KR102552330B1 - System and Method for detecting malicious internet address using search engine - Google Patents

Abstract

Disclosed is a malicious Internet address detection system using a search engine capable of preventing user damage by identifying malicious Internet addresses used for attacks such as phishing, smishing, and pharming. The malicious Internet address detection system includes a database for storing message information, a management server providing the message information and equipped with a search engine, and an Internet address linked to the message information and connected to the management server through a communication network. and a terminal that determines whether the Internet address is malicious or not by using the number of search results calculated by applying ? as a search word to the search engine.

Description

System and Method for detecting malicious internet address using search engine}

The present invention relates to a malicious Internet address detection technology, and more particularly, to a malicious Internet address detection system and method using a portal site search engine.

As the Internet of Things (IoT) technology develops, it is developing into a hyper-connected society in which everything in real life is organically connected. Accordingly, the importance of security issues is being emphasized, and among them, malicious attacks using malicious URLs (Uniform Resource Locators) are emerging as a social problem. Malicious URLs are used to steal user information by using URLs with malicious purposes such as smishing, parsing, and phishing.

Phishing is a compound word of private data and fishing, and is an attack that induces users to enter personal information themselves. Smishing is a compound word of SMS (Short Messaging System) and phishing, and is an attack that steals user information and maliciously uses it by sending a text message containing a malicious URL to communication terminal users.

Pharming is an attack that steals user information by infecting a user's PC (Personal Computer) with malicious code and then inducing access to a malicious URL. What these attacks have in common is that they are induced to an abnormal Internet site by e-mail, text message, or malicious code on a PC, and then steal necessary information and use it maliciously.

In order to prevent this, do not indiscriminately click on URL addresses included in personal messages (e-mails, text messages, SNS, etc.), and if it is impossible to verify the sender and information on the URL, delete or report it immediately. In addition, there are ways to use and update basic anti-spam programs and vaccine programs to the latest version.

However, these existing prevention methods create malicious URLs that look very similar to normal URL addresses (e.g. nate.com to natte.com, amazon.com to amizon.com), 'win an event', 'account hack', or 'contract'. It is very difficult to prevent in advance by inducing access to content that users are interested in, such as '. A diagram illustrating this is shown in FIG. 1 . That is, FIG. 1 is an example of distribution of malicious Internet addresses (especially URLs).

To solve this problem, users can check unclear URLs by using services such as 'PhishTank.com', which aims to check whether the site address is normal or not, where users submit proof of phishing suspicion and check whether it is phishing or not by voting. However, accuracy is poor because of the human opinion on the attack involved.

In addition, although there is a method of blocking malicious keywords through a blacklist, it is almost impossible to block all malicious keywords because countless new malicious keywords are generated.

In other words, the problem of low accuracy or convenience when a person directly determines the URL address of a malicious site and the problem of insufficient response to new malicious URLs that increase exponentially have not been solved.

1. Korea Patent Registration No. 10-1724307 (registration date: April 3, 2017)

In order to achieve the object presented above, the present invention provides a system and method for detecting malicious Internet addresses using a search engine capable of preventing user damage by identifying malicious Internet addresses used for attacks such as phishing, smishing, and pharming. Its purpose is to provide

In addition, the present invention automatically searches through a search engine for Internet addresses linked to e-mail, text messages, and SNS (Social Network Service), and utilizes the number (Count) of matching search results to detect malicious information of the searched Internet address. Another object is to provide a malicious Internet address detection system and method capable of determining whether

In order to achieve the object presented above, the present invention provides a malicious Internet address detection system using a search engine that can prevent user damage by identifying malicious Internet addresses used for attacks such as phishing, smishing, and pharming. .

The malicious internet address detection system,

database for storing message information;

a management server providing the message information and equipped with a search engine; and

A terminal that is communicatively connected to the management server through a communication network and determines whether the Internet address is malicious by using the number of search results calculated by applying the Internet address linked to the message information as a search word to the search engine. It is characterized by doing.

In addition, the message information is characterized in that any one of e-mail, text, and SNS (Social Networking Service).

