KR20230075950A - Cloud service usage detection method based on image analysis and server performing the same - Google Patents

Abstract

A cloud service usage detection method based on image analysis, with improved detection accuracy, and a server for performing the same are disclosed. According to one of various embodiments of the present invention, the method for the cloud management server to detect usage of cloud services comprises the steps of: collecting network traffic transmitted and received by a user terminal managed by a company; extracting an analysis target address on a network connected to the user terminal and determining whether the extracted analysis target address is included in a management list; if the extracted analysis target address is not included in the management list, accessing the analysis target address and collecting at least one image provided from the analysis target address; and determining whether the analysis target address is an address related to provision of the cloud services by analyzing the collected images, and if the analysis target address is an address related to provision of the cloud services, determining a name or type of the provided cloud service.

Description

Cloud service usage detection method based on image analysis and server performing the same

Various embodiments of the present invention relate to a technique for detecting and analyzing whether a cloud service is used based on image analysis.

The development of cloud services is accelerating due to the development of communication technology. In the past, data storage, calculation, information processing, information creation, etc. were mainly performed in a personal computer, but now, various computer resources exist on the Internet cloud, so you can use a device that can connect the cloud and network to conveniently access desired computer resources. can make use of it.

As such, even if the performance of the personal device is not excellent, the cloud service can provide as many resources as desired through the cloud service, so it has excellent cost-effectiveness compared to the centralized operating environment. It is easy to adjust the resources to be used according to the number of users, so it is economical and scalable.

Cloud services can be largely classified into SaaS (Soft as a Service), Paas (Platform as a Service), and IaaS (Infrastructure as a Service). SaaS is a service that provides users with software owned by a cloud service provider through a web browser or application, while PaaS is a service that provides IT developers with hardware and software construction environments necessary for development to users. IaaS is a service that provides infrastructure such as hardware servers, networks, storage devices, and power required to operate servers in a virtual environment.

It is important for companies to properly understand the cloud services used by members of the company. When a member of a company uses a cloud service with an unauthorized account, copyright infringement of software may occur and vulnerabilities may occur in terms of data security of the company. In addition, companies can efficiently adjust the function and scale of cloud services only when they accurately identify which cloud services are used by members of the company and to what extent.

Korean Patent Registration No. 10-2045844

An object of various embodiments of the present invention is to detect a cloud service used by a user of an enterprise based on image analysis.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

According to one of various embodiments of the present invention for solving the above problems, a method for a cloud management server to detect use of a cloud service includes collecting network traffic transmitted and received by a user terminal managed by a company; extracting an analysis target address on a network accessed by the user terminal and determining whether the extracted analysis target address is included in a management list; accessing the analysis target address and collecting at least one image provided from the analysis target address when the extracted analysis target address is not included in a management list; and determining whether the analysis target address is an address related to cloud service provision through analysis of the collected image, and if the analysis target address is an address related to cloud service provision, the name or type of cloud service provided It may be configured to include the step of performing the determination.

The image collection step may include additionally collecting images by receiving a captured image of a screen displayed on a display unit of the user terminal from the user terminal.

The step of determining whether the address to be analyzed is an address related to the provision of a cloud service through analysis of the collected image is determined based on data collected through an Internet search for text or part of the image extracted from the collected image. It may be characterized in that this is performed.

An Internet search for text or part of an image extracted from the collected images may include a search on at least one social media service.

The cloud service use detection method of the cloud management server may include capturing an analysis target address to which a predetermined number or more user terminals commonly access; Transmitting a notification of whether the analysis target address is included in a management list to a manager terminal; and receiving information on whether the address to be analyzed is included in a management list from the manager terminal and including the address to be analyzed in the management list based on the received information.

The cloud service usage detection method of the cloud management server may further include recording an amount of traffic transmitted/received by the user terminal by accessing the analysis target address.

The step of determining whether the analysis target address is an address related to cloud service provision through analysis of the collected images is performed by performing image analysis by the cloud management server in a state learned through machine learning technology to analyze the target address It may be characterized in that the determination of whether is related to the cloud service provision is performed.

The cloud management server may be characterized in continuously improving the performance of determining a part including a logo in an image to be analyzed through learning of machine learning technology.

