KR20180105335A - SYSTEM AND METHOD FOR DETECTING COUNTERFEIT and FALSIFICATION USING LINK DATA - Google Patents

Abstract

The present invention relates to a website forgery detection system using link data and a method thereof, a recording medium storing a program for implementing the same, and a computer program stored in the medium for implementing the same. The website forgery detection system using link data according to the present invention compares and analyzes link data information of a web page accessed by a user and link data information of a normal web site which is not forged to detect whether the web site is forged. The website forgery detection system using link data comprises: a database; an access detection means; a link data collection means; and a comparison analysis means.

Description

TECHNICAL FIELD [0001] The present invention relates to a system and method for detecting forgery of a web site using link data,

The present invention relates to a web site forgery detection system and method using link data, and more particularly to a web site forgery detection system and method using link data, The present invention relates to a web site forgery detection system and method using link data for detecting whether a user forged or forged a web site.

After the age of visiting the bank and looking at work, it became easy to see the banking service at home, and the number of Internet banking service and mobile banking registered customers increased sharply at the end of September 2016 due to the convenience of online financial services. . The number of internet banking and mobile banking use (daily average) is 87.9 million, which means that a considerable number of users are using it.

The increase in the number of Internet banking users has also been exposed to the threat from hackers.

Web site forgery attack methods include Cross Site Scripting (XSS) attacks, Cross Site Request Forgery (CSRF) attacks, phishing and pharming attacks, hosts file tampering attacks, DBD (Drive By Download) attacks, MITM Man In The Middle attack.

Among them, phishing and pharming attack is a pharming attack using a phishing site similar to an actual banking site, thereby inducing the user to input personal information capable of financial transactions, to be.

A phishing attack is a combination of private data and fishing. It is an attack to send e-mails as public institutions and financial institutions and steal financial information by inducing access to fake bank sites.

A pharming attack is an attack to steal financial information by manipulating an infected user's PC through malicious code. Even if a victim tries to access a normal site, access to a phishing site is triggered, .

Since this method is similar to the actual site, it is difficult for the user to directly judge whether or not the site is altered.

In Korea, we are establishing and operating a divisional security control center in charge of cyber security, centering on the National Cyber Safety Center (NCSC) and the Internet Infringement Response Support Center (KrCERT / CC) As the number of target organizations of the security control center increases and a large number of phishing sites are continuously generated, there is a limit in detecting and responding in real time to the up /

Korean Patent Registration No. 10-1264280 discloses a web page modulation detection system and method.

Korea registered patent [10-1264280] (Registration date: May 08, 2013)

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above-mentioned problems occurring in the prior art, and it is an object of the present invention to provide a method and apparatus for comparing and analyzing link data information of a web page accessed by a user and link data information of a normal web site, The present invention provides a web site forgery detection system and method using link data for detecting whether a user forged or forged a web site.

The objects of the embodiments of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description .

According to an embodiment of the present invention, there is provided a web site forgery detection system using link data, comprising: a database (100) for storing addresses of a specific web site and link data of the corresponding web site; A connection detecting means (200) for detecting whether or not a user terminal has accessed a predetermined specific web site; Link data collection means (300) for collecting link data of the specific web site when it is detected by the connection detection means (200) that the specific web site is accessed; And comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100, And comparing and analyzing means 400 for determining whether the web site is forged or falsified.

In addition, the link data collection means 300 collects various link data linked in a web page by using a Java library jsoup for HTML work.

The comparison and analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 using the Levenshtein Distance algorithm.

In addition, the website forgery detection system using the link data may be configured such that if the comparison analysis result is 100% identical to the comparison analysis result, the link data of the corresponding web page collected by the link data collection means 300 The link data collecting means 300 collects link data of the sub web page moved by the sub web page moving means 500, And the comparative analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 to determine whether the specific web site has been tampered with .