In addition, the terminal may include a search module extracting the Internet address from the body of the message information and performing a search by applying the search word for the Internet address to the search engine; an analysis module counting the number of search results generated as a result of the execution of the search; and a determination module for determining whether the Internet address is malicious by using the number of search results.

In addition, the search module is characterized in that it executes a search for a normal Internet address related to the Internet address and a search for an abnormal Internet address not related to the Internet address.

In addition, the determination module determines whether the number of first search results is greater than a first reference value based on the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. and as a result of the determination, if the number of first search results is greater than the first reference value, the Internet address is determined to be a normal Internet address, and if the number of first search results is less than the first reference value, the Internet It is characterized in that the address is determined as an abnormal Internet address.

In addition, the determination module may block access if the Internet address is determined to be the abnormal Internet address.

In addition, the determination module is characterized in that if the Internet address is determined to be the normal Internet address, normal service is maintained.

In addition, the first reference value is characterized in that the maximum value of the number of second search results.

The determination module determines the number of first search results and the number of second search results based on the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. It is determined whether the difference value of is greater than a preset second reference value, and as a result of the determination, if the difference value is greater than the second reference value, the Internet address is determined as a normal Internet address, and the difference value is greater than the second reference value. If it is small, the Internet address is determined as an abnormal Internet address.

Also, the Internet address is characterized in that it is a URL (Uniform Resource Locator).

On the other hand, another embodiment of the present invention, a database for storing message information; a management server provided with a search engine that provides the message information and has a function of automatically converting a second search word similar to the first search word; and a communication connection to the management server through a communication network, and using the number of search results calculated by applying the Internet address linked to the message information to the search engine as the first search word and the second search word, It provides a malicious internet address detection system using a search engine including;

At this time, the terminal may include: a search module extracting the Internet address from the body of the message information and performing a search by applying the first search word for the Internet address to the search engine; an analysis module counting the number of search results generated as a result of executing a search by the first search word and the second search word; and a determination module for determining whether the Internet address is malicious by using the number of search results.

In addition, the first search word is applied to search for normal internet addresses related to the internet address, and the second search word is applied to search for abnormal internet addresses not related to the internet address.

On the other hand, another embodiment of the present invention, (a) message information is stored in a database; (b) providing the message information to the terminal by a management server connected to the terminal through a communication network and equipped with a search engine; and (c) determining whether the Internet address is malicious by using the number of search results calculated by applying the Internet address linked to the message information to the search engine as a search term, by the terminal. A method for detecting malicious Internet addresses using a search engine is provided.

In this case, the step (c) is: (c-1) a step in which the search module extracts the Internet address from the content of the body of the message information and executes a search by applying the search term for the Internet address to the search engine; ; (c-2) counting, by an analysis module, the number of search results generated as a result of the search being executed; and (c-3) a determination module determining whether the Internet address is malicious using the number of search results.

Further, the step (c-1) may include the step of the search module executing a normal Internet address search related to the Internet address and an abnormal Internet address unrelated to the Internet address.

In addition, in step (c-3), (c-3-1) the determination module determines the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. determining whether the number of first search results is greater than a first reference value based on the number of first search results; (c-3-2) as a result of the determination, if the number of first search results is greater than the first reference value, determining, by the determination module, the Internet address as a normal Internet address; and (c-3-3) if the number of first search results is less than the first reference value as a result of the determination, determining, by the determination module, the Internet address as an abnormal Internet address. do.

On the other hand, another embodiment of the present invention, (a) storing the message information in the database; (b) providing the message information to the terminal by a management server connected to the terminal through a communication network and equipped with a search engine capable of automatically converting a second search word similar to the first search word; (c) determining whether the Internet address is malicious by using the number of search results calculated by applying the Internet address linked to the message information to the search engine as the first search word and the second search word; Provides a malicious Internet address detection method using a search engine including ;.

In addition, in step (c), (c-1) the search module extracts the Internet address from the body of the message information and applies the first search term for the Internet address to the search engine to perform a search. doing; (c-2) counting, by an analysis module, the number of search results generated as a result of performing a search based on the first search word and the second search word; and (c-3) a determination module determining whether the Internet address is malicious using the number of search results.

