LEAKAGE INFORMATION PROTECTION SYSTEM AND LEAKAGE INFORMATION PROTECTION METHOD

Abstract

An object of the present invention is to provide a system and method for protecting leaked information that can deal with cases in which personal information has already been leaked by a phishing application. [Solution] According to an embodiment disclosed in this specification, the leaked information protection system includes an analysis unit that extracts phishing server information of a phishing application and analyzes the leaked data transmitted to the phishing server, and a data management unit that generates dummy data including virtual information based on the leaked data and transmits the dummy data to the phishing server or a target device.

Description

[Technical field]

[0001] The present invention relates to a system and method for protecting leaked information. [Background technology]

[0002] Recently, the spread of communication terminal devices that perform smart phone functions by applying mobile operating systems such as Windows Mobile, i-OS (Operating System), and Android has increased.

[0003] A communication terminal device applying such a mobile operating system executes various application programs based on the mobile operating system to provide various information processing services to a user. The communication terminal device applying the mobile operating system includes a browser as an application program, and executes the browser to connect to Internet websites to provide information on various websites to a user. A communication terminal device applying such a mobile operating system executes an application program and frequently attempts to connect to a website based on a Uniform Resource Locator (URL) received when receiving a text message, a multimedia message, an e-mail, or trading content.

[0004] However, since communication connections based on such received URLs do not check whether the target site is harmful or not, there are cases where communication connections are made directly to harmful sites such as phishing sites, domestic and foreign obscene sites, speculative sites, etc. Among these, connections to phishing sites in particular have become a social problem because they often lead to financial crimes. For example, when a text message contains URL information that induces a connection to a phishing site disguised as a financial institution, a communication terminal device can easily connect to the phishing site by following the URL information, and there are frequent cases where personal information is leaked by such phishing sites. Summary of the Invention [Problem to be solved by the invention]

[0005] Generally, there are techniques for preventing damage from phishing, such as a technique for blocking harmful short messages received by a communication terminal device and a technique for blocking access to a phishing site based on URL information included in the harmful short message. However, such techniques have a problem in that there is no way to deal with cases where personal information has already been leaked by a phishing application. [Means for solving the problem]

[0006] According to one embodiment disclosed in this specification, the leaked information protection system includes an analysis unit that extracts phishing server information of a phishing application and analyzes the leaked data transmitted to a phishing server corresponding to the phishing server information, and a data management unit that generates dummy data including virtual information based on the leaked data and transmits the dummy data to the phishing server or a target device.

[0007] According to an embodiment, the leaked information protection system further includes an application acquisition unit that checks phishing application information corresponding to the phishing application and acquires the phishing application.

[0008] According to one embodiment, the application acquisition unit may acquire the phishing application from a victim device or from a database.

[0009] According to one embodiment, the application acquisition unit can acquire the phishing application based on the results of comparing the data in the database with at least one of the account number, telephone number, threatening message, website, perpetrator profile, and HASH value of the phishing application used in the phishing attack.

[0010] According to one embodiment, the analysis unit may analyze the phishing server information and the leaked data based on a result of decompiling the phishing application.

[0011] According to one embodiment, the data manager is capable of generating the dummy data based on at least one of software, a programming language script, and user input.

[0012] According to one embodiment, the software may include at least one of a phone book generation module, a text message generation module, and a unique identification number generation module.

[0013] According to one embodiment, the phishing server information may include at least one of VPS (Virtual Private Server) information, C&C (Command & Control) information, IP address, access path, and log transmission history.

[0014] According to one embodiment, the dummy data may include at least one of unidentifiable or unrecognizable photos, contacts in an unused phone number format, documents containing meaningless content, unidentifiable SMS data, and unique identification numbers in an unused format.

[0015] According to one embodiment, the work target device is capable of executing the phishing application based on user input.

[0016] According to an embodiment, the leaked information protection system further includes an application acquisition unit configured to check the phishing application, acquire the phishing application, and transmit the phishing application to the operation target device.

