KR20200087467A - System and method for detecting malicious links using block chain and computer program for the same - Google Patents

Abstract

A malicious link detection system includes: a transmission/reception unit receiving link information to be subject to malicious link detection from a user device and providing the user device with a malicious link detection result on the link information; a hash extraction unit generating a hash value corresponding to the link information; a diagnosis unit generating the malicious link detection result on the link information; a transmission unit uploading the hash value and the malicious link detection result to a blockchain network in a case where the hash value is not recorded in a distributed ledger of the blockchain network; and a reward providing unit providing a virtual currency managed by the distributed ledger of the blockchain network for a user corresponding to the link information-providing user device in a case where the malicious link detection result is uploaded to the blockchain network. In the system, the malicious link detection result and the malicious link hash value are recorded in the form of a transaction on the blockchain network. Accordingly, a result previously detected as a malicious link cannot be tampered with unless half or more of the nodes of the blockchain network are hacked. In addition, a user generating a detection result with respect to a new malicious link is rewarded with a blockchain-based virtual currency, and thus users can be encouraged to actively participate in malicious link detection.

Description

Malicious link detection system and method using blockchain, and computer program for this {SYSTEM AND METHOD FOR DETECTING MALICIOUS LINKS USING BLOCK CHAIN AND COMPUTER PROGRAM FOR THE SAME}

Embodiments are directed to a malicious link detection system and method and a computer program therefor, and more specifically, to upload a malicious link detection result to a distributed ledger of the blockchain and to block the user based on the blockchain. It is about a new detection technology that compensates for the cryptocurrency of.

With the development of short-range wireless technology and wireless equipment, the speed and availability of wireless networks are improving, and as the price of equipment is getting smaller and the size is getting smaller, the range of wireless networks is rapidly expanding from home to business. . Due to the recent spread of smartphones, communication trends from existing wired networks to wireless networks are rapidly increasing while providing APs (Access Points) through Wi-Fi using routers in various places such as homes, public places, and companies. Is changing.

However, with this change in the network environment, the distribution of malicious links for the purpose of seizing the user's goods is increased by unauthorized collection of user's personal information or by having the user input personal information related to their own finance, etc. Doing. The malicious link is often distributed through a group chat by a malicious user, or is frequently exposed through a fake page designed to have an address and form similar to a favorite page of the user, thereby inducing the user to click.

In the conventional malicious link detection method, a crawling method is often used to collect malicious links existing on a homepage. In the case of using the crawling method, if a suspected pattern exists as a malicious link in the main page content of the homepage, in-depth collection can be performed on the homepage. In addition, the collection results are recorded on a server of a provider providing a malicious link diagnosis service.

However, in the conventional detection method, if a malicious user complicates the link when distributing the malicious code, it is difficult to detect it as a malicious link. In addition, since detection is performed depending on information provided by a specific diagnostic service provider, even if it is detected as a malicious link once, the contents of the linked page are changed and the results are reversed through re-diagnosis and then the contents are returned to the malicious page. There is a problem in that there is a possibility that a user's damage may occur due to a malicious link or a malicious link that the diagnostic provider has not yet collected information.

Registered Patent Publication No. 10-1547999

According to an aspect of the present invention, the malicious link detection result is uploaded to the distributed ledger of the blockchain, and the malicious link is detected based on the contents of the distributed ledger, and the blockchain-based virtual is generated to the user who generated the new detection result. A new malicious link detection system and method for compensating money and a computer program for the same can be provided.

The malicious link detection system according to an embodiment includes: a transmission/reception unit configured to receive link information to detect whether a malicious link is present from a user device, and to provide the user device with a malicious link detection result for the link information; A hash extractor configured to generate a hash value corresponding to the link information; A diagnostic unit configured to generate the malicious link detection result for the link information; A transmission unit configured to upload the hash value and the result of the malicious link detection to the blockchain network when the hash value is not recorded in the distributed ledger of the blockchain network; And a reward providing unit providing a virtual currency managed by a distributed ledger of the blockchain network to a user corresponding to the user device that provided the link information when the malicious link detection result is uploaded to the blockchain network. do.