According to the present invention, malicious Internet addresses can be detected more accurately and efficiently than human judgment.

In addition, another effect of the present invention is to detect and respond to new malicious Internet addresses more effectively than before, by automatically discriminating normal/abnormal Internet addresses based on the number of search results (count) matching the search Internet address using a search engine. For example, it is possible to detect and/or block an attack using a malicious Internet address by finding out an Internet address in advance.

1 is an example of distribution of a common malicious internet address.
2 is a block diagram of a malicious Internet address detection system using a search engine according to an embodiment of the present invention.
FIG. 3 is a detailed block diagram of the terminal shown in FIG. 2 .
4 is a flowchart illustrating a process of blocking an abnormal Internet address using a search engine according to an embodiment of the present invention.
5 is a diagram showing a comparison result of the number of search results in which normal Internet addresses and abnormal Internet addresses searched according to an embodiment of the present invention match each other.
6 is an example of a normal internet address and an abnormal internet address search screen.
FIG. 7 is an example of a screen showing the number of search results matching normal and abnormal Internet addresses searched according to FIG. 6 .
8 is an example of a screen showing an automatic transformation screen of a search word and search result lengths of normal and abnormal Internet addresses according to an embodiment of the present invention.
9 is an example of a screen showing the number of search results matching a normal Internet address according to an embodiment of the present invention.
10 is a diagram showing the number of search results matching an abnormal Internet address and an automatic transformation screen of a search word according to an embodiment of the present invention.

Advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, only the present embodiments make the disclosure of the present invention complete, and those skilled in the art in the art to which the present invention belongs It is provided to fully inform the person of the scope of the invention, and the invention is only defined by the scope of the claims. The sizes and relative sizes of components shown in the drawings may be exaggerated for clarity of explanation.

Like reference numbers throughout the specification indicate like elements, and “and/or” includes each and every combination of one or more of the recited items.

Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. The referenced elements, steps, operations and/or elements that “comprise” and/or “comprise” as used in the specification do not exclude the presence or addition of one or more other elements, steps, operations and/or elements. .

Although used to describe various components such as first and second, these components are not limited to these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may also be the second component within the technical spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

2 is a block diagram of a malicious Internet address detection system 200 using a search engine according to an embodiment of the present invention. Referring to FIG. 2, a database 210 for storing message information, a management server 220 for providing message information, and Internet addresses linked to message information are searched to determine whether an Internet address is malicious by using the number of search results. It may be configured to include a terminal 240 that determines, a communication network 230 that connects the management server 220 and the terminal 240 through communication, and the like.

The message information may be e-mail, text message, SNS (Social Networking Service), and the like. These message information may include internet addresses. An Internet address may be a URL (Uniform Resource Locator).

The database 210 performs a function of storing message information. The database 210 may be configured in the management server 220 or may be configured as a separate database server.

The management server 220 functions to receive message information and store it in the database 210 or transmit message information stored in the database 210 to the user's terminal 240 . In addition, a search engine 221 is configured in the management server 220 .

Search engine 221 is an information retrieval system designed to help find information stored in a computer system. These search results are usually presented as a list. For example, when a query word "Yahoo" is received from a user, since URLs "http://kryahoocom/" and "http://wwwyahoocokr" are assigned to the website "Yahoo", the management server exposes a website called "Yahoo" in search results.

This search engine 221 is composed of a program having an algorithm that searches the database 210 according to a query and outputs the result after the search.

The communication network 230 means a connection structure capable of exchanging information between each node, such as a plurality of terminals and servers, such as a public switched telephone network (PSTN), a public switched data network (PSDN), and an integrated information communication network (ISDN: Integrated Services Digital Networks), Broadband ISDN (BISDN), Local Area Network (LAN), Metropolitan Area Network (MAN), Wide LAN (WLAN), etc. However, the present invention is not limited thereto, and the wireless communication network CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), Wibro (Wireless Broadband), WiFi (Wireless Fidelity), HSDPA (High Speed Downlink) A packet access) network, a Bluetooth network, a near field communication (NFC) network, a satellite broadcasting network, an analog broadcasting network, a digital multimedia broadcasting (DMB) network, and the like. Alternatively, it may be a combination of these wired communication networks and wireless communication networks.