The cloud management server may be characterized in continuously improving the performance of determining a portion including text as a feature in an image to be analyzed through learning of machine learning technology.

According to another one of various embodiments of the present invention, a cloud management server for detecting use of a cloud service includes a traffic collection unit that collects network traffic transmitted and received by a user terminal managed by a company; an address manager extracting an analysis target address on a network accessed by the user terminal and determining whether the extracted analysis target address is included in a management list; an image collecting unit that accesses the analysis target address and collects at least one image provided from the analysis target address when the extracted analysis target address is not included in the management list; and determining whether the analysis target address is an address related to cloud service provision through analysis of the collected image, and if the analysis target address is an address related to cloud service provision, the name or type of cloud service provided It may include a cloud service determining unit that performs the determination.

According to an embodiment of the present invention, cloud service detection is performed based on an image analysis technique, so that cloud service detection accuracy can be improved. Also, avoidance of cloud service detection due to data manipulation can be prevented.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a schematic diagram of an environment in which a cloud management platform according to an embodiment of the present invention operates.
2 is a block diagram schematically showing the configuration of a cloud management server according to an embodiment of the present invention.
3 is a flowchart illustrating an operating method of a cloud management platform according to an embodiment of the present invention.
4 is an exemplary diagram for explaining a method of performing analysis on collected images by a cloud management server according to an embodiment of the present invention.

Terminology used herein is for describing the embodiments and is not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used herein, "comprises" and/or "comprising" does not exclude the presence or addition of one or more other elements other than the recited elements. Like reference numerals throughout the specification refer to like elements, and “and/or” includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various components, these components are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first element mentioned below may also be the second element within the technical spirit of the present invention.

When it is said that a certain part "includes" a certain component throughout the specification, it means that it may further include other components without excluding other components unless otherwise stated. In addition, terms such as "...unit" and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. .

The 'cloud service' referred to in this specification is not limited to any one of various cloud services such as SaaS, PaaS, and IaaS. However, for convenience of explanation, the description will be performed by taking SaaS as a main example in the following specification.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a schematic diagram of an environment in which a cloud management platform 10 according to an embodiment of the present invention operates.

Referring to FIG. 1, a cloud management platform according to an embodiment of the present invention includes a cloud management server 100, a user terminal 200, an administrator terminal 300, and an external server 400. can operate in the environment.

The cloud management server 100 is a server managed by a company, and the company may provide cloud services to users belonging to the company and perform management thereof through the cloud management server 100 .

The cloud management server 100 manages a plurality of user terminals 200 to utilize various types of cloud services, and can perform license management of each cloud service accordingly.

The cloud management server 100 analyzes the degree to which each of the plurality of user terminals 200 utilizes the cloud service through functions used in the corresponding cloud service, usage time, traffic, etc., and manages the efficiency of providing the cloud service from an overall perspective. can do.

The cloud management server 100 may determine information about which cloud service the corresponding terminal uses and whether an unauthorized cloud service is accessed through an address on a network to which the user terminal 200 accesses.

Hereinafter, in this specification, an address on a network to which the user terminal 200 accesses will be referred to as an 'analysis target address'. The cloud management server 100 may collect images related to the address to be analyzed and detect use of the cloud service by the user terminals 200 through analysis of the images.

The user terminal 200 is a terminal controlled by users belonging to a company that manages the cloud management platform 10 of the present invention, and the user utilizes software such as a web browser or application installed on the user terminal 200 Cloud services are available.

A management program or management application provided by the company is installed on the user terminal 200, and information on the operation of the user terminal 200 may be collected and transmitted to the cloud management server 100, and in a specific situation, the user terminal The operation of 200 may be controlled by the cloud management server 100 .

The manager terminal 300 is a terminal controlled by a manager belonging to a company that manages the cloud management platform 10 of the present invention, and the manager accesses the cloud management server 100 through the manager terminal 300 to manage the cloud management server. Various setting values of (100) can be adjusted.

In addition, the manager may receive various notifications (eg, emergency notification, etc.) transmitted from the cloud management server 100 through the manager terminal 300 and take actions accordingly.

The user terminal 200 and the manager terminal 300 may include a memory for storing information necessary for operation, a central processing unit such as a CPU for performing various operations required for operation, and an input/output device.

