KR20210112678A - Method and blockchain nodes for detecting abusing based on blockchain networks - Google Patents

Abstract

Disclosed are a method for detecting abuse based on a blockchain network and a specific blockchain node using the same. The method for detecting abuse based on a blockchain network comprises: a step (a) in which a specific blockchain node among blockchain nodes constituting the blockchain network causes, if service data generated from each service provided by each service providing server is obtained, a smart contract registered in a distributed ledger of the blockchain network to register the service data in the distributed ledger of the blockchain network; and a step (b) in which the specific blockchain node transmits the service data to a pattern analysis server and causes the pattern analysis server to analyze a pattern for each of the service data with reference to a preset pattern analysis criterion to detect abuse, generate abuse detection information, and register the abuse detection information in other blockchain networks, thereby enabling each service providing server to check the abuse detection information.

Description

A method for detecting abusing based on a blockchain network and a blockchain node using the same

The present invention relates to a method for detecting abusing based on a blockchain network and a blockchain node using the same.

Various conventional services have introduced a login-based membership system, and accordingly, various service data corresponding to each service, for example, log-in information, have been stored in a dedicated database for each service provider.

Accordingly, each service provider was able to analyze abusing patterns and detect abusing by using their own service data, but could not access the service data of other service providers, so it had an extremely limited scope There was a problem in which the abusing pattern analysis was performed.

In addition, although these service data, such as login information, are important information that can confirm the user's activity starting point, they are generally stored in a storage space that can be easily tampered with. There was a risk that the data could be tampered with at any time by an attack.

In addition, since the service data owned by each service provider is stored in a database for each service provider, it is difficult to share the data in real time even if each service provider discloses their respective service data to each other. A problem existed.

Therefore, there is a need for an improvement method to solve the above problems.

US 10-2019-0033170 A

An object of the present invention is to solve all of the above problems.

Another object of the present invention is to allow the pattern analysis server to analyze the data to detect abusing by registering service data obtained from service providers in the blockchain network.

In addition, the present invention registers the abusing detection information generated by applying a standardized analysis logic to the service data to the public block chain so that anyone can check the abusing detection information based on massive service data in real time. The purpose.

In addition, another object of the present invention is to prevent performance degradation of each block chain network by registering in different block chain networks according to the presence or absence of pattern analysis and to prevent excessive fees from occurring.

In addition, another object of the present invention is to prevent a malicious third party from tampering with data by registering service data and abusing detection information in the blockchain network.

In order to achieve the object of the present invention as described above and to realize the characteristic effects of the present invention to be described later, the characteristic configuration of the present invention is as follows.

According to an aspect of the present invention, in a method for detecting abusing based on a block chain network, (a) when service data generated from each service provided by each service providing server is obtained, a block chain network is configured making, by a specific blockchain node among the blockchain nodes, a smart contract registered in the distributed ledger of the blockchain network to register the service data in the distributed ledger of the blockchain network; and (b) the specific block chain node transmits the service data to the pattern analysis server to allow the pattern analysis server to analyze the patterns for each of the service data with reference to a preset pattern analysis standard to detect abusing. A method comprising; generating abusing detection information and registering the abusing detection information to another blockchain network so that each of the service providing servers can check the abusing detection information; is disclosed.

As an example, in step (b), the specific block chain node causes the pattern analysis server to assign each of the service data (i) a weight for each abusing pattern according to the abusing pattern, (ii) re-detection with a specific abusing pattern Disclosed is a method characterized in that the abusing detection information is generated by applying an abusing re-detection weight corresponding to the number of times and (iii) a weight for each service period corresponding to the service provision period.

As an example, in step (b), the specific block chain node causes the pattern analysis server to generate the abusing detection information by applying the weight for each service period to each of the service data, and the specific block chain node A, in a state in which the pattern analysis server classifies the respective services into a new service, a transient service, and a stable service based on each service start time, the first weight corresponding to the new service, the transient service Disclosed is a method characterized in that the abusing detection information is generated by additionally referring to a corresponding second weight and a third weight corresponding to the stability service.

As an example, in step (a), the service data generated in each of the services provided by each of the service providing servers is obtained from a service provider API server, and in step (b), the specific blockchain node A, by causing the pattern analysis server to register the abusing detection information in the other blockchain network, other smart contracts in the other blockchain network can use other smart contracts corresponding to the abusing detection information registered in the other blockchain network. Disclosed is a method characterized in that by providing the abusing detection transaction information to the service provider API server, each of the service providing servers can check the abusing detection information by referring to the other abusing detection transaction information.