The method for detecting website forgery using link data according to an embodiment of the present invention includes: a database 100 for storing addresses of a specific website and link data of the corresponding website; A connection detecting means (200) for detecting whether or not a user terminal has accessed a predetermined specific web site; Link data collection means (300) for collecting link data of the specific web site when it is detected by the connection detection means (200) that the specific web site is accessed; And comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100, A web site forgery detection method using link data using a web site forgery detection system using link data, comprising: comparing and analyzing means (400) for determining whether a web site has been falsified; , A web site access step (S10) for detecting whether a user terminal is connected to a predetermined web site set in advance; If it is detected in the connection step S10 of the web site that a predetermined web site has been accessed, the comparison and analysis unit 400 compares the address of the specific web site with the address of the user terminal, Comparison step S20; A link data collection step of collecting link data of the specific web site by the link data collection means 300 if the address accessed by the user terminal and the address of the specific web site are the same in the address comparison step S20 S30); And the comparative analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 to determine whether the specific website is forged or not And a link data comparison step (S40).

In addition, the link data collection step S30 collects various link data linked in a web page by using a Java library jsoup for HTML work.

The link data comparison step S40 is characterized by comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100 using the Levenshtein Distance algorithm .

If the comparative analysis result of the comparative analysis means 400 is 100%, the sub web page is moved to the sub web page linked with the link data of the corresponding web page collected by the link data collection means 300 The web site forgery detection method using link data using the web site forgery detection system using the link data further including the moving means 500 is characterized in that when the comparison analysis result by the comparison and analysis means 400 is 100% A subpage moving step (S50) of moving to a subweb page connected to the link data of the corresponding webpage collected in the webpage by the subpage web page moving means (500); A sub link data collection step (S60) of collecting link data of a sub web page by the link data collection means (300); And the comparative analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 to determine whether the specific website is forged or not And sub-link data comparison step (S60).

According to an embodiment of the present invention, there is provided a computer-readable recording medium on which a program for implementing a method for detecting a website forgery-and-fix using the link data is stored.

According to an embodiment of the present invention, a program stored in a computer-readable recording medium is provided to implement a method for detecting a website forgery-and-alteration using the link data.

According to the web site forgery detection system and method using link data according to an embodiment of the present invention, a recording medium storing a program for implementing the same, and a computer program stored in a medium for implementing the same, In this situation, it is possible to detect fast and accurate forgery and falsification by simple comparison of link data.

Also, by collecting various link data linked to a web page by using the Java library jsoup, it is possible to collect link data in a web page more quickly and accurately.

Also, by comparing and analyzing the link data using the Levenshtein Distance algorithm, there is an effect that fake detection can be performed more quickly and accurately.

Further, comparison of the link data corresponding to the sub-web page is additionally performed, so that there is an effect that more accurate falsification detection can be performed.

1 is a conceptual diagram of a web site forgery detection system using link data according to an embodiment of the present invention.
2 is an exemplary diagram showing part of the collected link data;
3 is a conceptual diagram of a web site forgery detection system using link data according to another embodiment of the present invention.
4 is a flowchart of a method for detecting a website forgery using link data according to an embodiment of the present invention.
5 is a flowchart of a method for detecting a website forgery using link data according to another embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, .

On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the term "comprises" or "having ", etc. is intended to specify the presence of stated features, integers, steps, operations, elements, parts, or combinations thereof, And does not preclude the presence or addition of one or more other features, integers, integers, steps, operations, elements, components, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be construed as ideal or overly formal in meaning unless explicitly defined in the present application Do not.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concept of the term appropriately in order to describe its own invention in the best way. The present invention should be construed in accordance with the meaning and concept consistent with the technical idea of the present invention. Further, it is to be understood that, unless otherwise defined, technical terms and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Descriptions of known functions and configurations that may be unnecessarily blurred are omitted. The following drawings are provided by way of example so that those skilled in the art can fully understand the spirit of the present invention. Therefore, the present invention is not limited to the following drawings, but may be embodied in other forms. In addition, like reference numerals designate like elements throughout the specification. It is to be noted that the same elements among the drawings are denoted by the same reference numerals whenever possible.

FIG. 1 is a conceptual diagram of a web site forgery detection system using link data according to an embodiment of the present invention, FIG. 2 is a view illustrating a part of collected link data, FIG. FIG. 4 is a flowchart illustrating a method for detecting a website forgery detection using link data according to an embodiment of the present invention. FIG. 5 is a flowchart illustrating a method of detecting a web site forgery detection using link data according to another embodiment of the present invention. FIG. 2 is a flowchart of a method for detecting a forgery of a web site using the method of FIG.