[0017] According to one embodiment, the dummy data may be transmitted to the phishing server via the phishing application.

[0018] According to one embodiment, the work target device may include at least one of a mobile device, a virtual machine, and an emulator.

[0019] According to one embodiment disclosed in the present specification, a method for protecting leaked information includes a step of extracting phishing server information of a phishing application and analyzing leaked data transmitted to a phishing server corresponding to the phishing server information, a step of generating dummy data including virtual information based on the leaked data, and a step of transmitting the dummy data to the phishing server or a target device.

[0020] According to an embodiment, the method for protecting leaked information further includes checking phishing application information corresponding to the phishing application and acquiring the phishing application.

[0021] According to one embodiment, the step of transmitting the dummy data to the phishing server or the work target device includes a step of transmitting the dummy data to the work target device, a step of executing the phishing application on the work target device based on user input, and a step of transmitting the dummy data to the phishing server via the phishing application. Effect of the Invention

[0022] According to the present invention, even if the victims delete the phishing application, the phishing application can be obtained through a database, and even if the phishing application cannot be obtained from the victim, leaked information can be protected.

[0023] In addition, since a target device that is not a victim device can be used, leakage of additional personal information that may occur during the execution of a phishing application can be prevented.

[0024] In addition, since there is no need to install a commonly used proxy server, it is efficient in terms of time and cost.

[0025] It should be noted that convenience can be provided by generating and transmitting dummy data without the need to directly modulate the data transmitted by the phishing application.

[0026] In addition, various other advantages are provided that can be understood directly or indirectly through this specification. [Brief description of the drawings]

[0027] [Figure 1] FIG. 1 illustrates an information leak protection system according to one embodiment disclosed herein. [Diagram 2] 1 is a diagram illustrating a transmission process to a phishing server of a leaked information protection system according to an embodiment disclosed in this specification. [Diagram 3]FIG. 2 illustrates an example of the results of decompiling a phishing application according to one embodiment disclosed herein. [Figure 4] FIG. 2 illustrates an example of analyzing communication packets via a packet sniffer for a phishing application according to one embodiment disclosed herein. [Diagram 5] FIG. 2 illustrates an application acquisition unit according to one embodiment disclosed herein. [Figure 6] FIG. 2 illustrates a system for protecting information leaks according to another embodiment disclosed herein. [Figure 7] 1 is a flowchart illustrating a method for protecting leaked information according to an embodiment disclosed in this specification. [Figure 8] 10 is a flowchart illustrating a method for protecting leaked information according to another embodiment disclosed in this specification. [Figure 9] 10 is a flowchart illustrating a method for protecting leaked information according to another embodiment disclosed in this specification. [Figure 10] 2 is a diagram illustrating a process in which a leaked information protection system protects leaked information according to an embodiment disclosed in this specification. [Figure 11] FIG. 11 is a diagram illustrating a process in which a leaked information protection system protects leaked information according to another embodiment disclosed in this specification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] Various embodiments of the present invention will be described below with reference to the accompanying drawings. However, it should be understood that this is not intended to limit the present invention to a particular embodiment, but includes various modifications, equivalents, and / or alternatives of the embodiment of the present invention.

[0029] In this specification, the singular form of a noun corresponding to an item may include one or more of the items, unless the relevant context clearly indicates otherwise. In this specification, each of phrases such as "A or B," "at least one of A and B," "at least one of A or B," "A, B or C," "at least one of A, B and C," and "at least one of A, B or C" may include any one of the items listed together in the phrase, or all possible combinations thereof. Terms such as "first," "second," "first," and "second" may be used simply to distinguish the corresponding element from other corresponding elements, and do not limit the corresponding element to other aspects (e.g., importance or procedure). When a (e.g., first) component is referred to as being "coupled" or "connected" to another (e.g., second) component, with or without the terms "functionally" or "communicatively," it means that the one component can be coupled to the other component directly (e.g., by wire), wirelessly, or through a third component.