As an example, (c) confirmation information corresponding to specific abusing detection information generated by a specific service providing server among the service providing servers - The confirmation information is based on the result of checking whether the specific abusing detection information corresponds to abusing behavior Corresponding - When is obtained from the service provider API server, the specific blockchain node refers to the confirmation information corresponding to the specific abusing detection information and corresponds to the specific abusing detection information registered in the other blockchain network. The method further comprising: allowing the status information to be updated or allowing the pattern analysis server to update the status information registered in the other blockchain network with reference to the confirmation information.

As an example, the identification information is a method, characterized in that one of spy information, false positive information, false detection information, and whitelist information is disclosed.

As an example, in step (b), the specific blockchain node causes the smart contract to acquire the abusing detection information registered in the other blockchain network through the Oracleize API server, and the service providing servers Disclosed is a method characterized in that each allows to check the abusing detection information through the service provider API server.

As an example, the service data includes at least a service code, an IP address, and a service use time, and the abusing detection information includes at least abusing pattern information, blacklist information, and abusing score.

As an example, a method is disclosed, wherein the blockchain network and the other blockchain networks are a private blockchain network and a public blockchain network, respectively.

As an example, in step (a), the specific block chain node causes the smart contract to hash the personal information included in the service data, and to hash the service data on which the personal information is hashed to the distributed ledger. A method is disclosed, characterized in that, in the step (b), the specific block chain node transmits the service data on which the personal information is hashed to the pattern analysis server.

As an example, in step (a), the specific blockchain node causes the smart contract to transmit the service data to the address management server, and the address management server causes the address management server to match each of the service data. generate and transmit the address values to the smart contract, cause the smart contract to match the service data and the address values, respectively, and register them in the distributed ledger of the blockchain network, and (b) In the step, the specific block chain node transmits the service data and the address values to the pattern analysis server so that the pattern analysis server generates the abusing detection information corresponding to the service data and the address values. Disclosed is a method characterized in that

As an example, the specific block chain node causes the pattern analysis server to analyze the service data through machine learning to detect a new abusing pattern, and provides a new detection rule corresponding to the new abusing pattern to the pattern analysis server A method comprising registering is disclosed.

According to another aspect of the present invention, in a specific block chain node among block chain nodes for detecting abusing based on a block chain network, at least one memory for storing instructions; and at least one processor configured to execute the instructions, wherein the processor is configured to: (1) When service data generated from each service provided by each of the service providing servers is obtained, the distributed ledger of the blockchain network A process for causing a smart contract registered in to register the service data in the distributed ledger of the block chain network, and (2) transmitting the service data to a pattern analysis server so that the pattern analysis server performs a preset pattern analysis standard By analyzing patterns for each of the service data with reference to detect abusing to generate abusing detection information, and registering the abusing detection information to other blockchain networks, each of the service providing servers transmits the abusing detection information A specific blockchain node is disclosed that executes the above instructions to perform a process enabling verification.

As an example, the processor, in the (2) process, causes the pattern analysis server to assign each of the service data (i) a weight for each abusing pattern according to the abusing pattern, (ii) the number of times re-detected as a specific abusing pattern A specific block chain node is disclosed, characterized in that the abusing detection information is generated by applying a corresponding abusing re-detection weight and (iii) a weight for each service period corresponding to the service provision period.

As an example, the processor, in the process (2), causes the pattern analysis server to generate the abusing detection information by applying the weight for each service period to each of the service data, but causes the pattern analysis server to In a state in which each of the services is classified into a new service, a transient service, and a stable service based on the service start time, the first weight corresponding to the new service, the second weight corresponding to the transient service, and the stable service A specific block chain node is disclosed, characterized in that the abusing detection information is generated by additionally referring to a corresponding third weight.

As an example, in the (1) process, the service data generated in the respective services provided by each of the service providing servers are obtained from a service provider API server, and the processor, in the (2) process, the By causing the pattern analysis server to register the abusing detection information in the other blockchain network, other smart contracts in the other blockchain network can detect other abusing transactions corresponding to the abusing detection information registered in the other blockchain network. A specific blockchain node is disclosed, characterized in that by providing information to the service provider API server, each of the service providing servers can check the abusing detection information by referring to the other abusing detection transaction information.