In one embodiment, the diagnosis unit is further configured to generate the malicious link detection result by searching the distributed ledger of the blockchain network for the hash value corresponding to the link information.

In one embodiment, the diagnostic unit is further configured to generate the malicious link detection result by searching for one or more external servers using the link information.

In one embodiment, the transmission unit is further configured to record transaction information including the link information and the malicious link detection result in a data block on the blockchain network.

In one embodiment, the transmission unit is configured to further include user information corresponding to the user device transmitting the link information in the transaction information.

A malicious link detection method according to an embodiment includes the steps of: a malicious link detection system receiving link information to detect whether a malicious link is present from a user device; Generating, by the malicious link detection system, a hash value corresponding to the link information; Generating, by the malicious link detection system, a malicious link detection result for the link information; Transmitting, by the malicious link detection system, the malicious link detection result to the user device; If the malicious link detection system does not record the hash value in the distributed ledger of the blockchain network, uploading the hash value and the malicious link detection result to the blockchain network; And when the malicious link detection system uploads the malicious link detection result to the blockchain network, a virtual currency managed by a distributed ledger of the blockchain network to a user corresponding to the user device that provided the link information. It includes the steps of providing.

In one embodiment, the step of generating the malicious link detection result includes the step of generating the malicious link detection result by searching the distributed ledger of the blockchain network for the hash value corresponding to the link information.

In one embodiment, generating the malicious link detection result includes generating the malicious link detection result by searching for one or more external servers using the link information.

In one embodiment, the step of uploading to the blockchain network includes recording transaction information including the link information and the malicious link detection result in a data block on the blockchain network.

In one embodiment, the transaction information further includes user information corresponding to the user device transmitting the link information.

The computer program according to an embodiment is for executing a malicious link detection method according to the above-described embodiments in combination with hardware, and may be stored in a computer-readable recording medium.

According to the malicious link detection system and method according to an aspect of the present invention, since the hash value of the malicious link and the detection result of the malicious link are recorded in the form of a transaction on a blockchain network, the blockchain network Unless hacking more than half of the nodes, it is impossible to arbitrarily manipulate the results detected by malicious links.

In addition, according to the malicious link detection system and method according to an aspect of the present invention, by compensating for a blockchain-based virtual currency to a user who has generated a detection result for a new malicious link, users can actively participate in malicious link detection. Can be induced.

Due to the above features, according to the malicious link detection system and method according to an aspect of the present invention, there is an advantage of avoiding the risk that occurs in the prior art in which malicious link detection is performed depending only on a specific diagnostic service.

1 is a schematic block diagram of a malicious link detection system according to an embodiment.
2 is a flowchart of a malicious link detection method according to an embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

1 is a schematic block diagram of a malicious link detection system according to an embodiment. Referring to FIG. 1, the malicious link detection system 3 according to the present embodiment is configured to operate while communicating with user devices 1 and 2 of one or more users who want to diagnose whether a specific link is a malicious link. do. In addition, the malicious link detection system 3 operates by communicating with the blockchain network 4 maintained using a plurality of nodes 41-46. Furthermore, the malicious link detection system 3 may operate while communicating with one or more external servers 6 that provide diagnostic services for malicious links.