Prior to explanation, the terms used in this specification will be briefly described.

A 'website' is a meaningful bundle of web pages viewed through a generic URL consisting solely of a domain name, an IP address, and a root path in an internet protocol based network. The homepage, which is commonly referred to in Korea, refers to the website strictly speaking.

A collection of Web pages that store information on a Web server so that users can provide it whenever they need it. In other words, it refers to a collection of information (web pages) held by a web server in the sense of a warehouse that stores information and provides information to a person who needs information at any time. There can be more than one web site that provides different information to one web server.

In other words, a 'website' is a gateway to the Internet, sometimes referred to simply as a site, often referred to as the home page address.

A web site forgery detection system and method using link data according to an embodiment of the present invention, a recording medium on which a program for implementing the same is stored, and a computer program stored in a medium for implementing the same, And the link data information of a normal web site which is not forged and falsified, thereby detecting the forgery or falsification of the web site and preventing erroneous access through the unreliable web page in advance, thereby preventing financial information leakage accidents .

1, a web site forgery detection system using link data according to an exemplary embodiment of the present invention includes a database 100, a connection detecting unit 200, a link data collecting unit 300, 400).

The database 100 stores addresses of specific websites and link data of the corresponding websites.

Here, the specific website may be a website of a specific financial website (such as Internet banking, KB bank internet banking, Woori bank Internet banking, first bank Internet banking website such as Shinhan bank Internet banking), Financial Supervisory Service .

The database 100 stores a normal address (URL) of a specific web site. This is to enable the user to determine whether to perform a comparative analysis of the link data based on the comparison result, by comparing the URL of the specific web site accessed by the user with the normal URL of the specific web site.

In addition, the database 100 stores normal link data of a specific web site. This is to compare the normal link data of a specific web site with the link data of a specific web site accessed by the user in the future, and to judge a forgery or falsification of the web site based on the comparison result.

Here, the normal address and the normal link data refer to the address and link data without forgery and falsification.

Also, the database 100 may store the forgery information when it is determined by the comparison and analysis means 400 that the website is a forgery-altered web site.

The connection detecting means 200 detects whether or not the user terminal has accessed a predetermined web site set in advance.

Here, the user terminal collectively refers to all the devices available on a web site such as a computer, a mobile device, and a smart device.

The connection detecting means 200 monitors whether a user accesses a specific web site which needs to check whether a web site is forged or falsified by using a user terminal.

This is to confirm whether forgery or falsification of only a specific web site which needs to check whether forgery or falsification has been taken in consideration of the speed of web surfing because checking whether or not all web sites are falsified is slowing down the web surfing speed.

The link data collection means 300 collects link data of the specific web site when it is detected by the connection detection means 200 that the specific web site is accessed.

A web site means a bundle of web pages, meaning collecting link data of a specific web site means collecting link data of the currently connected web page.

Here, the link data represents movement information of a web page connected to the currently connected web page, and it means information such as a URL (Uniform Resource Locator) (see Fig. 2).

At this time, the link data collection means 300 may collect various link data linked to a web page by using a Java library jsoup for HTML work.

jsoup is a useful library for parsing web pages and fetching only the desired values.

The comparison and analysis means 400 compares the address of the user terminal with the address of the specific web site and analyzes the link data collected by the link data collection means 300 and the link data stored in the database 100 And determines whether the specific web site is forged or falsified.

That is, when the comparison and analysis means 400 firstly compares the address of the web site and it is determined that there is no forgery or falsification, the comparison and analysis means 400 secondarily compares the link data to judge whether or not forgery is possible.

Here, when the comparison result by the comparison and analysis means 400 is 100% identical, it can be judged that there is no forgery or falsification.

The comparison and analysis means 400 may compare and analyze the link data collected by the link data collection means 300 and the link data stored in the database 100 using the Levenshtein Distance algorithm. have.

In addition, the comparison and analysis means 400 may compare and analyze an address accessed by the user terminal and a specific web site address using the Levenshtein Distance algorithm.

The Levenshtein Distance algorithm is derived from the name of the Russian scientist Vladimir Levenshtein. It is also called the edit distance algorithm. It is an algorithm designed to measure the similarity of two strings. It is used for spell checking, speech recognition, and plagiarism. Compares two strings using a two-dimensional array and proceeds with insertion, deletion, and modification for each part of the string to obtain the minimum editing distance value. The cumulative value of the minimum edit distance obtained for each part becomes the final edit distance value of the two strings, and is used as a measure of judgment to obtain a similar degree through the value.