As an example, (3) the processor, the confirmation information corresponding to the specific abusing detection information generated by the specific service providing server among the service providing servers - The confirmation information is whether the specific abusing detection information corresponds to an abusing behavior Corresponding to the result of checking - If is obtained from the service provider API server, the status information corresponding to the specific abusing detection information registered in the other blockchain network with reference to the verification information corresponding to the specific abusing detection information is A specific block chain node characterized by further comprising a process of updating or causing the pattern analysis server to update the state information registered in the other block chain network with reference to the confirmation information is disclosed.

As an example, the confirmation information is a specific blockchain node, characterized in that one of spy information, false positive information, false positive information, and whitelist information is disclosed.

As an example, the processor, in the process (2), causes the smart contract to acquire the abusing detection information registered in the other blockchain network through the Oracleize API server, and causes each of the service providing servers to A specific blockchain node is disclosed, characterized in that it is possible to check the abusing detection information through the service provider API server.

As an example, the service data includes at least a service code, an IP address, and a service use time, and the abusing detection information includes at least abusing pattern information, blacklist information, and abusing score. do.

As an example, a specific blockchain node is disclosed, wherein the blockchain network and the other blockchain networks are a private blockchain network and a public blockchain network, respectively.

As an example, the processor, in the (1) process, causes the smart contract to hash the personal information included in the service data to register the service data hashed with the personal information to the distributed ledger, , in the (2) process, a specific block chain node is disclosed, characterized in that the personal information is hashed and transmits the service data to the pattern analysis server.

As an example, the processor, in the process (1), causes the smart contract to transmit the service data to an address management server, and causes the address management server to generate address values matching each of the service data. and transmit the address values to the smart contract, cause the smart contract to match the service data and the address values respectively and register them in the distributed ledger of the blockchain network, in the process (2), A specific block chain node, characterized in that by transmitting the service data and the address values to the pattern analysis server, the pattern analysis server generates the abusing detection information corresponding to the service data and the address values is initiated.

As an example, the processor causes the pattern analysis server to analyze the service data through machine learning to detect a new abusing pattern, and to register a new detection rule corresponding to the new abusing pattern to the pattern analysis server A specific blockchain node characterized by it is disclosed.

In addition to this, a computer-readable recording medium for recording a computer program for executing the method of the present invention is further provided.

The present invention has the effect of allowing the pattern analysis server to analyze the data to detect abusing by registering service data obtained from service providers in the blockchain network.

In addition, the present invention has the effect of allowing anyone to check the abusing detection information based on massive service data in real time by registering the abusing detection information generated by applying the standardized analysis logic to the service data in the public block chain. .

In addition, the present invention has the effect of preventing performance degradation of each block chain network and preventing excessive fees from being generated by registering in different block chain networks depending on the presence or absence of pattern analysis.

In addition, the present invention has the effect of preventing a malicious third party from tampering with data by registering service data and abusing detection information in the blockchain network.

The accompanying drawings for use in the description of the embodiments of the present invention are only a part of the embodiments of the present invention, and for those of ordinary skill in the art to which the present invention pertains (hereinafter "those skilled in the art"), the invention Other drawings may be obtained based on these drawings without any work being done.
1 schematically shows a system for detecting abusing based on a blockchain network according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following detailed description of the present invention refers to the accompanying drawings, which show by way of illustration a specific embodiment in which the present invention may be practiced, in order to clarify the objects, technical solutions and advantages of the present invention. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention.

Also, throughout this description and claims, the word "comprises" and variations thereof are not intended to exclude other technical features, additions, components or steps. Other objects, advantages and characteristics of the present invention will appear to a person skilled in the art, in part from this description, and in part from practice of the present invention. The following illustrations and drawings are provided by way of illustration and are not intended to limit the invention.

Moreover, the invention encompasses all possible combinations of the embodiments indicated herein. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein with respect to one embodiment may be embodied in other embodiments without departing from the spirit and scope of the invention. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those of ordinary skill in the art to easily practice the present invention.

1 schematically shows a system for detecting abusing based on a block chain network 200 according to an embodiment of the present invention. Referring to FIG. 1 , the system includes service providing servers 100-1, 100-2, ..., 100-N), blockchain network (200), pattern analysis server (300), other blockchain networks (400), service provider API server (500), Oracleize API server (600) may include.