The terminal 240 receives message information through the communication network 230 . In addition, it performs a function of executing a search with an Internet address in the received message information and a function of displaying a search result. Accordingly, the terminal 240 is a mobile phone, a smart phone, a laptop computer, a digital broadcasting terminal, a PDA (Personal Digital Assistants), a PMP (Portable Multimedia Player), a navigation device, a personal computer, and the like. This can be.

FIG. 3 is a detailed block diagram of the terminal 240 shown in FIG. 2 . Referring to FIG. 3, the terminal 240 receives message information 310, extracts an Internet address linked to the message information 310, and uses the search engine 221 provided in the management server 210 to A search module 320 that searches Internet addresses, an analysis module 330 that counts the number of search results of executed Internet addresses, and a determination module 340 that determines whether an Internet address is malicious by using the number of search results. ) and the like.

The message information 310 may be e-mail 311, text message 312, SNS (Social Networking Service) 313, and the like. SNS (Social Networking Service) 313 may be Facebook, Twitter, Line, and the like.

When a corresponding site is searched using the search engine 221 provided by the management server 220 such as Google or Naver, the number of matches between normal Internet address/abnormal Internet address and the search result is different. This is because, in general, in the case of a normal Internet address, there are many serviced data, so there are many search results for the corresponding search keyword, but in the case of an abnormal Internet address, there are few search results because it is rarely actually serviced.

The search module 320, analysis module 330, and decision module 340 shown in FIG. 3 refer to units that process at least one function or operation, and may be implemented in software and/or hardware. In hardware implementation, ASIC (application specific integrated circuit), DSP (digital signal processing), PLD (programmable logic device), FPGA (field programmable gate array), processor, microprocessor, other It may be implemented as an electronic unit or a combination thereof. In software implementation, software component components (elements), object-oriented software component components, class component components and task component components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, data , databases, data structures, tables, arrays, and variables. Software, data, etc. may be stored in memory and executed by a processor. The memory or processor may employ various means well known to those skilled in the art.

4 is a flowchart illustrating a process of blocking an abnormal Internet address using a search engine according to an embodiment of the present invention. Referring to FIG. 4 , the search module 320 receives message information such as e-mail, text, and SNS, and extracts an Internet address (ie, URL) from the body of the message information (steps S410 and S420).

Thereafter, it accesses the management server 220 and transmits a search command for searching the extracted Internet address to the search engine 221 (step S430). In other words, the search module 320 extracts the Internet address from the body of the message information 210, and searches for a normal Internet address related to the Internet address and an abnormal Internet address not related to the Internet address. The search request is transmitted to the search engine 221 side. Accordingly, the search engine 221 performs a search and transmits a search result to the search module 320 .

Then, the analysis module 330 calculates the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. Accordingly, the determination module 340 determines that the number of first search results is a threshold based on the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. ) is greater than (step S440). Here, the reference value may be the maximum value of the number of second search results.

In step S440, as a result of the determination, if the number of first search results (i.e., search results matching normal Internet addresses) is greater than the reference value, the determination module 340 determines that the Internet address is a normal Internet address and provides normal service. is performed (steps S450 and S451).

In contrast, in step S440, if the number of first search results is less than the reference value as a result of the determination, the internet address is determined as an abnormal internet address and access is blocked (steps S460 and S461).

On the other hand, since the normal/abnormal URL address itself to be searched is different, the number of matches between the search URL and the search result is different. Using this difference, URLs can be determined as normal if the difference is greater than a specific threshold, and abnormal if the difference is smaller.