[0030] Each component (e.g., a module or a program) of the components described herein may include a single or multiple entities. According to various embodiments, one or more components or operations of the corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, multiple components (e.g., modules or programs) may be integrated into one component. In this case, the integrated component may perform one or more functions of each of the multiple components in the same or similar manner as performed by the corresponding component of the multiple components before the integration. According to various embodiments, operations performed by a module, program, or other component may be performed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be performed in a different order, omitted, or one or more different operations may be added.

[0031] The term "module" or "portion" as used herein may include a unit implemented in hardware, software, or firmware, and may be interchangeable with terms such as logic, logic block, component, or circuit. A module may be an integrated component or the smallest unit or portion of said component that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0032] Various embodiments of the present specification may be implemented as software (e.g., a program or application) including one or more instructions stored in a storage medium (e.g., a memory) that is readable by a machine. For example, a processor of the machine may call up at least one of the one or more instructions stored in the storage medium and execute it. This allows the machine to be operated to perform at least one function according to the at least one instruction that is called up. The one or more instructions may include code generated by a compiler or code executed by an interpreter. The machine-readable storage medium may be provided in the form of a non-transitory storage medium. Here, "non-transitory" only means that the storage medium is a tangible machine and does not include a signal (e.g., electromagnetic waves), and the term does not distinguish between a case where data is semi-permanently stored in the storage medium and a case where data is temporarily stored in the storage medium.

[0033] FIG. 1 is a diagram illustrating an information leakage protection system according to one embodiment disclosed herein.

[0034] Referring to FIG. 1, when personal information such as customer photos, SNS information, text messages, messenger content, contact information, etc. is leaked through a phishing application, the leaked information protection system 100 transmits dummy data including virtual information to a phishing server 200 to neutralize the already leaked personal information and prevent further leaking, thereby protecting the leaked information.

[0035] The leaked information protection system 100 can transmit dummy data directly to the phishing server 200, or can transmit the dummy data using a separate operation target device 300. In FIG. 1, the operation target device 300 is shown as a separate configuration, but in some cases, it can operate as one configuration with the leaked information protection system 100.

[0036] For example, in most general servers, data is stored in a LIFO (Last In First Out) format. That is, since a data processing method is used in which the server reads the data recorded last in time first, the leaked information protection system 100 can transmit to the phishing server 200 a larger amount of dummy data than the data stored in the server or a larger amount of dummy data than the storage capacity, so that the leaked data is pushed out and replaced. For example, when the phishing server 200 is configured in a LIFO format to store the next incoming data and delete the subsequent data when the data array format is 1000 or more, if more than 1000 (e.g., 2000) contacts are generated as dummy data and transmitted to the phishing server 200, only the last 1000 contacts are stored in the phishing server 200, and the remaining contacts are deleted. As a result, the contact information, which is leaked data that was previously stored, can be deleted from the phishing server 200.

[0037] In addition, the leaked information protection system 100 can replace the leaked data by overwriting dummy data on the leaked data of the phishing server 200. For example, dummy data having the same file name as the leaked data can be generated and transmitted to the phishing server 200, and the leaked data can be replaced with the dummy data by overwriting.

[0038] In addition, the leaked information protection system 100 can protect the leaked information in various ways, including a method of preventing the phishing server 200 from recognizing the leaked data by transmitting dummy data, a method of causing the phishing server 200 to mistakenly believe that the personal information of other victims has been leaked by transmitting dummy data, and a method of causing the phishing server 200 to mistakenly believe that there is no leaked data by transmitting dummy data.

[0039] According to an embodiment, the leaked information protection system 100 includes an application acquisition unit 110, an analysis unit 120, and a data management unit 130. The leaked information protection system 100 may generate dummy data including virtual information and transmit the dummy data to the phishing server 200 or the operation target device 300. According to an embodiment, the leaked information protection system 100 may be a hardware device such as a processor or a central processing unit (CPU), or may be software or a program implemented by a hardware device.