First, each of the service providing servers 100-1, 100-2, ..., 100-N corresponds to memories storing instructions for providing respective services and instructions stored in the memories, respectively. It may include processors that perform an operation of providing services of

Specifically, each of the service providing servers 100-1, 100-2, ..., 100-N is typically a computing device (eg, a computer processor, memory, storage, input device and output device, other existing Devices that may include components of a computing device; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SANs)) and computer software (ie, as a computing device). instructions that cause it to function in a particular way) to achieve the desired system performance.

In addition, the processor of the computing device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. In addition, the computing device may further include an operating system and a software configuration of an application for performing a specific purpose.

However, a case in which the computing device includes an integrated processor in which a medium, a processor, and a memory are integrated for implementing the present invention is not excluded.

Meanwhile, the pattern analysis server 300 analyzes patterns for each of the service data with reference to a preset pattern analysis criterion to detect abusing, thereby storing instructions for generating abusing detection information and instructions stored in the memories. It may include processors that perform an operation of generating abusing detection information in response to them.

On the other hand, the service provider API server 500 and the Oracleize API server 600 are stored in memories and memories that store instructions for transmitting service data and abusing detection information from the outside of the blockchain network 200, respectively. It may include processors that perform an operation of transmitting service data and abusing detection information in response to the instructions.

Since the description of the configuration of the pattern analysis server 300 , the service provider API server 500 , and the Oracleize API server 600 is similar to the description of the configuration of the service providing server, a further detailed description will be omitted.

On the other hand, the block chain network 200 includes block chain nodes including a specific block chain node, and service data can be registered in the distributed ledger by the distributed agreement of the block chain nodes.

In addition, each of the blockchain nodes of the blockchain network 200 may be a computing device including at least a memory and a processor.

At this time, the memory of the computing device may store the instructions, specifically, as computer software for causing the blockchain nodes of the blockchain network 200 to function in a specific way, as computer or other programmable data processing It may be stored in a computer usable or computer readable memory that may be oriented to the equipment. The instructions are also capable of performing processes for executing the functions shown in the drawings.

In addition, the processor of the computing device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. In addition, the computing device may further include an operating system and a software configuration of an application for performing a specific purpose.

However, a case in which the computing device includes an integrated processor in which a medium, a processor, and a memory are integrated for implementing the present invention is not excluded.

On the other hand, since the detailed description of the configuration of the other block chain network 400 is similar to the description of the configuration of the block chain network 200, the detailed description will be omitted.

The service providing servers 100-1, 100-2, ..., 100-N configured in this way, the block chain network 200, the pattern analysis server 300, other block chain networks 400, the service provider API A method of detecting abusing by the server 500 and the Oracleize API server 600 will be described below.

First, when service data generated from each service provided by each of the service providing servers 100-1, 100-2, ..., 100-N is obtained, the block chain constituting the block chain network 200 A specific blockchain node among nodes may cause a smart contract registered in the distributed ledger of the blockchain network 200 to register service data in the distributed ledger of the blockchain network 200 .

At this time, as can be seen through FIG. 1 , the service providing server 100-1 of at least some of the service providing servers 100-1, 100-2, ..., 100-N is the blockchain network 200 . Becomes a specific block chain node (200-1) among the block chain nodes constituting By doing so, the corresponding service data can be registered in the distributed ledger of the blockchain network 200, but is not limited thereto.

That is, at least some of the service providing servers (100-N) of the service providing servers (100-1, 100-2, ..., 100-N) do not participate in the blockchain network 200 but indirectly serve It transmits service data generated from its own service to a specific blockchain node 200-2 through the provider API server 500, and the specific blockchain node 200-2 corresponding to the service provider API server 500 corresponds By broadcasting the service data to the remaining nodes 200-1, 200-3, 200-4, ..., 200-N, the corresponding service data can be registered in the distributed ledger of the blockchain network 200 .

At this time, the service data registered in the distributed ledger is various data generated from each service provided by service providers to service users, for example, login data, search log, etc. may be service data, and these service data include Service code, IP address, service use time, etc. may be included. However, the present invention is not limited thereto, and at least some of information about the operating system of the user terminal to which the service is provided, language information, and login ID information of the service user may be included.

Here, information such as an IP address may be regarded as personal information, so if it is registered in the distributed ledger of the blockchain network 200 in plain text, legal problems may occur. Therefore, a specific blockchain node can make the smart contract perform a hash operation on the personal information included in the service data, for example, information such as the IP address, and register the service data in which the personal information is hashed in the distributed ledger. have.

