the specific link is included in the text message based on the determination result, and then determining whether the specific link is a malicious link when the user selects a specific link after the conventional text message is delivered to the user It is possible to provide the malicious site blocking service more quickly to the user because the waiting time for malicious link confirmation does not occur and even if the hacking of the mobile environment is made intelligent, it is possible to fundamentally block the malicious link from being transmitted to the terminal, It is possible to dramatically increase the blocking probability.

1 is an exemplary diagram illustrating a communication environment to which a malicious site blocking apparatus according to an embodiment of the present invention is applied.
2 is a block diagram of a malicious site blocking apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating an operation flow for providing a malicious site blocking service according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

First, a communication environment to which the malicious site blocking apparatus of the present invention is applied will be described with reference to FIG.

As shown in FIG. 1, a communication environment to which the present invention is applied may include a terminal 100, a malicious site blocking apparatus 200, and an information providing apparatus 300.

The terminal 100 may be a wired terminal or a wireless terminal, which is a device that can use a basic communication service such as attempting to make a call (send) with the other party, or receive (receive) a call attempted from the other party. In the present invention, it is assumed that the terminal 100 is a mobile terminal.

Of course, in addition to the basic call service, the terminal 100 may use a message service such as sending / receiving a text message, and a data service such as data download and information search. Here, the text message may be a Short Message Service (SMS) or a Multimedia Message Service (MMS), but may include any message including character information without limitation to the term.

The malicious company P2015-0235 firewall device 200 is a server for providing an additional service to a plurality of terminals including the terminal 100. It is a server for detecting malicious sites in a mobile environment, (Hereinafter referred to as a malicious site blocking service).

That is, when the malicious site blocking apparatus 200 has to transmit a text message including a website link (hereinafter referred to as a specific link) to the terminal 100, the malicious site blocking apparatus 200 determines that the specific link is a malicious site link Link is used in combination), and the malicious site blocking service is provided by controlling whether or not to transmit the specific link in the text message.

The malicious site blocking apparatus 200 may be a server for receiving a text message and transmitting the text message by recognizing the corresponding terminal to receive the text message.

For example, the malicious site blocking apparatus 200 receives a text message such as a Short Message Service Center (SMSC), a Multi-Media Message Service Center (MMSC), and a Short Message Spam Filtering System (SMSF) And transmitting the message to the corresponding terminal, and may be configured with other text message processable devices having the same function.

The information providing apparatus 300 has a function of providing information on a communication network of the Internet, and in particular, may be a server for managing resources and information of the Internet. For example, the information providing apparatus 300 may operate as a protocol for identifying all domains used in a communication network of the Internet and searching for resources related to a domain and resources of the Internet .

Hereinafter, it will be assumed that the information providing apparatus 300 is a whois server.

That is, when the malicious site blocking apparatus 200 receives an information providing request message (e.g., a Whois command) including an IP address or a domain name, the information providing apparatus 300 transmits an information providing request message (e.g., And searches for and provides resource registration information related to the domain.

For example, when the information providing apparatus 300 receives the information providing request message from the malicious site blocking apparatus 200, the information providing apparatus 300 confirms the domain based on the information providing request message, searches the resource registration information related to the domain, To the blocking device (200).

Herein, the resource registration information includes a domain for a specific link, a domain allocation date, a domain owner, a domain allocation area location, a domain owner identifier, a domain administrator email, a domain administrator's phone number, And may include at least one.

Hereinafter, the configuration of the malicious site blocking apparatus according to the embodiment of the present invention will be described in more detail with reference to FIG.

As shown in FIG. 2, when it is determined that a specific link is included in a text message, the malicious site blocking apparatus 200 according to the present invention determines whether or not the specific link is included in malicious list information identified as malicious A malicious link determination unit 220 for determining whether the specific link is malicious for the specific link using the resource registration information for the specific link when the specific link is not included in the malicious list information, And a malicious link verification unit 230 for verifying whether or not the specific link is malicious using a verification link for verifying whether or not the specific link is malicious if the maliciousness of the specific link is not determined using the resource registration information do.

The malicious site blocking apparatus 200 may further include a malicious blocking message generating unit 240 for generating an malicious blocking message indicating that the malicious link is blocked after removing a specific link from the text message if it is determined that the specific link is a malicious link, As shown in FIG.