[0040] According to an embodiment, the application acquisition unit 110 may acquire a phishing application by checking phishing application information corresponding to the phishing application. The application acquisition unit 110 may check phishing application information used in phishing via a victim device, etc. The phishing application information may include, for example, file information (e.g., HASH value, application name, etc.) related to the phishing application, or information such as an account number, a phone number, and a perpetrator profile used in phishing.

[0041] According to an embodiment, the analysis unit 120 may extract phishing server information of a phishing application and analyze leaked data transmitted to the phishing server 200 corresponding to the phishing server information. The phishing server information may include, for example, an IP band used for communication and a site address (URL). The leaked data may include, for example, victim's phone number data, text message data, photo data, video data, messenger data, etc. In addition, the leaked data may include the format, standard, type (whether it is a phone number, a photo, an image, etc.) of the data transmitted to the phishing server 200, etc.

[0042] According to an embodiment, the analysis unit 120 may extract and analyze phishing server information and leaked data of the phishing application based on the result of decompiling the phishing application. Decompiling may refer to a process of converting a program file (e.g., an APK file or an IPA file) into a code implemented in a computer programming language (e.g., Java, C++, C, etc.). When a program file is decompiled, the code implemented in the programming language may be confirmed, and the code may be analyzed to confirm the operating method of the program file, the server address used, information transmitted through the program file, etc. Thus, the analysis unit 120 may extract leaked data transmitted by the phishing application and / or phishing server information used for phishing by analyzing the code obtained by decompiling the phishing application. FIG. 3 shows an example of a result of decompiling a program file, in which it may be confirmed that the decompiled code contains phishing server information, etc.

[0043] According to an embodiment, the analysis unit 120 may also analyze the phishing server information and / or leaked data of the phishing application using a packet sniffer. For example, a packet sniffer may refer to a program that displays communication packets of a program file. The analysis unit 120 may obtain the communication packets through the packet sniffer and analyze the phishing server information and data transmitted to the phishing server 200. FIG. 4 is an example of checking the communication packets through a packet sniffer, and it may be possible to check that the communication packets contain phishing server information and leaked data by analyzing the communication packets.

[0044] According to an embodiment, the analysis unit 120 can check whether the dummy data has been normally transmitted to the phishing server 200 during the process in which the data management unit 130 or the phishing application transmits dummy data to the phishing server 200. The analysis unit 120 can check whether the data to be transmitted (e.g., dummy data) has been normally transmitted to the phishing server 200 by decompiling the phishing application or analyzing communication packets through a packet sniffer, similar to the process of analyzing the phishing server information and / or the leaked data. Thus, the leaked information protection system 100 can check whether the process of neutralizing the already leaked personal information in the phishing server 200 is being performed normally.

[0045] According to an embodiment, the data management unit 130 may generate dummy data including virtual information based on the leaked data and transmit the dummy data to the phishing server 200 or the operation target device 300. The leaked information protection system 100 aims to neutralize information leaked by a phishing application, and for this purpose, transmits dummy data having the same data format as the leaked information to the phishing server 200, and the dummy data may replace the leaked data or may be combined with the leaked data to push out or overwrite the leaked data. That is, the data management unit 130 may generate dummy data including virtual information to have the same data format as the leaked data, and in this case, instead of directly modulating the leaked data, may check the format of the analyzed leaked data (e.g., .jpg, .txt, etc.) and arbitrarily generate virtual information to have the same data format as the leaked data. For example, if the leaked data leaked to the phishing server 200 has a data format of .jpg, the data management unit 130 may simply generate arbitrary virtual information having the same data format as .jpg without directly modulating the actually leaked data. That is, the dummy data including virtual information generated by the data management unit 130 may be data that is generated arbitrarily regardless of the actual data leaked to the phishing server 200 .