In addition, a specific blockchain node causes the smart contract to transmit service data to an address management server (not shown), causes the address management server to generate address values that match each of the service data, and converts the address values to the smart contract to be transmitted, and the smart contract can match service data and address values, respectively, and register them in the distributed ledger of the blockchain network 200 .

For example, there may be two cases of key values to be recorded even for the same service data, such as an IP address and a user ID. As such, when there are a plurality of key values to be recorded, there is a problem in that it is difficult to generate the same address value. To solve this, a specific blockchain node causes the address management server to generate the same address value corresponding to a plurality of keys included in the service data and transmit it to the smart contract. can make it happen

And, a specific block chain node transmits service data to the pattern analysis server 300 and causes the pattern analysis server 300 to analyze patterns for each of the service data with reference to a preset pattern analysis standard to detect abusing. By generating abusing detection information and registering the abusing detection information to other blockchain networks 400, each of the service providing servers 100-1, 100-2, ..., 100-N transmits the abusing detection information. you can check it out. In this case, the block chain network 200 and other block chain networks 400 may be a private block chain network and a public block chain network, respectively.

Here, a process in which the pattern analysis server 300 analyzes a pattern of service data with reference to a preset pattern analysis standard will be described as follows.

That is, a specific block chain node causes the pattern analysis server 300 to assign each of the service data (i) a weight for each abusing pattern according to the abusing pattern, (ii) abusing re-detection corresponding to the number of times that the specific abusing pattern is re-detected. A weight and (iii) a weight for each service period corresponding to the service provision period may be applied to generate abusing detection information.

Specifically, the pattern analysis server 300 refers to at least some of the correlation between the login location and the login time, the number of login attempts within a certain time range, the login time by IP address, and the number of logged-in users by IP address for each abusing pattern weights can be applied.

In addition, the pattern analysis server 300, for example, when the same IP address is detected again by the abusing detection rule, regardless of whether the IP address is included in the service data related to the same service, the corresponding IP address is a malicious behavior It is possible to apply a redetection weight to the corresponding IP address as it has a high correlation with .

As another example, when service data indicating that a specific search word is repeatedly inputted in a specific time period is obtained, the pattern analysis server 300 refers to the number of times the corresponding search word is repeatedly inputted within a certain time range to a blacklist in the corresponding service data. By applying a weight for registration and generating specific abusing detection information corresponding to an action in which a specific search term is input at a specific time, a specific service provider can check specific abusing detection information and support that a specific search term is not reflected in the search term ranking have.

Conversely, the pattern analysis server 300 determines that a specific IP address is related to abusing in the past and is designated as a blacklist, but after a predetermined time has elapsed after being designated as a blacklist, the specific IP address is related to abusing. If it is not detected again as an IP address, you can clear the blacklist specified for a specific IP address and designate it as a normal IP address.

In addition, the pattern analysis server 300, a third party with malicious intent, to reduce the reliability of the abusing detection information disclosed through the other blockchain network 400, the contaminated service data to the blockchain network 200 In order to prevent an act of registering in , a weight for each service period may be applied to each of the service data.

That is, the pattern analysis server 300 classifies each service into a new service, a transient service, and a stable service based on each service start time or service registration time, a first weight corresponding to the new service, a transient A second weight corresponding to the service and a third weight corresponding to the stable service may be further referenced.

As an example, for new service data generated from a new service for a predetermined period from the time of service start or service registration, (i) a specific block chain node does not register new service data in the distributed ledger of the block chain network 200 or (ii) the pattern analysis server 300 may apply a weight of 0 as the first weight to the new service data. Also, the pattern analysis server 300 may apply a weight of 0.1 as a second weight to transient service data generated in a transient service in which a first period has elapsed from the service start time or service registration time. Also, the pattern analysis server 300 may apply a weight of 1 as a third weight to the stable service data generated in the stable service in which a second period has elapsed from the service start time or service registration time. For reference, the first period may be shorter than or equal to the second period.

At this time, the abusing detection information may include at least abusing pattern information, blacklist information, and abusing scores, but is not limited thereto, and among the abusing grades, local information corresponding to the IP address, overall score, and overall grade It may include at least a portion.

In addition, in the blacklist information, (i) whitelist information to prevent information such as a specific IP address determined to be related to abusing from being registered in the blacklist, (ii) information such as a specific IP address is related to abusing Normal data information indicating that information such as blacklist information, (iii) a specific IP address, etc., does not correspond to either the whitelist or the blacklist may be included.