The user terminal 200 and the administrator terminal 300 are all types of hands that can be connected to a web server through a network, such as a mobile phone, a smart phone, a personal digital assistant (PDA), a portable multimedia player (PMP), a tablet PC, and the like. It may include a handheld-based wireless communication device, and has a memory means such as a personal computer (eg, a desktop computer, a notebook computer, etc.), a workstation, a web pad, etc., and is equipped with a microprocessor to provide computing power. It could be one of your digital devices.

The external server 400 is a server that provides data necessary for the smooth operation of the cloud management server 100. According to an embodiment, the external server 400 is a server that provides various cloud services accessed by users, a search engine It may be configured with a portal server that provides a server or a server that provides various social media services (SNS).

According to an embodiment of the present invention, a communication network used by entities operating within the operating environment of the cloud management platform 10 to communicate may be configured regardless of its communication mode, such as wired and wireless. For example, For example, it may be implemented in various communication networks such as a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN). Preferably, the communication network according to an embodiment of the present invention may be a well-known World Wide Web (WWW) or the like.

2 is a block diagram schematically showing the configuration of the cloud management server 100 according to an embodiment of the present invention.

Referring to FIG. 2 , the cloud management server 100 includes a traffic collection unit 110, an address management unit 120, an image collection unit 130, a cloud service determination unit 140, a machine learning execution unit 150, a search It may be configured to include a performing unit 160, a communication unit 170, a storage unit 180 and a control unit 190.

The traffic collecting unit 110 may collect network traffic transmitted and received by the user terminal 200 for at least one user terminal 200 managed by a company.

According to an embodiment, such network traffic collection may be performed only when the user terminal 200 utilizes a network provided by the company (eg, in-house LAN or in-house Wifi), but with the consent of the user. It may be performed during a specific time period, such as business hours, or it may be performed regardless of the type or time of the network used.

The traffic collection unit 110 may record the amount of network traffic transmitted and received by the user terminal 200 by accessing a specific network address. As such, information on the amount of traffic collected for each user can be used to analyze what type of cloud service each user uses and how much.

The address management unit 120 may extract an analysis target address on a network to which the user terminal 200 accesses, and determine whether the extracted analysis target address is included in the management list.

The management list managed by the address management unit 120 may be a concept including various types of lists. According to one embodiment, the management list may include an authorization list, other safe lists, and black lists. In this specification, the management list is exemplified as including the aforementioned three lists, but the number and type of lists included in the management list are not limited thereto.

The authorization list may be a list composed of a set of network addresses of places recognized as safe by a company among network addresses providing cloud services.

The other safety list may be a list composed of a set of network addresses of places recognized as safe by a company, but not related to the provision of cloud services.

The black list may be a list composed of a set of network addresses of sites determined to be unsafe by the company.

When the analysis target address to which the user terminal 200 accesses is included in the management list, the cloud management server 100 may collect information about network use of the corresponding user terminal 200 .

According to an embodiment, the address manager 120 captures an analysis target address to which a predetermined number or more user terminals 200 commonly access, and notifies the manager terminal 300 of the corresponding analysis target address. can transmit The manager can receive and confirm the corresponding notification through the manager terminal 300, and accordingly can determine whether to include the corresponding analysis target address in the management list and in which detailed list within the management list. When the manager transmits information on whether to include the corresponding analysis target address in the management list to the cloud management server 100 through the manager terminal 300, the address management unit 120 receives the information and receives the corresponding analysis target address. can be included in the management list.

According to one embodiment, when the administrator includes the analysis target address in the management list, the analysis target address is included in any one of the authorization list, other safety list, and black list in the management list based on the service provided by the analysis target address. can determine whether

When the analysis target address extracted by the address management unit 120 is not included in the management list, the image collection unit 130 accesses the corresponding analysis target address and collects at least one image provided from the accessed address. can

The image collection unit 130 may access the address to be analyzed and collect images provided from the address, but otherwise capture the screen displayed on the display unit of the user terminal 200 operating by accessing the address. Additional collection of images may be performed by receiving images from the user terminal 200 .