[0046] According to an embodiment, the dummy data may include at least one of an unidentifiable or unrecognizable photograph, an unused contact number format, a document containing meaningless content, unidentifiable SMS data, and an unused format unique identification number. Such data may mainly correspond to the leaked data transmitted by the phishing application to the phishing server. However, if the phishing application transmits data in another format, dummy data having a corresponding data format may be generated.

[0047] According to an embodiment, the data management unit 130 can generate dummy data based on at least one of software, a programming language script, and user input. The software can include a program that generates virtual information having a predetermined data format. The programming language script can include code implemented in a programming language, and the programming language can include, for example, Java, Python, Ruby, C, C++, etc. The data management unit 130 can also generate dummy data by storing data in Excel (registered trademark) or the like based on user input. For example, the data management unit 130 can generate dummy data by entering a virtual phone number into Excel based on user input.

[0048] According to an embodiment, the data management unit 130 may transmit dummy data generated based on software or a programming language script to the phishing server 200. In this case, the software or the programming language script may receive the phishing server information extracted from the analysis unit 120 and transmit the dummy data to the phishing server 200.

[0049] According to one embodiment, the data management unit 130 may transmit dummy data generated based on user input to the operation target device 300. In some cases, the dummy data generated based on user input may be transmitted to the phishing server 200 via software or a programming language script.

[0050] According to an embodiment, the software of the data management unit 130 may include at least one of a phone book generating module 131, a text message generating module 132, and a unique identification number generating module 133. The phone book generating module 131 may generate a virtual phone number having an unused phone number format. The text message generating module 132 may generate an arbitrary text message. In this case, the arbitrary text message may include text such as a list of meaningless character strings. The unique identification number generating module 133 may generate a unique identification number in an unused format. In this case, the unique identification number (IMEI: International Mobile Equipment Identity) may include a unique serial number possessed by the mobile device.

[0051] According to one embodiment, each of the phone book generation module 131, the text message generation module 132, and the unique identification number generation module 133 can generate dummy data automatically via software, programming language scripts, etc., or can generate the dummy data manually based on user input.

[0052] According to one embodiment, the phishing server 200 may include a server that communicates with a phishing application used in a phishing crime to receive leaked data or stores the leaked data.

[0053] According to an embodiment, the phishing server information may include at least one of VPS (Virtual Private Server) information, C&C (Command & Control) information, IP address, access path, and log transmission history. The phishing server 200 that leaks personal information may be a C&C server, and is generally accessed by connecting via a VPS server.

[0054] According to an embodiment, the operation target device 300 may include at least one of a mobile device, a virtual machine, and an emulator. In this case, the mobile device may be a device that is not a victim device and does not store personal information. However, in some cases, the leaked information protection system 100 may proceed with the leaked information protection operation on the victim device 10, and in this case, the operation target device 300 and the victim device 10 may be substantially the same.

[0055] According to one embodiment, the virtual machine and / or emulator may include a program that enables the running of a mobile application on a PC. In general, a phishing application may be a mobile application, and the mobile application may not run on a PC due to compatibility issues, etc. Therefore, a virtual machine, emulator, etc. that enables the running of a mobile application may be used to run a phishing application within the virtual machine to enable leaked information protection work.

[0056] When the leaked information protection system 100 performs the leaked information protection operation on the victim device 10, the victim device 10 may still have a phishing application installed and may still have the victim's personal information, which may result in unintended additional leaking of personal information. In contrast, when an emulator or virtual machine 310 is used as the operation target device 300, there is no data of the victim's personal information, which may prevent additional leaks. In addition, since there is no need to provide a separate proxy server, the operation can be performed efficiently in terms of time and cost, and the operation can be performed efficiently since the operation can be performed on a device such as a device (e.g., a PC) on which the analysis unit 120 or application acquisition unit 110 operates.

[0057] FIG. 2 is a diagram illustrating a transmission process to a phishing server in the leaked information protection system according to an embodiment disclosed in this specification.