A L L I G A T O R 0 One 2 3 4 5 6 7 8 9 E One One 2 3 4 5 6 7 8 9 L 2 2 One 2 3 4 5 6 7 8 E 3 3 2 2 3 4 5 6 7 8 V 4 4 3 3 3 4 5 6 7 8 A 5 4 4 4 4 4 4 5 6 7 T 6 5 5 5 5 5 5 4 5 6 O 7 6 6 6 6 6 6 5 4 5 R 8 7 7 7 7 7 7 6 5 4

Table 1 shows the operation of the Levenshtein Distance algorithm that compares the ALLIGATOR with the ELEVATOR to obtain the edit distance. In the case of the same value, it takes the value above the left diagonal. If it is different from the value above, . When the algorithm is finished, the value at the bottom right is the editing distance of the two strings.

Using the Levenshtein Distance algorithm, the result of comparing the current page URL address with the existing URL address,

If the two strings to be compared differ by one part, the result of 0.0 is output,

If the two strings to be compared are 100% identical, the result is 1.0.

3, in the web site forgery detection system using link data according to an embodiment of the present invention, when the comparative analysis result is equal to 100% by the comparative analysis means 400, the link data collection means And a sub-page moving unit 500 for moving to a sub-web page connected to the link data of the corresponding web page,

The link data collection means 300 collects link data of the sub web page moved by the sub page moving means 500,

The comparison and analysis means 400 compares and analyzes the link data collected by the link data collection means 300 and the link data stored in the database 100 to determine whether the specific website is forged or not can do.

Web site forgery and falsification attacks are increasing and increasing. In order to cope with such forgery and fake attacks, more accurate detection of forgery and falsification is required,

For this purpose, the present invention is not limited to comparing the link data of the connected web page with the link data of the web page stored in the database 100,

The link data of the sub web page connected to the link data of the corresponding web page can be compared to detect the forgery and falsification more accurately.

As shown in FIG. 4, a method for detecting a website forgery using link data according to an embodiment of the present invention includes: a database 100 for storing addresses of a specific website and link data of the corresponding website; A connection detecting means (200) for detecting whether or not a user terminal has accessed a predetermined specific web site; Link data collection means (300) for collecting link data of the specific web site when it is detected by the connection detection means (200) that the specific web site is accessed; And comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100, A web site forgery detection method using link data using a web site forgery detection system using link data, the method comprising: comparing and analyzing means (400) for determining whether a web site has been falsified;

A website access step S10, an address comparison step S20, a link data collection step S30, and a link data comparison step S40.

In the web site connection step S10, the connection detecting means 200 detects whether the user terminal has accessed a predetermined web site set in advance.

This is to confirm whether forgery or falsification of only a specific web site which needs to check whether forgery or falsification has been taken in consideration of the speed of web surfing because checking whether or not all web sites are falsified is slowing down the web surfing speed.

The address comparing step S20 compares the address accessed by the user terminal with the address of the specific web site by the comparison and analysis unit 400 when it is detected that the web site is connected to a predetermined web site, Compare the addresses.

That is, in the address comparing step S20, the address (URL) of the specific web site accessed by the user is crawled and compared with the normal address (URL) of the specific web site to compare the two addresses.

That is, the address of the current web page accessed by the user is collected and compared with the address of the web page stored in the database 100.

If the two addresses are not identical in the address comparison step (S20), it is determined that the web site is a forged web site, and the user terminal can be informed that the web site is a forged web site.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, the forgery information can be stored in the database 100.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, it is also possible to terminate or block the connection of the web site.

At this time, the address comparing step S20 may compare the address accessed by the user terminal using the Levenshtein Distance algorithm and the address of the specific web site stored in the database 100. [

The Levenshtein Distance algorithm has been described above and will be omitted.

In the link data collection step S30, if the address of the specific web site is the same as the address of the user terminal in the address comparison step S20, the link data collection means 300 acquires link data Lt; / RTI >

A web site means a bundle of web pages, meaning collecting link data of a specific web site means collecting link data of the currently connected web page.