In this case, each of the whitelist information and the blacklist information may simply indicate whether the whitelist or the blacklist corresponds to, but is not limited thereto, and the reliability of each analysis information may be indicated through the score.

For example, when a specific IP address is first analyzed as a blacklist, 10 points are given to the corresponding IP address, but 10 points may be accumulated each time it is re-detected as a blacklist thereafter. However, this weight application method is only an example, and an operation other than the addition operation may be applied.

In addition, a specific block chain node causes the pattern analysis server 300 to register the abusing detection information in the other block chain network 400, thereby causing other smart contracts of the other block chain network 400 to become another block chain network 400 ) by providing other abusing detection transaction information corresponding to the abusing detection information registered in the service provider API server 500, so that each of the service providing servers 100-1, 100-2, ..., 100-N It is possible to check the abusing detection information by referring to other abusing detection transaction information.

That is, another smart contract registered in another block chain network 400 may provide other abusing detection transaction information as a transaction ID corresponding to the abusing detection information to each of the service providing servers.

Contrary to the above, a specific blockchain node causes a smart contract registered in the blockchain network to acquire the abusing detection information registered in the other blockchain network 400 through the Oracleize API server 600, and a service providing server It is possible to enable each of the ones 100-1, 100-2, ..., 100-N to check the abusing detection information through the service provider API server 500 .

In addition, in order to prevent infringement of personal information that may occur when a specific block chain node is registered and disclosed to another block chain network, such as an IP address, service data in which personal information is hashed can be transmitted to the pattern analysis server 300 . have.

In addition, a specific blockchain node may transmit service data and address values to the pattern analysis server 300 so that the pattern analysis server 300 generates abusing detection information corresponding to the service data and address values. .

In addition, confirmation information corresponding to specific abusing detection information generated by a specific service providing server among the service providing servers 100-1, 100-2, ..., 100-N is obtained from the service provider API server 500 When obtained, the specific blockchain node refers to the confirmation information corresponding to the specific abusing detection information so that the status information corresponding to the specific abusing detection information registered in the other blockchain network 400 is updated or the pattern analysis server 300 The state information registered in the other block chain network 400 can be updated by referring to the confirmation information.

In this case, the confirmation information may correspond to a result of confirming whether the specific abusing detection information corresponds to an abusing act. Specifically, the confirmation information may be one of true positive information, true negative information, false positive information, false negative information, and whitelist information.

For example, specific service data provided by a specific service provider may be erroneously analyzed as being related to abusing due to various reasons. For example, when many people use a specific service through the same public IP address at the same time, even though each individual has no intention of abusing, the specific service data is stored in the same IP address at the same time. Since the record is included, the pattern analysis server 300 may analyze specific service data as being related to abusing.

In the above case, a specific service provider may give feedback that the corresponding IP address is not related to abusing in order to provide the service smoothly. That is, the specific service provider confirms that the specific abusing detection information analyzed to be related to the abusing behavior is not actually related to the abusing behavior, and sends the verification information corresponding to the specific abusing detection information, such as whitelist registration information, to the service provider API server. (500) can be provided. Of course, if a specific service provider is an operator of a service providing server that operates a specific block chain node among the block chain nodes of the block chain network 200, directly to the block chain network 200 without going through the service provider API server 500 might be able to provide.

As such, by obtaining the confirmation information from the service providing server, the confirmation information corresponding to the specific abusing detection information is referenced, and the status information corresponding to the specific abusing detection information registered in the other block chain network 400 may be updated.

Meanwhile, the pattern analysis server 300 may analyze service data through machine learning to detect a new abusing pattern, and register a new detection rule corresponding to the new abusing pattern in the pattern analysis server 300 .

As an example, the pattern analysis server classifies data patterns corresponding to service data into any one pattern among preset abusing patterns in a state that is learned to detect an abusing pattern through machine learning, and which by machine learning The abusing pattern of service data is detected by referring to the information classified as one abusing pattern, and a specific data pattern corresponding to the specific service data that is not classified as an abusing pattern among service data but is classified as highly likely to be abusing is newly created. It can be registered as an abusing pattern.

Specifically, when the pattern analysis server obtains learning service data including information about the abusing pattern from the service providing servers in the form of each reference vector, it can learn its parameters by referring to the learning service data. And, when the pattern analysis server obtains test service data from the service providing servers, it may generate abusing detection information corresponding to the test service data with reference to the learned parameters.

Through the method described so far, the service provider can check the corresponding abusing detection information by inputting their service data into the block chain network 200 .