[0058] 2, the data management unit 130 may generate dummy data based on at least one of software, a programming language script, and user input. According to an embodiment, the software or the programming language script may directly transmit the dummy data to the phishing server 200, and the dummy data generated based on the user input may be transmitted to the operation target device 300 and transmitted to the phishing server 200 by the phishing application.

[0059] FIG. 5 is a diagram illustrating an application acquisition unit according to one embodiment disclosed herein.

[0060] Referring to FIG. 5, the application acquisition unit 110 can acquire a phishing application from the victim device 10 or the database 20 .

[0061] If the phishing victim has not deleted the phishing application from the victim device 10, the application acquisition unit 110 can receive the phishing application from the victim device 10. At this time, the application acquisition unit 110 and the victim device 10 can communicate with each other via wired or wireless communication, and the phishing application can be received via a commonly used communication method such as Bluetooth communication, Wi-Fi communication, or USB communication.

[0062] However, if a phishing victim deletes a phishing application from the victim device 10, there is a problem that the phishing application cannot be directly transmitted from the victim device 10. In this case, the application acquisition unit 110 compares the data in the database 20 with the phishing victim information to estimate the phishing application used in the phishing victimization, and transmits it from the database 20.

[0063] That is, according to an embodiment, the application acquisition unit 110 can acquire a phishing application based on a result of comparing at least one of the account number, telephone number, threatening message, website, perpetrator profile, and HASH value of the APK file used in the phishing damage with the data in the database 20. Such phishing damage information can be acquired from the victim and can include various other information related to the phishing damage. For example, if data matching the account number information acquired from the victim exists in the database 20, it can be estimated that the application matched with the data is the phishing application used in the phishing damage. To this end, the database 20 can match and store information such as the account number, telephone number, threatening message, website, perpetrator profile, etc. used in the existing phishing damage with the phishing application.

[0064] According to one embodiment, in order to always keep the data in the database 20 up to date, the leaked information protection system 100 continuously checks for changes in information related to the phishing server 200 (e.g., changes in account numbers, telephone numbers, perpetrator profiles, etc. used in phishing victimization) based on the existing data in the database 20, and if there is a change in information, it can be reflected in the database 20 to update the data. For example, if the address of the phishing server 200 to which dummy data is transmitted is changed when dummy data is transmitted by a phishing application, the changed address can be reflected in the database 20. In another example, if the account number or telephone number of the perpetrator stored in the database 20 is no longer valid due to closure, termination, etc., such fact can be reflected.

[0065] In this way, the leaked information protection system 100 can obtain the phishing application and protect the leaked information even if the victim has deleted the phishing application.

[0066] FIG. 6 is a diagram illustrating an information leakage protection system according to another embodiment disclosed in this specification.

[0067] Referring to FIG. 6, the leaked information protection system 100 may transmit dummy data from the operation target device 300 to the phishing server 200 .

[0068] According to an embodiment, the data management unit 130 may generate dummy data including virtual information based on the leaked data and transmit the dummy data to the operation target device 300 .

[0069] According to an embodiment, the application acquisition unit 140 may check the phishing application, acquire the phishing application, and transmit the acquired phishing application to the work target device 300. According to an embodiment, the application acquisition unit 140 illustrated in FIG 3 may be substantially the same as the application acquisition unit 110 illustrated in FIG 1.

[0070] According to one embodiment, the work target device 300 can execute a phishing application based on a user input. This allows the phishing application to transmit dummy data from the work target device 300 to the phishing server 200 on its own. Since the phishing application is designed to automatically transmit specific data in the device to the phishing server 200, simply executing the phishing application on the work target device 300 can cause the phishing application to transmit dummy data from the work target device 300 to the phishing server 200 on its own.

[0071] In this way, if the phishing application itself transmits dummy data to the phishing server 200, the perpetrator will not notice that the leaked information protection work is being carried out even when monitoring the phishing server 200, so the leaked information can be protected without the perpetrator's suspicion.