First, when receiving a text message to be transmitted to the terminal 100, the malicious registration confirmation unit 210 checks whether or not a specific link is included in the text message.

Here, the specific link may be a URL link (uniform resource locator link) for allowing a sender who sends a text message to the terminal 100 to easily allow a user of the terminal 100 to access a specific web site.

That is, if the specific link is not included in the text message to be transmitted to the terminal 100, the malicious registration confirmation unit 210 transmits the text message to the terminal 100. On the other hand, when the specific message is included in the text message to be transmitted to the terminal 100, the malicious registration confirmation unit 210 checks whether or not the specific link is included in the malicious list information identified as malicious.

Here, the malicious list information may be malicious link black list information that is information that is stored in a list of malicious sites that were included in the text message and were transmitted.

That is, when a specific link is included in the text message, the malicious registration confirmation unit 210 compares the specific link with the malicious list information to determine whether malicious link matching the specific link exists in the malicious list information .

If there is a malicious link matching the specific link among the malicious list information, the malicious registration confirmation unit 210 determines that the specific link is a malicious link. Thereafter, the malicious registration confirmation unit 210 transmits a text message including a specific link to the malicious block message generation unit 240 so that a malicious blocking message for notifying that the specific link is a malicious link to the terminal 100 .

On the other hand, when there is no malicious link matching the specific link among the malicious list information, the malicious registration confirmation unit 210 checks whether the specific link is a malicious link or not, To the malicious link determining unit 220.

The malicious link determining unit 220 receives the resource registration information for the specific link from the information providing apparatus 300 and determines whether or not the specific link is malicious.

More specifically, the malicious link determining unit 220 generates an information provision request message (e.g., a Whois command) for requesting resource registration information using a specific link of a text message.

That is, since malicious link determination unit 220 includes domain information in a specific link, it generates an information provision request message including domain information for requesting resource registration information, and transmits the information provision request message to information provision apparatus 300 do.

In the present invention, an information providing request message for requesting resource registration information is generated using domain information included in a specific link. However, the present invention is not limited to this, and it is possible to use an IP address identified by domain information May also generate an information provision request message for requesting resource registration information.

Then, the malicious link determining unit 220 receives the resource registration information in response to the information providing request message from the information providing apparatus 300. [

In other words, the malicious link determination unit 220 receives malicious link from the information providing apparatus 300, such as a domain for a specific link, an allocation date of the domain, a domain owner, a domain allocation area location, a domain owner identifier, And a service type using a domain name.

When the resource registration information is received, the malicious link determining unit 220 compares the resource registration information with the malicious determination condition to determine whether or not the specific link is a malicious link.

Here, the malicious decision conditions include malicious site identification conditions such as a domain assignment date related to a malicious site that can be confirmed as malicious sites that have been collected based on malicious list information, a domain owner, an administrator email of a domain, . ≪ / RTI >

That is, the malicious link determining unit 220 determines that the specific link is a malicious link when one of the resource registration information matches the malicious determination condition as a result of comparing the resource registration information and the malicious determination condition. Then, the malicious link determining unit 220 transmits a text message including the specific link to the malicious block message generating unit 240 so that a malicious blocking message for notifying the terminal 100 that the specific link is a malicious link may be generated do.

On the other hand, if none of the resource registration information matches the malicious decision condition as a result of the comparison between the resource registration information and the malicious decision condition, that is, if the maliciousness for the specific link is not determined using the resource registration information, The malicious link verification unit 220 forwards the text message including the specific link to the malicious link verification unit 230 in order to request to verify whether the specific link is a malicious link.

The malicious link verification unit 230 verifies whether or not the specific link is malicious using the verification link if maliciousness of the specific link is not determined even by using the resource registration information.

More specifically, the malicious link verifier 230 detects the allocation date of the domain included in the resource registration information for the specific link. The malicious link verifier 230 determines whether or not the allocation date of the domain is included in the free registration use period range.

Here, the free registration use period range is a period of use that can be registered and used free of charge without paying the fee for registering the internet resources and information in the information providing apparatus 300, for example, one week or two weeks Means the period of free use during the period.