In addition, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD-ROM, a DVD, and a magneto-optical medium such as a floppy disk. media), and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

In the above, the present invention has been described with specific matters such as specific components and limited embodiments and drawings, but these are provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , those of ordinary skill in the art to which the present invention pertains can make various modifications and variations from these descriptions.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments, and not only the claims described below, but also all modifications equivalently or equivalently to the claims described below belong to the scope of the spirit of the present invention. will do it

Claims (24)

In a method for detecting abusing based on a blockchain network,
(a) When service data generated from each service provided by each of the service providing servers is obtained, a specific block chain node among block chain nodes constituting the block chain network is registered in the distributed ledger of the block chain network. causing a smart contract to register the service data in the distributed ledger of the blockchain network; and
(b) the specific block chain node transmits the service data to the pattern analysis server to allow the pattern analysis server to analyze the patterns for each of the service data with reference to a preset pattern analysis standard to detect abusing generating detection information and registering the abusing detection information to other blockchain networks so that each of the service providing servers can check the abusing detection information;
How to include. According to claim 1,
In step (b),
The specific block chain node causes the pattern analysis server to assign each of the service data (i) a weight for each abusing pattern according to the abusing pattern, (ii) an abusing re-detection weight corresponding to the number of times that the specific abusing pattern is re-detected, and (iii) A method for generating the abusing detection information by applying a weight for each service period corresponding to the service provision period. 3. The method of claim 2,
In step (b),
The specific block chain node causes the pattern analysis server to generate the abusing detection information by applying the weight for each service period to each of the service data,
In a state where the specific block chain node causes the pattern analysis server to classify each service into a new service, a transient service, and a stable service based on each service start time, the first weight corresponding to the new service , A method characterized in that the abusing detection information is generated by additionally referring to a second weight corresponding to the transient service and a third weight corresponding to the stable service. According to claim 1,
In step (a),
The service data generated from the respective services provided by each of the service providing servers are obtained from a service provider API server,
In step (b),
The specific block chain node causes the pattern analysis server to register the abusing detection information to the other block chain network, thereby causing other smart contracts of the other block chain network to register the abusing detection information in the other block chain network. A method characterized in that by providing the other abusing detection transaction information corresponding to the service provider API server, each of the service providing servers can check the abusing detection information by referring to the other abusing detection transaction information. 5. The method of claim 4,
(c) Confirmation information corresponding to specific abusing detection information generated by a specific service providing server among the service providing servers - The confirmation information corresponds to a result of checking whether the specific abusing detection information corresponds to an abusing act - is obtained from the service provider API server, the specific blockchain node refers to the confirmation information corresponding to the specific abusing detection information, and the state information corresponding to the specific abusing detection information registered in the other blockchain network is updating or causing the pattern analysis server to update the state information registered in the other blockchain network with reference to the confirmation information;
Method, characterized in that it further comprises. 6. The method of claim 5,
The confirmation information is one of espionage information, false positive information, non-detection information, and whitelist information. 5. The method of claim 4,
In step (b),
The specific blockchain node causes the smart contract to acquire the abusing detection information registered in the other blockchain network through the Oracleize API server, and causes each of the service providing servers to run through the service provider API server. Method characterized in that it allows to check the abusing detection information. According to claim 1,
The service data includes at least a service code, an IP address, and a service use time,
The method of claiming that the abusing detection information includes at least abusing pattern information, blacklist information, and an abusing score. According to claim 1,
The block chain network and the other block chain network are a private block chain network and a public block chain network, respectively. According to claim 1,
In step (a),
The specific blockchain node causes the smart contract to hash the personal information included in the service data to register the service data hashed with the personal information to the distributed ledger,
In step (b),
Method characterized in that the specific block chain node transmits the service data on which the personal information is hashed to the pattern analysis server. According to claim 1,
In step (a),
The specific blockchain node causes the smart contract to transmit the service data to the address management server, causes the address management server to generate address values matching each of the service data, and sets the address values to the smart transmit to the contract, and cause the smart contract to match the service data and the address values, respectively, and register them in the distributed ledger of the blockchain network,
In step (b),
The specific block chain node transmits the service data and the address values to the pattern analysis server so that the pattern analysis server generates the abusing detection information corresponding to the service data and the address values how to do it According to claim 1,