[0072] FIG. 7 is a flowchart illustrating a method for protecting leaked information according to an embodiment disclosed in this specification.

[0073] Referring to FIG. 7, the leaked information protection method includes a step of extracting phishing server information of a phishing application and analyzing the leaked data transmitted to a phishing server corresponding to the phishing server information (S100), a step of generating dummy data including virtual information based on the leaked data (S200), and a step of transmitting the dummy data to the phishing server or a target device (S300).

[0074] In step S100, the analysis unit 120 may extract phishing server information of the phishing application and analyze leaked data transmitted to the phishing server 200 corresponding to the phishing server information. In this case, the analysis unit 120 may analyze the phishing server information and / or the leaked data by decompiling the phishing application or analyzing communication packets through a packet sniffer.

[0075] In operation S200, the data management unit 130 may generate dummy data including virtual information based on the leaked data. In this case, the data management unit 130 may generate the dummy data based on at least one of software, a programming language script, and a user input.

[0076] In step S300, the data management unit 130 may transmit dummy data to the phishing server 200 or the operation target device 300.

[0077] FIG. 8 is a flowchart illustrating a method for protecting leaked information according to another embodiment disclosed in this specification.

[0078] 8, the leaked information protection method further includes a step of confirming phishing application information corresponding to a phishing application and acquiring the phishing application (S10). According to an embodiment, steps S100, S200, and S300 shown in FIG. 8 may be substantially the same as steps S100, S200, and S300 shown in FIG. 7, respectively.

[0079] In step S10, the application acquisition unit 110 may acquire the phishing application by checking phishing application information corresponding to the phishing application. In this case, the application acquisition unit 110 may acquire the phishing application from the victim device 10 or the database 20.

[0080] According to an embodiment, the application acquisition unit can acquire the phishing application based on a result of comparing the data in the database with at least one of the account number, telephone number, threatening message, website, perpetrator profile, and HASH value of the phishing application used in the phishing damage. Such phishing damage information should be acquired from the victim, and may include various other information related to the phishing damage. For example, if data matching the account number information acquired from the victim exists in the database 20, it can be estimated that the application matched with the data is the phishing application used in the phishing damage. For this purpose, the database 20 can match and store information such as account numbers, telephone numbers, threatening messages, websites, and perpetrator profiles used in existing phishing damage with the phishing application.

[0081] FIG. 9 is a flowchart illustrating a method for protecting leaked information according to another embodiment disclosed in this specification.

[0082] Referring to FIG. 9, the leaked information protection method includes a step of transmitting dummy data to a target device (S310), a step of executing a phishing application on the target device based on user input (S320), and a step of transmitting the dummy data to a phishing server via the phishing application (S330).

[0083] In step 310 , the data management unit 130 may transmit dummy data to the operation target device 300 .

[0084] In step S320, the work target device 300 may execute a phishing application based on the user input. In this case, the work target device 300 may include an emulator or a virtual machine 310.

[0085] In step S330, the dummy data can be transmitted from the operation target device 300 to the phishing server 200 via the phishing application. Since the phishing application is designed to automatically transmit specific data within the device to the phishing server 200, simply executing the phishing application on the operation target device 300 can cause the phishing application to transmit the dummy data from the operation target device 300 to the phishing server 200 by itself.

[0086] FIG. 10 is a diagram illustrating a process in which the leaked information protection system protects leaked information according to an embodiment disclosed in this specification.

[0087] Referring to FIG. 10, it can be seen that the leaked information protection system 100 transmits dummy data to the phishing server 200 using the virtual machine 310 as the operation target device 300.