That is, in the present invention, in consideration of the fact that hackers exploit this free registration use period range to generate a malicious link during the corresponding free use period and distribute the malicious link, it is determined whether the allocation date of the domain is included in the free registration use period range It is verified whether or not the specific link is a malicious link.

As a result of determining whether or not the allocation date of the domain is included in the free registration use period range as described above, if the allocation date of the domain is included in the free registration use period range, the malicious link verifier 230 checks the domain To generate at least two verification links.

Here, the verification link is generated by modifying a specific link in a form suitable for each verification terminal so that at least two verification terminals (for example, a mobile terminal, a PC, etc.) can access a specific link to verify whether the specific link is malicious .

Hereinafter, at least two verification terminals include a first verification terminal (e.g., a mobile terminal) and a second verification terminal (e.g., a PC), and at least two verification links include a first verification link and a second verification link As shown in FIG.

That is, when the specific link is linked to, for example, "oa.to/Pjazvb ", the malicious link verification unit 230 verifies whether the specific link is a mobile version link form accessible from the first verification terminal To generate a first verification link. In addition, the malicious link verifier 230 generates a second verification link by modifying a specific link to be a PC version link form accessible from a second verification terminal (e.g., a PC).

Then, the malicious link verifier 230 verifies whether or not the malicious link verification unit 230 has successfully authenticated the first connection screen and the second verification terminal (e.g., PC) connected to the domain of the specific link through the first verification link at the first verification terminal A result of checking whether or not a screen is displayed as a result of comparing a second connection screen accessed through a domain of a specific link through a second verification link and a domain of a specific link returned from the first verification terminal Based on the result of checking whether or not the domain of the specific link returned from the second verification terminal (for example, PC) is the same.

That is, the malicious link verifier 230 verifies that the first connection screen and the second connection screen when the first verification terminal (e.g., mobile terminal) accesses the domain of the specific link through the first verification link and the second connection screen, ), A second connection screen when connected to the domain of the specific link via the second verification link is displayed in the same manner, and the domain of the specific link returned from the first verification terminal (e.g., mobile terminal) For example, if the domain of a specific link returned from the PC is the same as the returned one, it is determined that the specific link is not a malicious link. Then, the malicious link verification unit 230 transmits a text message including the specific link to the terminal 100. [

On the other hand, if the first connection screen and the second connection screen are not displayed equally or the first connection screen and the second connection screen are displayed in the same manner, ) Is not the same as the domain of the specific link returned from the second verification terminal (e.g., PC), it is determined that the specific link is a malicious link. Thereafter, the malicious link verifier 230 transmits a text message including the specific link to the malicious block message generator 240 so that a malicious block message for notifying the terminal 100 of the specific link is a malicious link do.

In the present invention, when a text message including a specific link is received, maliciousness is firstly filtered using the previously registered malicious list information and the resource registration information of the specific link. In the first filtering, It is possible to dramatically increase the blocking probability of the malicious link by performing the second filtering to determine whether the allocation date of the domain is included in the free registration use period range in order to verify whether the specific link is malicious or not You can.

If it is determined that the allocation date of the domain is included in the free registration use period range as described above and the allocation date of the domain is not included in the free registration use period range, It is determined that the probability of being used by the hacker is low and the text message including the specific link is transmitted to the terminal 100. [

In the present invention, when the domain assignment date is not included in the free registration use period range, the text message including the specific link is transmitted to the terminal 100 without performing verification of maliciousness of the specific link, The present invention is not limited to this, and the malicious link may be verified based on the result of performing maliciousness for all the specific links in the same manner as described above regardless of whether the assignment date of the domain is included in the free registration use period range It is possible.

On the other hand, the malicious block message generator 240 determines that the specific link is determined to be a malicious link as a result of the malicious registration check unit 210, the malicious link determination unit 220 and the malicious link verification unit 230, When a request is made to generate a message, a malicious block message is generated by removing a specific link from a text message and adding a notification indicating that the malicious link has been blocked. Thereafter, the malicious block message generator 240 transmits a malicious block message to the terminal 100 to notify that the malicious link is blocked.

Hereinafter, an operation flow of providing a malicious site blocking service in the malicious site blocking apparatus according to an embodiment of the present invention will be described in detail with reference to FIG. Hereinafter, for convenience of description, reference will be made to the reference numerals mentioned in FIGS. 1 and 2.