The above communication process is performed through a wired and/or wireless network. The communication method through the wired and/or wireless network may include an object and all communication methods through which the object can be networked, and is not limited to wired communication, wireless communication, 3G, 4G, or other methods. For example, wired and/or wireless networks include Local Area Network (LAN), Metropolitan Area Network (MAN), Global System for Mobile Network (GSM), Enhanced Data GSM Environment (EDGE), and High Speed Downlink Packet Access (HSDPA). , Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth, Zigbee, Wi-Fi, VoIP (Voice) over Internet Protocol), LTE Advanced, IEEE802.16m, WirelessMAN-Advanced, HSPA+, 3GPP Long Term Evolution (LTE), Mobile WiMAX (IEEE 802.16e), UMB (formerly EV-DO Rev. C), Flash-OFDM, iBurst and MBWA (IEEE 802.20) systems, HIPERMAN, Beam-Division Multiple Access (BDMA), Wi-MAX (World Interoperability for Microwave Access), and refers to a communication network by one or more communication methods selected from the group consisting of ultrasonic communication. However, it is not limited thereto.

Systems, user devices and servers according to embodiments may have aspects that are entirely hardware, or partially hardware and partially software. For example, the user devices 1 and 2, the malicious link detection system 3 and the external server 6, and each unit included therein process data of a specific format and content and/or electronic communication method Hardware and related software for sending and receiving may be collectively referred to as. The terms "part", "module", "device", "terminal", "server" or "system" in this specification are intended to refer to a combination of hardware and software driven by the hardware. For example, the hardware can be a data processing device that includes a CPU or other processor. Also, software driven by hardware may refer to a running process, an object, an executable, a thread of execution, a program, or the like.

In one embodiment, the malicious link detection system 3 includes a transmission/reception unit 31, a hash extraction unit 32, a transmission unit 34, a diagnostic unit 36, and a compensation providing unit 33. . In addition, in one embodiment, the malicious link detection system 3 further includes a storage unit 35.

Each element constituting the malicious link detection system 3 according to the present embodiment is not intended to refer to separate devices that are physically separated from each other. That is, the transmission/reception unit 31, the hash extraction unit 32, the transmission unit 34, the diagnosis unit 36, the compensation providing unit 33, and the storage unit 35 of FIG. 1 are malicious link detection systems 3 Hardware constituting is only functionally divided according to the operation performed by the corresponding hardware, and each part is not necessarily provided independently of each other. Of course, depending on the embodiment, one or more of the transmission/reception unit 31, the hash extraction unit 32, the transmission unit 34, the diagnosis unit 36, the compensation providing unit 33, and the storage unit 35 are physically connected to each other. It is also possible to implement a separate device separated by.

A user who wants to be diagnosed as whether or not a specific link is a malicious link can transmit link information and receive a malicious link detection result by communicating with the malicious link detection system 3 using user devices 1 and 2. . The malicious link detection result provided by the malicious link detection system 3 may be a result of the malicious link detection system 3 detecting itself if the link information is included in the database, or a block chain using the link information It may be the result obtained by querying the network 4 and/or the external diagnostic service server 6.

In one embodiment, the malicious link detection system 3 at least partially functions of an application server that enables function execution of an application by communicating with an application (or an app) running on the user device 1, 2. To perform. Or/and, in addition, the malicious link detection system 3 is a web server that provides a predetermined web page accessible at least partially through a web browser or the like executed on the user devices 1 and 2 ( web server).

In FIG. 1, the first and second user devices 1 and 2 are respectively illustrated in the form of a notebook computer. However, this is exemplary and does not limit the types of the first and second user devices 1 and 2, and the first and second user devices 1 and 2 are mobile communication terminals, such as a smart phone. It may be implemented in the form of any computing device, such as a personal computer, personal digital assistant (PDA), tablet, set-top box for Internet Protocol Television (IPTV), and the like.

The external server 6 is a server of a provider that communicates with the malicious link detection system 3 and provides a diagnostic service, and is not limited to providing a specific service type or device type. In the drawing, for convenience of description, although it is illustrated as one device, the external server 6 may collectively refer to a plurality of different organizations.