According to one embodiment of the present invention, it is possible to perform a search on the Google search engine for 10 normal internet addresses (URLs)/abnormal internet addresses (URLs), respectively, and compare the number of search results matching the searched internet addresses. code can be constructed. Python was used as a programming language for this, but other than this, C, Java, C++, etc. may be used. "IpURLnormal = ['wwww.amazon.com', 'www.microsoft.com', 'www.netflix.com',...etc" is a normal internet address, "IpURLabnomal = ['www.ai amazon.com /apikeytokenid.php?set = 10000120', 'www.news.pointer.co.id',...etc" can be configured to indicate an abnormal Internet address.

In addition, to output the number of search results that match the normal Internet address entered above,

for userURL in IpURLnomal:

response = requests.get(URL + userURL + strOri)

txt = (response.text).lower()

getCount = txt.count(userURL.lower())

getlen=len(response. text)

site.append(userURL)

res.append(getlen)

lpMinMAx. append(getCount)

totalCount+= getCount

print('{} Site Response matching number: {}".format(userURL,getCount))

nor_t = np.array([userURL,getCount])

...... can be coded. Here, getCount means counting internet addresses, getlen means counting number of characters, and str Ori means string variable.

In addition, in order to output the number of matching search powers with abnormal Internet addresses,

for userURL in IpURLabnomal:

response = requests.get(URL + userURL + strOri)

txt = (response.text).lower()

getCount = txt.count(userURL.lower())

getlen=len(response. text)

site.append(userURL)

res.append(getlen)

lpMinMAx. append(getCount)

totalCount+= getCount

print('{} Site Response matching number: {}".format(userURL,getCount))

nor_t = np.array([userURL,getCount])

...... can be coded. The source code shown above is for illustrative purposes only and represents only a portion of it.

5 is a diagram showing comparison results of the number of search results in which normal Internet addresses and abnormal Internet addresses searched according to an embodiment of the present invention match each other. Referring to FIG. 5 , the maximum value of the number of search results matching the actually searched normal Internet address (URL) is 46, the minimum value is 29, and the average value is 34.6. The average value is obtained by dividing the sum of the number of Internet addresses searched as a search result by the sum of the number of Internet addresses designated for search. The maximum value of the number of search results matching the searched abnormal Internet address (URL) is 20, the minimum value is 0, and the average value is 10.

It can be seen that the number of search results matching the abnormal Internet address (URL) is relatively small compared to the normal Internet address (URL). Based on these results, a specific threshold is set, and if it is greater than the threshold, it can be determined as a normal Internet address, and if it is smaller, it can be determined as an abnormal Internet address. In the case of FIG. 5 , since the maximum value of abnormality is greater than the minimum value of normality, the maximum value of abnormality may be designated as a threshold. In this way, abnormal URL addresses can be automatically detected.

6 is an example of a normal internet address and an abnormal internet address search screen. When a corresponding site is searched using a search engine, there is a difference in the number of matches between normal and abnormal Internet addresses. This is because, in general, in the case of normal URLs, there are many serviced data, so there are many search results for the corresponding search keyword, but in the case of abnormal URLs, there are few search results because there are few cases in which they are actually served.

As shown in FIG. 6 , it is possible to search for amazon.com, which is a normal URL, and annaizoina.com , which is an abnormal URL, by using the search engine 710 of Google.

FIG. 7 is an example of a screen showing the number of search results matching normal and abnormal Internet addresses searched according to FIG. 6 . In FIG. 7, comparing the number of search results (Responses) matching normal/abnormal URLs searched using Google's search engine, the number of search results matching normal URLs is 216 (810), and matching abnormal URLs The number of search results is 39 (820), showing a clear difference.

8 is an example of a screen showing an automatic transformation screen 920 of a search word and search result lengths of normal and abnormal Internet addresses according to an embodiment of the present invention. Search engines 221 of portal sites such as Google, Yahoo, Naver, and Daum have a function of automatically transforming similar search terms into search terms (normal search terms) 910 having a high search rate.

When a normal Internet address (URL) and an abnormal Internet address (URL) changed to be very similar are searched for, the search engine 221 may automatically change a search term. In this case, although the search results of the normal Internet address (URL) and the abnormal Internet address are the same, since the normal/abnormal URL itself is different, a difference occurs in the number of matched search URLs and search results.