3, the malicious site blocking apparatus 200 according to the embodiment of the present invention receives a text message to be transmitted from the terminal 400 to the terminal 100 (S100).

That is, the malicious site blocking apparatus 200 receives a text message to be transmitted to the terminal 100 from the terminal 400.

Thereafter, the malicious site blocking apparatus 200 confirms whether or not a specific link is included in the text message (S101).

Here, the specific link may be a URL link (uniform resource locator link) for allowing a sender who sends a text message to the terminal 100 to easily allow a user of the terminal 100 to access a specific web site.

If it is determined in step S101 that the specific link is not included in the text message, the malicious site blocking apparatus 200 transmits a text message to the terminal 100 (S102).

On the other hand, if it is determined in step S101 that a specific link is included in the text message, the malicious site blocking apparatus 200 confirms whether or not the specific link is included in malicious list information identified as malicious (S103).

Here, the malicious list information may be malicious link black list information that is information that is stored in a list of malicious sites that were included in the text message and were transmitted.

That is, when the specific message is included in the text message, the malicious site blocking apparatus 200 compares the specific link with the malicious list information to determine whether malicious link matching the specific link exists in the malicious list information.

If it is determined in step S103 that there is a malicious link matching the specific link in the malicious list information, the malicious site blocking apparatus 200 determines that the specific link is a malicious link. Thereafter, the malicious site blocking apparatus 200 generates a malicious blocking message for notifying that the specific link is a malicious link, and transmits the malicious blocking message to the terminal 100 (S104).

On the other hand, if it is determined in step S103 that there is no malicious link matching the specific link among the malicious list information, the malicious site blocking apparatus 200 receives the resource registration information for the specific link from the information providing apparatus 300 Thereby determining whether or not the specific link is a malicious link.

More specifically, the malicious site blocking apparatus 200 generates an information provision request message (e.g., a Whois command) for requesting resource registration information using a specific link of a text message.

That is, since the malicious site blocking apparatus 200 includes domain information in the specific link, the malicious site blocking apparatus 200 generates an information providing request message including domain information for requesting resource registration information, and transmits the information providing request message to the information providing apparatus 300 (S105).

In the present invention, an information providing request message for requesting resource registration information is generated using domain information included in a specific link. However, the present invention is not limited to this, and it is possible to use an IP address identified by domain information May also generate an information provision request message for requesting resource registration information.

Thereafter, the malicious site blocking apparatus 200 receives the resource registration information in response to the information providing request message from the information providing apparatus 300 (S106).

That is, the malicious site blocking apparatus 200 receives, from the information providing apparatus 300, a domain for a specific link, an allocation date of a domain, an owner of a domain, an allocated area location of a domain, an owner identifier of a domain, And a service type using a domain name.

When the resource registration information is received, the malicious site blocking apparatus 200 compares the resource registration information with the malicious determination condition to determine whether the specific link is a malicious site (S107).

Here, the malicious decision conditions include malicious site identification conditions such as a domain assignment date related to a malicious site that can be confirmed as malicious sites that have been collected based on malicious list information, a domain owner, an administrator email of a domain, . ≪ / RTI >

As a result of the comparison in step S107, if one of the resource registration information matches the malicious decision condition as a result of the comparison between the resource registration information and the malicious decision condition, the malicious site blocking apparatus 200 determines that the specific link is a malicious link . Thereafter, the malicious site blocking apparatus 200 generates a malicious blocking message for notifying that the specific link is a malicious link, and transmits the malicious blocking message to the terminal 100 (S108).

On the other hand, if it is determined in step S107 that any of the resource registration information does not coincide with the malicious determination condition as a result of the comparison between the resource registration information and the malicious determination condition, that is, whether or not the maliciousness for the specific link is determined using the resource registration information , The malicious site blocking apparatus 200 verifies whether or not the specific link is a malicious link (S109).

That is, if the malicious site blocking device 200 determines that the malicious site for the specific link is not determined using the resource registration information, the malicious site blocking device 200 determines whether the malicious site of the specific link is malicious Verify.

More specifically, the malicious site blocking apparatus 200 detects the allocation date of the domain included in the resource registration information for the specific link. The malicious site blocking apparatus 200 determines whether or not the allocation date of the domain is included in the free registration use period range.