The blockchain network 4 consists of a plurality of nodes 41-46 participating in it. Blockchain connects information as a block, and stores information in each node (41-46) rather than a central management server in a peer-to-peer (P2P) network distributed environment, thereby jointly sharing information. Refers to the method of maintaining security by managing. The basic structure of information shared on the blockchain is in the form of a collection of chains of blocks, and after a certain period of time, more than half of the participants exchange and confirm and approve the transaction details, and then use a digital signature. Only the agreed financial transaction details are made into one block. Then, the newly created block is connected to the previous blockchain, and a copy is made and distributed to each node 41-46 and stored.

In embodiments of the present invention, the blockchain network 4 is implemented with nodes 41-46 as participants, and hash values of specific link information and corresponding link information for each of the plurality of nodes 41-46. Whether a malicious link is detected may be stored as a data block. In this specification, a series of information recorded in one data block is referred to as transaction information. In addition, the transaction information may include user information corresponding to a user who provided link information to detect whether a malicious link exists, and details of virtual currency rewards provided to the user.

In this specification, virtual currency refers to digital data whose transaction details are preserved by a distributed ledger that is distributed and stored by each node (41-46) of the blockchain network (4). For example, the virtual currency of the present specification may be an existing virtual currency such as Bitcoin, Ethereum, or any other virtual currency provided by a provider operating the malicious link detection system 3 It might be. When a malicious link detection result for new link information is generated, it is uploaded to the data block of the blockchain network (4) and rewarded to the user who provided the link information with a cryptocurrency based on the blockchain network (4) By providing, you can encourage active participation of users. For example, the provision of virtual currency rewards to a user may be based on a smart contract, but is not limited thereto.

In FIG. 1, each of the plurality of nodes 41-46 is shown in the form of a server, but each of the plurality of nodes 41-46 is a mobile communication terminal such as a smartphone, a PDA, a tablet PC, a desktop PC, an IPTV set-top box, and the like. Likewise, it may include any kind of computing device that can be connected to an external server through a wireless communication network. In addition, although FIG. 1 illustrates that the blockchain network 4 is configured by six nodes 41-46, it is easy to see that the number of nodes participating in the blockchain network 4 can be more or less. Will be understood.

The transmission/reception unit 31 receives link information to detect whether a malicious link exists from the user devices 1 and 2, and when a malicious link detection result for the link information is obtained by the diagnostic unit 36, the user device 1, 2 2).

The hash extractor 32 is configured to generate a hash value corresponding to the link information received by the transceiver 31. The hash value is generated in correspondence to the original link information, and if the original information is slightly different, the hash value changes, but since it is impossible to track the original information from the hash value, in the embodiments, the hash value is used to block the network (4 ) And matching of link information and confirmation of existing detection can be performed.

The diagnostic unit 36 is configured to generate a malicious link detection result for link information. Meanwhile, in one embodiment, the storage unit 35 is configured to store the detected malicious link detection result together with each link information. That is, the storage unit 35 corresponds to a storage for storing the internal database of the malicious link detection system 3. When the malicious link detection system 3 includes the storage unit 35, the diagnosis unit 36 may detect whether the link information is a malicious link based on the database of the storage unit 35. Alternatively, the diagnostic unit 36 detects whether a malicious link exists by transmitting link information to the external server 6, or compares a hash value of the link information with a distributed ledger on the blockchain network 4 to detect whether the malicious link exists. Can be.

The transmission unit 34 compares the hash value of the link information provided by the user with the distributed ledger on the blockchain network 4, and if the hash value of the link information is not recorded in the distributed ledger, it is determined as new link information. And the hash value and malicious link detection result can be uploaded to the blockchain network 4 as a data block. At this time, the malicious link detection result to be recorded in the data block can be obtained by the database of the storage unit 35 or the external diagnostic service server 6.

In addition, when the new malicious link detection result is uploaded to the blockchain network 4 based on the link information provided by the user, the reward providing unit 33 of the blockchain network 4 is provided to the user who provided the link information. Cryptocurrency managed by a distributed ledger can be provided as a reward. For example, the provision of the reward to the user may be achieved by uploading a block of data defining the payment history of the virtual currency to the user as a transaction to the blockchain network 4 together with the result of detecting the malicious link.