As an example, the search result length of wooribank.com , which is a normal Internet address (URL) based on Google search, is 42175 (930). The search results for similarly transformed abnormal URL wooridank.com are automatically transformed into search results for wooribank.com , which is a normal Internet address (URL), and the length is 43480, which is almost similar to the length of the normal Internet address (URL), so it is normal/abnormal. You can see that the URL search results are almost the same.

Of course, even with almost identical search results, normal/abnormal URL addresses themselves are not the same, so as shown in FIGS. 9 and 10, the number of search results matching the normal URL wooribank.com is 89, and the abnormal URL wooridank There are 16 .com , and there is a clear difference, so it is possible to determine whether there is an abnormality.

9 is an example of a screen showing the number of search results matching a normal Internet address according to an embodiment of the present invention. Referring to FIG. 9 , a search result screen 1020 obtained by applying a search word 1011 according to a programming code 1010 to a search engine 221 is shown. The number of search results 1021 is displayed on the search result screen 1020 .

10 is a diagram showing the number of search results matching an abnormal Internet address and an automatic transformation screen of a search word according to an embodiment of the present invention. Referring to FIG. 10 , a search term 1111 according to a programming code 1110 is applied to a search engine 221 to be automatically converted into a similar search word 1112 and a search result screen 1120 is displayed. The number of search results 1121 is displayed on the search result screen 1120 .

In one embodiment of the present invention, the number of search results matching a search Internet address (URL) is determined as normal/abnormal URL according to a specific threshold. This can also be applied to mobile applications. Since the introduction of smartphones, personal information and money theft attack methods are increasing due to malicious application downloads. In order to solve this problem, it is possible to determine normal/abnormal applications by comparing the number of search results matching the searched application by utilizing search engines in application download services such as 'Google play' or 'Apple store'.

In addition, the steps of a method or algorithm described in connection with the embodiments disclosed herein are implemented in the form of program instructions that can be executed through various computer means such as a microprocessor, processor, CPU (Central Processing Unit), etc. It can be recorded on any available medium. The computer readable medium may include program (instruction) codes, data files, data structures, etc. alone or in combination.

The program (command) code recorded on the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs, DVDs, and Blu-rays, and ROMs and RAMs ( A semiconductor storage element specially configured to store and execute program (instruction) codes such as RAM), flash memory, or the like may be included.

Here, examples of the program (command) code include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to act as one or more software modules to perform the operations of the present invention, and vice versa.

200: malicious internet address detection system
210: database 220: management server
221: search engine 230: communication network
240: terminal
310: message information
311: Email 312: Text
313: SNS (Social Networking Service)
320: analysis module 340: determination module

Claims (20)