The specific block chain node causes the pattern analysis server to analyze the service data through machine learning to detect a new abusing pattern, and to register a new detection rule corresponding to the new abusing pattern in the pattern analysis server How to characterize. In a specific blockchain node among blockchain nodes that detect abusing based on the blockchain network,
at least one memory storing instructions; and
at least one processor configured to execute the instructions;
The processor (1) When service data generated from each service provided by each of the service providing servers is obtained, the smart contract registered in the distributed ledger of the block chain network transmits the service data to the block chain network. A process of registering in the distributed ledger and (2) transmitting the service data to a pattern analysis server so that the pattern analysis server analyzes patterns for each of the service data with reference to a preset pattern analysis standard to detect abusing A specific block chain executing the instructions to generate abusing detection information by doing so and to register the abusing detection information to other blockchain networks to perform a process that allows each of the service providing servers to check the abusing detection information node. 14. The method of claim 13,
The processor is
In the process (2) above,
Let the pattern analysis server give each of the service data (i) a weight for each abusing pattern according to the abusing pattern, (ii) an abusing re-detection weight corresponding to the number of times re-detected with a specific abusing pattern, and (iii) a service provision period A specific block chain node, characterized in that it generates the abusing detection information by applying a weight for each corresponding service period. 15. The method of claim 14,
The processor is
In the process (2) above,
Let the pattern analysis server generate the abusing detection information by applying the weight for each service period to each of the service data, and cause the pattern analysis server to convert each service to a new service based on each service start time, The abusing detection information by additionally referring to a first weight corresponding to the new service, a second weight corresponding to the transient service, and a third weight corresponding to the stable service, in a state to classify the transient service and the stable service A specific blockchain node characterized by creating 14. The method of claim 13,
In the process (1) above,
The service data generated from the respective services provided by each of the service providing servers are obtained from a service provider API server,
The processor is
In the process (2) above,
By having the pattern analysis server register the abusing detection information in the other blockchain network, other smart contracts in the other blockchain network detect other abusing corresponding to the abusing detection information registered in the other blockchain network. A specific block chain node, characterized in that by providing transaction information to the service provider API server, each of the service providing servers can check the abusing detection information by referring to the other abusing detection transaction information. 17. The method of claim 16,
(3) Confirmation information corresponding to the specific abusing detection information generated by the specific service providing server among the service providing servers by the processor - The confirmation information is a result of checking whether the specific abusing detection information corresponds to an abusing act Corresponding to - When is obtained from the service provider API server, the status information corresponding to the specific abusing detection information registered in the other blockchain network is updated with reference to the confirmation information corresponding to the specific abusing detection information, or a process of causing the pattern analysis server to update the state information registered in the other block chain network with reference to the confirmation information;
A specific blockchain node, characterized in that it further comprises a. 18. The method of claim 17,
The confirmation information is a specific block chain node, characterized in that one of spy information, false positive information, false positive information, and whitelist information. 17. The method of claim 16,
The processor is
In the process (2) above,
Let the smart contract acquire the abusing detection information registered in the other blockchain network through the Oracleize API server, and allow each of the service providing servers to check the abusing detection information through the service provider API server A specific blockchain node characterized in that it allows. 14. The method of claim 13,
The service data includes at least a service code, an IP address, and a service use time,
The abusing detection information is a specific block chain node, characterized in that it includes at least abusing pattern information, blacklist information, and abusing score. 14. The method of claim 13,
A specific block chain node, characterized in that the block chain network and the other block chain networks are a private block chain network and a public block chain network, respectively. 14. The method of claim 13,
The processor is
In the process (1) above,
Let the smart contract hash the personal information included in the service data to register the service data hashed with the personal information in the distributed ledger,
In the process (2) above,
A specific block chain node, characterized in that it transmits the service data on which the personal information is hashed to the pattern analysis server. 14. The method of claim 13,
The processor is
In the process (1) above,
cause the smart contract to transmit the service data to the address management server, cause the address management server to generate address values matching each of the service data, and transmit the address values to the smart contract; make a smart contract match the service data and the address values, respectively, and register them in the distributed ledger of the blockchain network,
In the process (2) above,
A specific block chain node, characterized in that by transmitting the service data and the address values to the pattern analysis server, the pattern analysis server generates the abusing detection information corresponding to the service data and the address values. 14. The method of claim 13,
The processor causes the pattern analysis server to analyze the service data through machine learning to detect a new abusing pattern, and to register a new detection rule corresponding to the new abusing pattern in the pattern analysis server A specific blockchain node.

Images