2 is a flowchart of a malicious link detection method according to an embodiment. For convenience of description, a method for detecting a malicious link according to this embodiment will be described with reference to FIGS. 1 and 2.

First, the transmission/reception unit 31 of the malicious link detection system 3 may receive link information from the user device 2 (S1). In this embodiment, it will be described as an example that the transmission of the link information is made by any one of the user device (1, 2) of the user device (2) of Figure 1, which uses a malicious link detection system (3) or It will be readily understood that the number of users is not limited.

In the present specification, link information means that a linked page, before or after accessing the linked page, for a link in which the user is not sure whether the malicious link is a malicious link or unauthorized access to the user's information or goods This is information that is sent to check whether it contains malicious data for the purpose. Link information may be a URL (Uniform Resource Location) address including an address of a specific web document (for example, an HTML file) in a narrow sense, or may refer to a specific domain in a broad sense, in multiple or multiple stages. It may also include configured URL addresses.

In one embodiment, the malicious link detection system 3 may first search an internal database stored in the storage unit 35 of the malicious link detection system 3 when link information to detect whether the malicious link is received (S2) ). In the internal database, link information previously detected as being a malicious link or not as a malicious link and their detection results are stored. For example, the internal database may be configured as a blacklist including a list of link addresses determined as a malicious link and/or a whitelist including a list of link addresses determined as not a malicious link. .

The diagnosis unit 36 of the malicious link detection system 3 queries the link information transmitted from the user device 2 from the internal database, and when a malicious link detection result of the link information is obtained, the user device 2 It can be provided to (S6-1). In this case, since the link information requested by the user has been recorded in the existing database, the procedure is terminated as such, and no additional compensation is given to the user.

On the other hand, if the link information transmitted from the user device 2 is not retrieved from the internal database, the diagnostic unit 36 of the malicious link detection system 3 may be configured with an external diagnostic service server 6 and/or a blockchain network ( 4) Initiate malicious link detection.

Specifically, the diagnostic unit 36 transmits link information to the external diagnostic service server 6 and receives the malicious link detection result corresponding to the link information (S3). At this time, the diagnostic unit 36 may transmit the URL itself of the link information to the diagnostic service server 6 according to a transmission rule defined by the diagnostic service server 6, or an electronic fingerprint extracted from the link information (eg, Hash value) or other different types of information to the diagnostic service server 6.

On the other hand, by paralleling or replacing the inquiry process through the diagnostic service server 6, the diagnostic unit 36 compares the link information with information recorded in the distributed ledger on the blockchain network 4, thereby linking the malicious link to the link information. You can also search for detection results. To this end, the diagnostic unit 36 first extracts a hash value from a predetermined portion of link information or all of the link information (S4), and compares the extracted hash value with the distributed ledger on the blockchain network 4 to apply It is possible to check whether the link information has been detected or not and uploaded onto the blockchain network 4 (S5).

Next, the diagnostic unit 36 may provide the user device 2 with a result of detecting a malicious link of link information obtained through the distributed ledger or the diagnostic service server 6 of the blockchain network 4 (S6-2). ). The malicious link detection result of the link information may be stored in the storage unit 35 of the malicious link detection system 3. At this time, if the hash value of the link information and the result of the malicious link detection have already been recorded in the distributed ledger on the blockchain network 4, the procedure is terminated as such, and no additional compensation is given to the user.

On the other hand, if the hash value of the corresponding link information and the result of the malicious link detection are not already recorded in the distributed ledger on the blockchain network 4, the user of the user device 2 compensates for providing the new link information. The following procedure is performed to provide it to the user.

First, the transmission unit 34 may define transaction information to be recorded in a block of data of the blockchain to include new link information that has not been recorded in the existing distributed ledger and a result of detecting the malicious link thereof (S7). For example, the transaction information may be a data block including link information and/or a hash value thereof, and a malicious link detection result (that is, whether or not the malicious link) for the link information.