Here, the free registration use period range is a period of use that can be registered and used free of charge without paying the fee for registering the internet resources and information in the information providing apparatus 300, for example, one week or two weeks Means the period of free use during the period.

That is, in the present invention, in consideration of the fact that hackers exploit this free registration use period range to generate a malicious site during the corresponding free use period and mainly distribute the malicious site, it is determined whether the allocation date of the domain is included in the free registration use period range It is verified whether or not the specific link is a malicious link.

As a result of determining whether or not the allocation date of the domain is included in the free registration use period range as described above, if the allocation date of the domain is included in the free registration use period range, the malicious site blocking apparatus 200 determines that the domain To generate at least two verification links.

Here, the verification link is generated by modifying a specific link in a form suitable for each verification terminal so that at least two verification terminals (for example, a mobile terminal, a PC, etc.) can access a specific link to verify whether the specific link is malicious .

Hereinafter, at least two verification terminals include a first verification terminal (e.g., a mobile terminal) and a second verification terminal (e.g., a PC), and at least two verification links include a first verification link and a second verification link As shown in FIG.

That is, when the specific link is linked to, for example, "oa.to/Pjazvb ", the malicious site blocking apparatus 200 transmits a specific link (for example, To generate a first verification link. In addition, the malicious site blocking apparatus 200 generates a second verification link by modifying a specific link to be a PC version link form accessible from a second verification terminal (e.g., PC).

Thereafter, the malicious site blocking apparatus 200 transmits the first connection screen and the second connection screen, which are connected to the domain of the specific link, through the first verification link in the first verification terminal (e.g., mobile terminal) In step S110, whether the specific link is malicious or not is verified based on whether or not a screen is displayed as a result of comparing a second connection screen accessed through a domain of a specific link through a second verification link.

As a result of the verification in step S110, if the first connection screen and the second connection screen are not displayed in the same manner, the malicious site blocking apparatus 200 determines that the specific link is a malicious link. Thereafter, the malicious site blocking apparatus 200 generates a malicious blocking message for notifying that the specific link is a malicious link, and transmits the malicious blocking message to the terminal 100 (S111).

On the other hand, if the first connection screen and the second connection screen are displayed in the same manner as the result of the verification in step S110, the malicious site blocking apparatus 200 determines whether the malicious site blocking apparatus 200 has received the first connection screen from the first verification terminal It is determined whether the domain of the specific link to be returned is the same as the domain of the specific link returned from the second verification terminal (e.g., PC) on which the second connection screen is displayed (S112).

If it is determined in step S112 that the domain of the specific link returned from the first verification terminal (e.g., mobile terminal) is the same as the domain of the specific link returned from the second verification terminal (e.g., PC), the malicious site blocking apparatus 200 ) Judges that the specific link is not a malicious link. Thereafter, the malicious site blocking apparatus 200 transmits a text message including the specific link to the terminal 100 (S113).

If it is determined in step S112 that the domain of the specific link returned from the first verification terminal (e.g., mobile terminal) and the domain of the specific link returned from the second verification terminal (e.g., PC) are not the same, 200 judges that the specific link is a malicious link. Thereafter, the malicious site blocking apparatus 200 generates a malicious blocking message for notifying that the specific link is a malicious link, and transmits the malicious blocking message to the terminal 100 (S114).

In the present invention, when a text message including a specific link is received, maliciousness is firstly filtered using the previously registered malicious list information and the resource registration information of the specific link. In the first filtering, , It is possible to drastically increase the blocking probability of the malicious site by performing the secondary filtering to determine whether the assignment date of the domain is included in the free registration use period range in order to verify whether the specific link is malicious or not You can.

In the present invention, when the domain assignment date is not included in the free registration use period range, the text message including the specific link is transmitted to the terminal 100 without performing verification of maliciousness of the specific link, The present invention is not limited to this, and the malicious link may be verified based on the result of performing maliciousness for all the specific links in the same manner as described above regardless of whether the assignment date of the domain is included in the free registration use period range It is possible.