According to an embodiment, the capture timing of the display unit screen of the user terminal 200 may be determined by the control of the user terminal 200 performed by the cloud management server 100. In contrast, the cloud management server When (100) recognizes that the user terminal 200 accesses an analysis target address not included in the management list and instructs the user terminal 200 for screen capture and transmission, installed on the user terminal 200 A capture timing for a screen displayed on the display unit may be determined through software such as a company's management program or management application.

According to an embodiment, when the user terminal 200 captures the screen of the display unit, the period of capture may be determined in various ways. That is, capturing may be performed while the user terminal 200 is accessing an analysis target address that is not included in the management list managed by the address management unit 120 of the cloud management server 100, and is accessing the address. During this period, the capture cycle may be determined in various ways. For example, the capture of the screen of the display unit of the user terminal 200 may be performed at regular time intervals. In contrast, the capture of the screen of the display unit of the user terminal 200 may be performed every time a change of a certain degree or more occurs. there is.

The cloud service determination unit 140 may determine whether the analysis target address from which the corresponding image is collected is an address related to the provision of the cloud service through analysis of the image collected by the image collection unit 130, and the analysis target If the address is an address that is related to the provision of a cloud service, the name or type of the cloud service provided through the corresponding address may be determined.

The cloud service determination unit 140 extracts text or part of the image from the collected image and extracts the extracted text in the process of determining whether a specific analysis target address is an address related to the provision of the cloud service through analysis of the collected image. Or, by collecting data by performing an internet search on a part of the image, based on the collected search data, it is determined whether or not the corresponding cloud service is an address related to the provision of cloud services, and if so, the name or type of the corresponding cloud service. determination can be made.

In this process, an Internet search utilizing text or a part of the image extracted from the collected images may be performed through the search execution unit 160 to be described later.

The machine learning performer 150 determines whether the address to be analyzed is related to the provision of a cloud service through the analysis of the image collected by the cloud service determiner 140, and determines the name or type of the cloud service provided at the address. In the process of performing the determination for , machine learning (Machine Learning) technology may be utilized.

In detail, the machine learning execution unit 150 may perform learning based on data collected by the image collection unit 130 or data for learning input by an administrator, and accordingly, the analysis target address is a cloud service The performance of determining whether the address is related to the service and the performance of determining the name or type of the cloud service provided at the corresponding address may be continuously improved.

According to an embodiment, machine learning performed by the machine learning performer 150 may be performed using a known machine learning algorithm, or may be performed in a deep learning method.

According to an embodiment of the present invention, performance of determining a portion including a logo in an image to be analyzed may be improved by learning performed by the machine learning unit 150 .

In the process of determining the address to be analyzed through the analysis of the collected images, the cloud service determination unit 140 determines whether the address to be analyzed is related to the provision of the cloud service through the logo included in the image, or the analysis It is possible to determine the name or type of cloud service provided by the target address, and performance for logo determination can be improved by machine learning.

According to an embodiment of the present invention, performance of determining a portion including text as a feature in an image to be analyzed may be improved by learning performed by the machine learning performer 150 .

The cloud service determination unit 140 determines whether the corresponding address to be analyzed is related to the provision of a cloud service or the name of the cloud service provided by the corresponding address to be analyzed by determining a part of the collected image in which the characteristic text is included. Alternatively, the type may be determined. Text displayed in a color and size that is distinguished from general text on an image is highly likely to be usefully used to determine the service provided at the address to be analyzed. The text discrimination performance of the cloud service determiner 140 may be improved by the machine learning performer 150 .

The search performer 160 may be in charge of and perform an Internet search during the process of performing an Internet search for text or a part of the image extracted from the collected image by the cloud service determiner 140 .

The search performer 160 may perform text search or image search by using search engines provided from various portal sites, etc., and according to an embodiment, text search on various types of social media services (SNS). Or you can do an image search.

The communication unit 170 enables the cloud management server 100 to communicate with the user terminal 200 , the manager terminal 300 and the external server 400 . The communication network used by the communication unit 170 to perform communication may be configured regardless of its communication mode, such as wired and wireless, for example, a local area network (LAN) and a metropolitan area network (MAN). Area Network), wide area network (WAN), etc. may be implemented in various communication networks.