Here, the link data represents movement information of a web page connected to the currently connected web page, and it means information such as a URL (Uniform Resource Locator) (see Fig. 2).

In this case, the link data collection step (S30) may collect various link data linked in a web page using jsoup, which is a Java library for HTML work.

JSoup was used to collect various kinds of link data linked to web pages.

In the link data comparison step S40, the comparison and analysis means 400 compares and analyzes the link data collected by the link data collection means 300 and the link data stored in the database 100, It is judged whether the site is forged or falsified.

That is, in the link data comparison step S40, the link data collected by the link data collection means 300 and the link data stored in the database 100 are compared and analyzed, and the link data collected by the link data collection means 300 Data and the link data stored in the database 100 are the same data.

That is, it compares the link data of the current web page accessed by the user with the link data stored in the database 100 that have been collected.

If the link data of the current web page accessed by the user in the link data comparison step (S40) is not the same as the link data stored in the database 100, it is determined that the web site is a forged web site. It can notify the terminal.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, the forgery information can be stored in the database 100.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, it is also possible to terminate or block the connection of the web site.

The link data comparison step S40 is characterized by comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100 using the Levenshtein Distance algorithm .

The Levenshtein Distance algorithm has been described above and will be omitted.

The link data comparison step (S40) compares the link data collected in the link data collection step with normal web page link data to determine normal and abnormal. In case of abnormality, the detection system is terminated, and if it is normal, the user can move to a subpage, which is previously collected link data, and proceed with detection.

As shown in FIG. 5, the method for detecting website forgery using link data according to an embodiment of the present invention is characterized in that when the comparison and analysis result is 100% 300), and a sub-page moving means (500) for moving to a sub-web page linked to link data of the corresponding web page collected by the web site forcible detection system In the detection method,

After the link data comparison step S40, it may include a sub page shift step S50, a sub link data collection step S60 and a sub link data comparison step S70.

In the subpage moving step S50, when the comparison analysis result by the comparison and analysis means 400 is equal to 100%, the subpage moving means 500 reads the link data of the corresponding webpage collected from the corresponding webpage To a sub-web page connected to the sub-web page.

The sub-link data collection step (S60) collects the link data of the sub-web page by the link data collection means (300).

The sub-link data comparison step S70 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 by the comparison and analysis means 400, It is judged whether the website is forged or falsified.

That is, the sub-link data comparison step S70 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 and compares the link data collected by the link data collection means 300 The link data and the link data stored in the database 100 are the same data.

That is, it compares the link data of the current web page accessed by the user (the sub web page moved by the sub page shifting means 500) with the link data already collected and stored in the database 100.

In the sub link data comparison step S70, the link data of the current web page accessed by the user (the sub web page moved by the sub page shifting means 500) and the link data previously collected and stored in the database 100 are the same Otherwise, it is determined that the web site is a forged web site, and the user terminal can be informed that the web site is a forged web site.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, the forgery information can be stored in the database 100.

In addition, if it is determined by the comparison and analysis means 400 that the web site is forged, it is also possible to terminate or block the connection of the web site.

If the result value obtained from the sub-link data comparison step S70 is a normal result corresponding to a website without forgery and falsification,

The subpage data comparison step S60 may be repeatedly performed in the subpage moving step S50 (see FIG. 5). [

This is because it is possible to repeatedly perform the process until there is no further sub-web page in order to perform more precise detection of falsification and tampering, but there is a risk of endless loop, so that it is possible to repeat the process with a fixed number of times.

Although the web site forgery detection method using link data according to an embodiment of the present invention has been described above, it is possible to use a computer readable recording medium storing a program for implementing a web site forgery detection method using link data, It goes without saying that a program stored in a computer-readable recording medium for implementing the website forgery detection method can also be implemented.