database 110 for storing message information 310;
a management server 120 providing the message information 310 and having a search engine 221; and
It is communicatively connected to the management server 120 through the communication network 130 and uses the number of search results calculated by applying the Internet address linked to the message information 310 to the search engine 221 as a search term. A terminal 240 that determines whether the Internet address is malicious; includes,
The terminal 240,
a search module 320 extracting the Internet address from the text of the message information 310 and performing a search by applying the search term for the Internet address to the search engine 221;
an analysis module 330 counting the number of search results generated as a result of the search being executed; and
A determination module 340 for determining whether the Internet address is malicious by using the number of search results;
The search module 320 searches for normal Internet addresses related to the Internet address and searches for abnormal Internet addresses not related to the Internet address;
The determination module 340 determines whether the number of first search results is greater than a first reference value based on the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. and as a result of the determination, if the number of first search results is greater than the first reference value, the Internet address is determined as a normal Internet address, and if the number of first search results is less than the first reference value, the A malicious Internet address detection system using a search engine, characterized in that the Internet address is determined as an abnormal Internet address.
According to claim 1,
The message information 310 is a malicious Internet address detection system using a search engine, characterized in that any one of e-mail 310, text 311, and SNS (Social Networking Service) 313.
delete delete delete According to claim 1,
The system for detecting malicious Internet addresses using a search engine, characterized in that the determination module 340 blocks access when the Internet address is determined to be the abnormal Internet address.
According to claim 1,
The system for detecting malicious Internet addresses using a search engine, characterized in that the determination module 340 maintains a normal service when the Internet address is determined as the normal Internet address.
According to claim 1,
The system for detecting malicious Internet addresses using a search engine, characterized in that the first reference value is the maximum value of the number of second search results.
According to claim 1,
The determination module 340 determines the number of first search results and second search results based on the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. It is determined whether the difference value of the number is greater than a preset second reference value, and as a result of the determination, if the difference value is greater than the second reference value, the Internet address is determined as a normal Internet address, and the difference value is determined as the second reference value. A system for detecting malicious Internet addresses using a search engine, characterized in that if the Internet address is smaller than the reference value, the Internet address is determined as an abnormal Internet address.
According to claim 1,
The Internet address is a malicious Internet address detection system using a search engine, characterized in that URL (Uniform Resource Locator).
database 110 for storing message information 310;
A management server 120 provided with a search engine 221 that provides the message information 310 and has a function of automatically converting a second search word similar to the first search word; and
It is communicatively connected to the management server 120 through the communication network 130 and is calculated by applying the Internet address linked to the message information 310 to the search engine 221 as the first and second search words A terminal 240 that determines whether the Internet address is malicious by using the number of search results;
The terminal 240,
a search module (320) extracting the Internet address from the body of the message information (310) and executing a search by applying the first search term for the Internet address to the search engine (221);
an analysis module 330 counting the number of search results generated as a result of executing a search by the first search word and the second search word; and
A determination module 340 for determining whether the Internet address is malicious by using the number of search results;
wherein the first search word is applied to search for a normal internet address related to the internet address, and the second search word is applied to a search for an abnormal internet address not related to the internet address. system.
delete delete (a) storing the message information 310 in the database 110;
(b) providing the message information 310 to the terminal 240 by a management server 220 connected to the terminal 240 via a communication network 230 and having a search engine 221; and
(c) The terminal 240 applies the Internet address linked to the message information 310 to the search engine 221 as a search term, and determines whether the Internet address is malicious by using the number of search results calculated. Step; including,
In step (c),
(c-1) extracting, by the search module 320, the Internet address from the text of the message information 310, and executing a search by applying the search term for the Internet address to the search engine 221; ;
(c-2) counting, by the analysis module 330, the number of search results generated as a result of the search being executed; and
(c-3) determining, by the determination module 340, whether the Internet address is malicious using the number of search results;
In the step (c-1),
Searching, by the search module 320, a normal Internet address related to the Internet address and an abnormal Internet address not related to the Internet address;
In the step (c-3),
(c-3-1) The determination module 340 determines the number of first search results according to the normal Internet address search and the number of second search results according to the abnormal Internet address search. determining whether the number is greater than a first reference value;
(c-3-2) as a result of the determination, if the number of first search results is greater than the first reference value, determining, by the determination module 340, the Internet address as a normal Internet address; and
(c-3-3) as a result of the determination, if the number of first search results is less than the first reference value, determining, by the determination module 340, the Internet address as an abnormal Internet address; A malicious Internet address detection method using a search engine, characterized in that.
15. The method of claim 14,
The message information 310 is any one of e-mail 310, text message 311, and SNS (Social Networking Service) 313, characterized in that malicious Internet address detection method using a search engine.
delete delete delete (a) storing the message information 310 in the database 110;
The terminal ( 240) providing the message information 310;
(c) The terminal 240 uses the number of search results calculated by applying the Internet address linked to the message information 310 to the search engine 221 as the first search word and the second search word, Including; determining whether the Internet address is malicious;
In step (c),
(c-1) The search module 320 extracts the Internet address from the body of the message information 310 and applies the first search term for the Internet address to the search engine 221 to perform a search. doing;
(c-2) counting, by the analysis module 330, the number of search results generated as a result of performing a search based on the first search word and the second search word; and
(c-3) determining, by the determination module 340, whether the Internet address is malicious using the number of search results;
wherein the first search word is applied to search for a normal internet address related to the internet address, and the second search word is applied to a search for an abnormal internet address not related to the internet address. method. delete

Images