Next, the transmission unit 34 may upload a data block including the generated transaction information on the blockchain network 4 (S8). Blocks shared on the blockchain network 4 are all connected in a chain, and each newly created block includes the hash value of all blocks created up to the last and the data of the newly created block. Nodes 41-46 propagate the newly created block at one node to neighboring nodes, and at the neighboring nodes, chain generation is performed by verifying whether the propagated block conforms to the blockchain's consensus algorithm. Participate and share new blocks.

The transmission unit 34, using the above characteristics of the blockchain, to the data block containing the malicious link detection result of the link information to any one of the nodes (41-46) constituting the blockchain network (4) By transmitting, the data block is included in the newly created block of the blockchain, and stored in one or more nodes 41-46 on the blockchain network 4. By storing the results of malicious link detection on the blockchain network (4), it is possible to secure the integrity of the data and to solve the cost and difficulty of management when storing the diagnosis results for the vast link in the system. Problems that occur when a diagnosis is made can be avoided depending on the diagnosis result of a diagnostic operator.

In addition, the reward providing unit 33 of the malicious link detection system 3 is a virtual transaction history managed by the distributed ledger of the blockchain network 4 to the user of the user device 2 that provided the newly diagnosed link information. Currency can be provided as a reward. To this end, in one embodiment, when the transaction information is recorded as a data block on the blockchain by the transmission unit 34, the user information (for example, a cryptocurrency deposit address) of the user who provided the link information is included in the transaction information. Can. Further, in another embodiment, the transaction information itself may be in the form of a smart contract that includes the transmission of the virtual currency to the user's cryptocurrency deposit address.

In one embodiment, the size of the virtual currency reward provided to the user who provided the link information may be determined based on the new degree of the link information. For example, depending on whether the domain included in the link information and each web page file (ie, HTML document) linked by the link information is new, the link information is (i) a new file of a new domain, (ii) a known domain It can be divided into a new file, (ⅲ) a known file of a new domain, and (ⅳ) a known file of a known domain.

Whether the domain of the link information is a new domain or not, the full URL of the link information (eg, https://www.example.net/example.html) itself is not previously diagnosed, but other links accessible within the same domain It means that the existing diagnosis was made for the address (for example, https://www.example.net/prior.html). Whether or not the other link address of the same domain has been diagnosed can be confirmed by querying the database or diagnostic service server 6 of the storage unit 35 of the malicious link detection system 3.

In addition, whether the web document accessible through the link information is a new file means whether the HTML document itself accessed through the link information is new. This is because the web document file itself accessed through the URL may be the same even if the URL is different. Whether it is the same web document file can also be confirmed by querying the database or the diagnostic service server 6 of the storage unit 35 of the malicious link detection system 3.

In this embodiment, the reward providing unit 33 primarily determines the size of the virtual currency reward so that the reward is large in the case of a new domain according to whether the domain is new, and secondly, in the case of a new file, the reward is large. To determine the size of the cryptocurrency reward. As a result, in the examples of (i) to (ⅳ) described above, if the size of the virtual currency reward is arranged from large to small, (i) new files in the new domain, (ii) new files in the known domain, (,) This is the case for known files in the new domain and (v) known files in the known domain.

However, this is an example, and in other embodiments, the size of the virtual currency reward may be determined by giving priority to the newness of the web document file itself in comparison to the newness of the domain, or the cryptocurrency may be determined by a different standard than the domain or web document file. You can also decide the size of the reward.

According to the malicious link detection system and method according to the above-described embodiments, since the malicious link detection result for a specific link is recorded in the form of a transaction on the blockchain network 4, a node constituting the blockchain network 4 It is impossible for any user to arbitrarily manipulate the results detected by malicious links unless more than half of them are hacked. As a result, it is possible to avoid the security risk that may occur when malicious link detection is made by relying only on a specific diagnostic service.