The storage unit 180 serves to store information collected, generated, and processed in various components of the cloud management server 100 . That is, the storage unit 180 may store user information, manager information, information about a management list, collected images, learning data used for machine learning, information about a machine learning algorithm, and the like. The storage unit 180 may include, for example, a memory, a cache, a buffer, and the like, and may be composed of software, firmware, hardware, or a combination of at least two or more of these.

The control unit 190 includes a traffic collection unit 110, an address management unit 120, an image collection unit 130, a cloud service determination unit 140, a machine learning execution unit 150, a search execution unit 160, a communication unit ( 170) and the storage unit 180 may play a role of controlling data flow. That is, the control unit 190 according to an embodiment of the present invention includes the traffic collection unit 110, the address management unit 120, the image collection unit 130, the cloud service determination unit 140, and the machine learning execution unit 150. , The search unit 160, the communication unit 170, and the storage unit 180 can be controlled to perform unique roles.

In FIG. 2 , the traffic collection unit 110, the address management unit 120, the image collection unit 130, the cloud service determination unit 140, the machine learning unit 150, and the search unit 160 are controlled by the control unit 190. Since it is a functionally classified configuration, it may be integrated and configured as one control unit 190.

3 is a flowchart illustrating an operating method of the cloud management platform 10 according to an embodiment of the present invention.

Referring to FIG. 3, the cloud management server 100 collects network traffic transmitted and received by the user terminal 200 (S310), and sets the address to which the user terminal 200 accesses as an analysis target address on the network. It can be extracted (S320).

Thereafter, the cloud management server 100 may determine whether the extracted address to be analyzed is included in the management list (S330), and according to the determination result (S340), if the address to be analyzed is included in the management list It is possible to record the traffic generated from communication with the corresponding address (S350). The management list may be classified into an authorization list, other safety list, and black list, and the cloud management server 100 may perform different operations depending on which list in the management list includes the corresponding address to be analyzed. For example, when the user terminal 200 tries to access a network address corresponding to a blacklist, it may warn or block access to the network address, and may transmit a notification to the administrator terminal 300.

If it is determined in step S340 that the address to be analyzed is not included in the management list, the cloud management server 100 may collect images for the address to be analyzed (S360).

As described above, image collection performed by the cloud management server 100 may be performed in such a way that the cloud management server 100 accesses a corresponding analysis target address and collects images provided from the accessed address. Unlike this, additional collection of images may be performed by receiving from the user terminal 200 a captured image of a screen displayed on the display unit of the user terminal 200 that is operating by accessing the corresponding address to be analyzed. .

After the image collection is completed, the cloud management server 100 may determine whether the analysis target address from which the image is collected is an address related to the cloud service provision through analysis of the collected image, and the analysis target address If the address is related to the cloud service provision, the name or type of the cloud service provided through the corresponding address may be determined (S370). According to an embodiment, the cloud management server 100 may include the corresponding analysis target address in the management list based on the image analysis result, and the corresponding analysis target address may be included in the authorization list, other safety list, and black list in the management list. You can also decide which of the lists should be included. In the process of including the address to be analyzed in the management list, confirmation by the manager may be required, and the cloud management server 100 determines whether to include the address to be analyzed from the manager terminal 300 in the management list, the authorization list, and other information. The address to be analyzed may be included in the management list by receiving information on whether to be included in a safe list or a black list.

After the cloud management server 100 determines what kind of service the analysis target address provides, as in step S350, the user terminal 200 may record the amount of network traffic transmitted and received by accessing the corresponding address. there is.

4 is an exemplary diagram for explaining a method of performing analysis on collected images by the cloud management server 100 according to an embodiment of the present invention.

As described above, the cloud management server 100 may access the analysis target address, collect images provided from the accessed address, and display the images on the display unit of the user terminal 200 operating by accessing the analysis target address. A captured image for the screen may be received from the user terminal 200 .

Assuming that the collected image is a screen displayed inside the user terminal 200 of FIG. 4 , the cloud management server 100 may determine the logo S410 included in the image to be analyzed, and additionally analyzed. A portion ( S420 ) in which text as a feature is included in the target image may be determined.

In FIG. 4 , an umbrella-shaped picture may be determined as a logo, and a text portion written as 'UMBRELLA' may be determined as a feature text on a corresponding image.