That is, the above-described method for detecting a website forgery-alteration using link data can be easily understood by those skilled in the art that a program of instructions for implementing the program can be tangibly embodied in a recording medium readable by a computer will be. In other words, it can be implemented in the form of a program command that can be executed through various computer means, and can be recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and configured for the present invention or may be those known and available to those skilled in the computer software. Examples of the computer-readable medium include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs and DVDs, and optical disks such as floppy disks. Magneto-optical media and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, USB memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

100: Database 200: Connection Detection Means
300: link data collection means 400: comparative analysis means
500: Subpage moving means
S10: Web site access step S20: Address comparison step
S30: Link data collection step S40: Link data comparison step
S50: Sub page shift step S60: Sub link data collection step
S70: Sublink data comparison step

Claims (10)

A database 100 for storing addresses of specific websites and link data of the corresponding websites;
A connection detecting means (200) for detecting whether or not a user terminal has accessed a predetermined specific web site;
Link data collection means (300) for collecting link data of the specific web site when it is detected by the connection detection means (200) that the specific web site is accessed; And
Analyzes the link data collected by the link data collecting means 300 and the link data stored in the database 100 to compare the link data collected by the link data collecting means 300 with the specific web A comparison and analysis means 400 for determining whether the site is forged or falsified;
A web site forgery detection system using link data including.
The method according to claim 1,
The link data collection means (300)
A web site forgery detection system using link data, characterized by collecting various link data linked to a web page by using a Java library jsoup for HTML operation.
The method according to claim 1,
The comparison and analysis means (400)
Wherein the link data collected by the link data collection means (300) and the link data stored in the database (100) are compared and analyzed using the Levenshtein Distance algorithm.
The method according to claim 1,
The web site forgery detection system using the link data
A sub web page moving means for moving to a sub web page linked with link data of the corresponding web page collected by the link data collecting means 300 when the comparison and analysis result is 100% (500)
/ RTI >
The link data collection means (300)
Collects link data of the sub web page moved by the sub web page moving means 500,
The comparison and analysis means (400)
Wherein the web site forgery and corruption is determined by comparing and analyzing the link data collected by the link data collection means (300) and the link data stored in the database (100) Detection system.
A database 100 for storing addresses of specific websites and link data of the corresponding websites; A connection detecting means (200) for detecting whether or not a user terminal has accessed a predetermined specific web site; Link data collection means (300) for collecting link data of the specific web site when it is detected by the connection detection means (200) that the specific web site is accessed; And comparing and analyzing the link data collected by the link data collection means 300 and the link data stored in the database 100, A web site forgery detection method using link data using a web site forgery detection system using link data, the method comprising: comparing and analyzing means (400) for determining whether a web site has been falsified;
A web site access step (S10) for detecting whether the user terminal has accessed a predetermined web site set by the connection detecting means (200);
If it is detected in the connection step S10 of the web site that a predetermined web site has been accessed, the comparison and analysis unit 400 compares the address of the specific web site with the address of the user terminal, Comparison step S20;
A link data collection step of collecting link data of the specific web site by the link data collection means 300 if the address accessed by the user terminal and the address of the specific web site are the same in the address comparison step S20 S30); And
The comparison and analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 to determine whether the specific website is forged or not A data comparison step (S40);
A method for detecting forgery of a web site using link data including a link data.
6. The method of claim 5,
The link data collection step (S30)
A method for detecting forgery of a website using link data, characterized by collecting various link data linked to a web page by using a Java library jsoup for HTML operation.
6. The method of claim 5,
The link data comparison step (S40)
Wherein the link data collected by the link data collection means (300) and the link data stored in the database (100) are compared and analyzed using the Levenshtein Distance algorithm.
6. The method of claim 5,
A sub web page moving means for moving to a sub web page linked with link data of the corresponding web page collected by the link data collecting means 300 when the comparison and analysis result is 100% A method for detecting forgery of a web site using link data using a web site forgery detection system using link data,
When the result of the comparative analysis by the comparative analysis means 400 is 100%, the sub web page moving means 500 transmits a sub web page, which is linked to the link data of the corresponding web page, Moving subpage moving step S50;
A sub link data collection step (S60) of collecting link data of a sub web page by the link data collection means (300); And
The comparison and analysis means 400 compares the link data collected by the link data collection means 300 with the link data stored in the database 100 to determine whether the specific website is forged or not Link data comparison step (S60);
A method for detecting forgery of a web site using link data including a link data.
A computer-readable recording medium storing a program for implementing a method for detecting a website forgery-alteration using link data according to any one of claims 5 to 8.
A program stored in a computer-readable recording medium for implementing a method for detecting a website forgery-alteration using link data according to any one of claims 5 to 8.

Images