As described above, according to the embodiment of the present invention, when a text message including a specific link is received, a specific link is transmitted as a text message based on a result of determining whether the specific link is a malicious link, The waiting time for confirming the malicious link is not generated unless the user determines whether the specific link is a malicious link after the user selects the specific link after the conventional text message is delivered to the user The malicious site blocking service can be provided more quickly to the user and even if the hacking of the mobile environment is intelligent, it is possible to fundamentally block the malicious link from being transmitted to the terminal, thereby greatly increasing the blocking probability of the malicious site.

Embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

According to the apparatus and method for blocking malicious sites of the present invention, before transmitting a text message including a specific link (e.g., a web site link) to the mobile terminal, it is determined whether or not the specific link is a malicious link, , It is possible to control whether or not to transmit a text message to a text message. Thus, it is possible to overcome the limitations of the prior art, This is an invention that is industrially applicable because it can be done.

100: terminal
200: Malicious site blocking device
210: malicious registration confirmation unit 220: malicious link determination unit
230: malicious link verification unit 240: malicious block message generation unit
300: information providing device

Claims (10)

A malicious registration confirmation unit for verifying whether or not the specific link is included in the malicious list information when it is determined that the specific link is included in the text message;
A malicious link determining unit determining maliciousness of the specific link using the resource registration information for the specific link when the specific link is not included in the malicious list information; And
A malicious link verification unit for verifying whether the specific link is malicious using a verification link when the malicious link determination unit determines that the specific link is malicious,
The malicious site blocking device comprising: The method according to claim 1,
The resource registration information includes:
A domain name of the domain, an allocation date of the domain, an owner of the domain, an allocation area location of the domain, an owner identifier of the domain, an administrator email of the domain, a manager phone number of the domain, The malicious site blocking device comprising: 3. The method of claim 2,
The malicious link verifier may include:
Wherein the at least two verification links are generated using the domain for the specific link when the allocation date of the domain is included in a predetermined free registration use period range. The method of claim 3,
The malicious link verifier may include:
Wherein if the at least two verification links include a first verification link and a second verification link, then the first verification link connects to the domain at the first verification terminal and the second verification link Based on at least one of a result of comparing the second connection screen accessed by the second verification terminal with the domain and a result of checking whether the specific link returned from the first verification terminal and the second verification terminal respectively are matched The malicious site blocking device verifying whether or not the specific link is malicious. 5. The method of claim 4,
The malicious link verifier may include:
The first connection screen and the second connection screen are displayed in the same manner and when the specific links returned from the first verification terminal and the second verification terminal are the same,
The first connection screen and the second connection screen are not displayed identically or the first connection screen and the second connection screen are displayed identically but are returned from the first verification terminal and the second verification terminal respectively And judges that the specific link is malicious when the specific link is not the same. A confirmation step of confirming whether the specific link is included in the malicious list information if it is determined that the specific link is included in the text message;
Determining whether the specific link is malicious for the specific link using the resource registration information for the specific link if the specific link is not included in the malicious list information; And
A verification step of verifying whether or not the specific link is malicious using the verification link if the maliciousness of the specific link is not determined in the determining step
The malicious site blocking apparatus comprising: The method according to claim 6,
The resource registration information includes:
A domain name of the domain, an allocation date of the domain, an owner of the domain, an allocation area location of the domain, an owner identifier of the domain, an administrator email of the domain, a manager phone number of the domain, The malicious site blocking device comprising: 8. The method of claim 7,
Wherein the verifying step comprises:
And generating the at least two verification links using the domain for the specific link if the allocation date of the domain is included in a predetermined free registration use period range. Way. 9. The method of claim 8,
Wherein the verifying step comprises:
Wherein if the at least two verification links include a first verification link and a second verification link, then the first verification link connects to the domain at a first verification terminal and the second verification link Based on at least one of a result of comparing the second connection screen accessed by the second verification terminal with the domain and a result of checking whether the specific link returned from the first verification terminal and the second verification terminal respectively are matched And comparing and verifying whether or not the specific link is malicious. 10. The method of claim 9,
Wherein the comparing and verifying step comprises:
The first connection screen and the second connection screen are displayed in the same manner and when the specific links returned from the first verification terminal and the second verification terminal are the same,
The first connection screen and the second connection screen are not displayed identically or the first connection screen and the second connection screen are displayed identically but are returned from the first verification terminal and the second verification terminal respectively If the specific link is not the same, judges that the specific link is malicious.

Images