According to an embodiment of the present invention, machine learning technology may be used in the process of determining the logo and the characteristic text portion through image analysis.

The cloud management server 100 performs an Internet search for the identified logo and the characteristic text portion to determine whether the analysis target address is an address related to cloud service provision, and the cloud service provided by the analysis target address. It is possible to perform discrimination on the name or type of.

As such, according to various embodiments of the present disclosure, cloud service use detection of users based on image analysis may be performed. The accuracy of such image analysis can be continuously improved according to learning through machine learning. According to an embodiment of the present invention, an attempt to evade detection of the use of a cloud service through manipulation of data can greatly increase the degree of difficulty in avoiding since a transmitted/received image must also be newly created and manipulated.

Steps of a method or algorithm described in connection with an embodiment of the present invention may be implemented directly in hardware, implemented in a software module executed by hardware, or implemented by a combination thereof. A software module may include random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, CD-ROM, or It may reside in any form of computer readable recording medium well known in the art to which the present invention pertains.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features of the present invention. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

10: Cloud management platform
100: cloud management server
200: user terminal
300: manager terminal
400: external server

Claims (10)

In the method for the cloud management server to detect the use of cloud services,
Collecting network traffic transmitted and received by user terminals managed by the enterprise;
extracting an analysis target address on a network accessed by the user terminal and determining whether the extracted analysis target address is included in a management list;
accessing the analysis target address and collecting at least one image provided from the analysis target address when the extracted analysis target address is not included in a management list; and
Through analysis of the collected images, it is determined whether the analysis target address is an address related to cloud service provision, and if the analysis target address is an address related to cloud service provision, the name or type of provided cloud service is determined. A method for detecting use of a cloud service by a cloud management server, comprising the step of performing a.
According to claim 1,
The image collection step,
A method for detecting use of a cloud service of a cloud management server, characterized in that by receiving a captured image of a screen displayed on a display unit of the user terminal from the user terminal and additionally collecting the image.
According to claim 1,
The step of determining whether the address to be analyzed is an address related to the provision of cloud services through analysis of the collected images,
A method for detecting use of a cloud service by a cloud management server, characterized in that the determination is performed based on data collected through an Internet search for text or part of the image extracted from the collected image.
According to claim 3,
Internet search for text or parts of images extracted from collected images,
A method of detecting use of a cloud service by a cloud management server, comprising a search on at least one social media service.
According to claim 1,
capturing an analysis target address to which a predetermined number or more user terminals commonly access;
Transmitting a notification of whether the analysis target address is included in a management list to a manager terminal; and
A method for detecting use of a cloud service by a cloud management server, further comprising receiving information on whether the address to be analyzed is included in a management list from the manager terminal and including the address to be analyzed in the management list based on the received information. .
According to claim 1,
The method of detecting use of a cloud service of a cloud management server, further comprising the step of recording the amount of traffic transmitted and received by the user terminal by accessing the analysis target address.
According to claim 1,
The step of determining whether the address to be analyzed is an address related to the provision of cloud services through analysis of the collected images,
Characterized in that image analysis is performed by the cloud management server in a state learned through machine learning technology to determine whether the analysis target address is related to cloud service provision, characterized in that, cloud service use detection of the cloud management server method.
According to claim 7,
Characterized in that the cloud management server continuously improves the performance of determining the part containing the logo in the image to be analyzed through learning of machine learning technology, cloud service use detection method of the cloud management server.
According to claim 7,
Characterized in that the cloud management server continuously improves the performance of determining a part containing text as a feature in an image to be analyzed through learning of machine learning technology, cloud service usage detection method of a cloud management server.
In the cloud management server for detecting the use of cloud services,
a traffic collecting unit that collects network traffic transmitted and received by user terminals managed by the enterprise;
an address manager extracting an analysis target address on a network accessed by the user terminal and determining whether the extracted analysis target address is included in a management list;
an image collecting unit that accesses the analysis target address and collects at least one image provided from the analysis target address when the extracted analysis target address is not included in the management list; and
Through the analysis of the collected images, it is determined whether the analysis target address is an address related to cloud service provision, and if the analysis target address is an address related to cloud service provision, the name or type of provided cloud service is determined. Comprising a cloud service determination unit to perform, the cloud management server.

Images