In addition, since the user who provided the link information is provided with a virtual currency as a reward at the same time as creating a data block on the blockchain, it can be expected to improve the accuracy and speed of diagnosis by inducing active participation of users and building a vast database through this. In addition, since the diagnosis result database is also distributed and recorded on the blockchain network 4, there is an advantage in that it does not require a separate cost for storage and management of the vast database.

The operation by the malicious link detection method according to the above-described embodiments may be at least partially implemented as a computer program and recorded in a computer-readable recording medium. In the recording medium, a program consisting of commands for implementing an operation by a malicious link detection method is recorded. For example, an embodiment of the present invention may be implemented in the form of an application (or app) capable of executing a malicious link detection method on a user terminal or a detection server such as a smartphone or tablet. In addition, the recording medium includes any kind of recording device capable of storing data that can be read by a computer. For example, a computer-readable recording medium includes a ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. In addition, the computer readable recording medium may be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed manner. Functional instructions, codes, and code segments for implementing the embodiments will be readily understood by those skilled in the art to which this embodiment belongs.

The present invention described above has been described with reference to the embodiments shown in the drawings, but this is only exemplary and those skilled in the art will understand that various modifications and modifications of the embodiments are possible therefrom. However, it should be considered that such modifications are within the technical protection scope of the present invention. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

Claims (11)

A transceiver configured to receive link information to detect whether a malicious link is present from a user device, and to provide a result of detecting a malicious link to the user device to the user device;
A hash extractor configured to generate a hash value corresponding to the link information;
A diagnostic unit configured to generate the malicious link detection result for the link information;
A transmission unit configured to upload the hash value and the malicious link detection result to the blockchain network when the hash value is not recorded in the distributed ledger of the blockchain network; And
When the malicious link detection result is uploaded to the blockchain network, a reward providing unit that provides a virtual currency managed by a distributed ledger of the blockchain network to a user corresponding to the user device that provided the link information Malware link detection system.
According to claim 1,
The diagnosis unit, the malicious link detection system further configured to generate the malicious link detection result by retrieving the hash value corresponding to the link information in the distributed ledger of the blockchain network.
According to claim 1,
The diagnosis unit, the malicious link detection system further configured to generate the malicious link detection result by searching for one or more external servers using the link information.
According to claim 1,
The transmission unit, the malicious link detection system further configured to record the link information and the transaction information including the malicious link detection result in a data block on the blockchain network.
According to claim 4,
The transmitting unit is configured to further include user information corresponding to the user device that has transmitted the link information in the transaction information.
The malicious link detection system, receiving link information to detect whether the malicious link from the user device;
Generating, by the malicious link detection system, a hash value corresponding to the link information;
Generating, by the malicious link detection system, a malicious link detection result for the link information;
Transmitting, by the malicious link detection system, the malicious link detection result to the user device;
When the malicious link detection system does not record the hash value in the distributed ledger of the blockchain network, uploading the hash value and the malicious link detection result to the blockchain network; And
When the malicious link detection system uploads the malicious link detection result to the blockchain network, a virtual currency managed by the distributed ledger of the blockchain network is provided to a user corresponding to the user device that provided the link information. Malicious link detection method comprising the step of providing.
The method of claim 6,
The step of generating the malicious link detection result includes the step of generating the malicious link detection result by searching the distributed ledger of the blockchain network for the hash value corresponding to the link information.
The method of claim 6,
The step of generating the malicious link detection result includes generating the malicious link detection result by searching for one or more external servers using the link information.
The method of claim 6,
The step of uploading to the blockchain network includes recording transaction information including the link information and the result of detecting the malicious link in a data block on the blockchain network.
The method of claim 9,
The transaction information further includes a user information corresponding to the user device that transmitted the link information.
A computer program stored in a computer-readable recording medium to execute the malicious link detection method according to any one of claims 6 to 10 in combination with hardware.

Images