[0088] According to an embodiment, in the leaked information protection system 100, the application acquisition unit 110 may transmit a phishing application to the virtual machine 310. The data management unit 130 may generate dummy data and transmit it to the virtual machine 310. At this time, the phishing application may be executed in the virtual machine 310, so that the dummy data may be transmitted to the phishing server 200 by the phishing application. The process in which the dummy data is transmitted to the phishing server 200 by the phishing application may be confirmed by the analysis unit 120 by decompiling the phishing application or analyzing communication packets through a packet sniffer to see if the data is normally transmitted. Thus, the dummy data may be transmitted to the phishing server 200 to push out or overwrite the leaked data, which is existing information, to protect the leaked information.

[0089] FIG. 11 is a diagram illustrating a process in which a leaked information protection system according to another embodiment disclosed in this specification protects leaked information.

[0090] Referring to FIG. 11, the leaked information protection system 100 can protect leaked information by transmitting dummy data to the phishing server 200 through software.

[0091] According to an embodiment, in the leaked information protection system 100, the data management unit 130 can generate dummy data based on software, and the software can include at least one of a phone book generation module 131, a text message generation module 132, and a unique identification number generation module 133. In this case, the software or a programming language script can transmit the dummy data to the phishing server 200.

[0092] As described above, even if all components constituting one embodiment disclosed in the present specification are described as being integrally combined or combined and operating, the embodiment disclosed in the present specification is not necessarily limited to this embodiment. That is, within the scope of the purpose of one embodiment disclosed in the present specification, all components may be selectively combined and operated as one or more.

[0093] In addition, the terms "comprise", "constitute" or "have" described above mean that the relevant element can be contained, unless otherwise specified, and should be interpreted as including other elements, not excluding other elements. All terms, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the embodiments disclosed herein belong, unless otherwise defined. Commonly used terms, such as terms defined in a dictionary, should be interpreted to be consistent with the contextual meaning of the relevant art, and should not be interpreted as being ideal or overly formal, unless otherwise clearly defined in this specification.

[0094] The above description is merely an example of the technical ideas disclosed in this specification, and a person having ordinary knowledge in the technical field to which the embodiments disclosed in this specification belong may make various modifications and variations without departing from the essential characteristics of the embodiments disclosed in this specification. Therefore, the embodiments disclosed in this specification are intended to explain, rather than limit, the technical ideas of the embodiments disclosed in this specification, and the scope of the technical ideas disclosed in this specification is not limited by such an embodiment. The scope of protection of the technical ideas disclosed in this specification should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present specification. [Explanation of symbols]

[0095] 10 Victim Device 20 Database 100 Leaked Information Protection System 110, 140 Application Acquisition Department 120 Analysis Department 130 Data Management Department 131 Telephone directory generation module 132 Text Message Generation Module 133 Unique Identification Number Generation Module 200 Phishing Server 300 Work target device 310 Virtual Machines

Claims

1. an analysis unit that extracts phishing server information of a phishing application and analyzes leaked data transmitted to a phishing server corresponding to the phishing server information; A leaked information protection system comprising: a data management unit that generates dummy data including virtual information based on the leaked data and transmits the dummy data to the phishing server or the operation target device.

2. The leaked information protection system according to claim 1 , further comprising an application acquisition unit that checks phishing application information corresponding to the phishing application and acquires the phishing application.

3. The leaked information protection system according to claim 2 , wherein the application acquisition unit acquires the phishing application from a victim device or from a database.

4. The leaked information protection system of claim 3, characterized in that the application acquisition unit acquires the phishing application based on the results of comparing the data in the database with at least one of the account number, telephone number, threatening message, website, perpetrator profile, and HASH value of the phishing application used in phishing attacks.

5. The leaked information protection system according to claim 1 , wherein the analysis unit analyzes the phishing server information and the leaked data based on a result of decompiling the phishing application.

6. The information leak protection system according to claim 1 , wherein the data management unit generates the dummy data based on at least one of software, a programming language script, and a user input.

7. The information leakage protection system of claim 6, wherein the software includes at least one of a phone book generating module, a text message generating module, and a unique identification number generating module.

8. 2. The system of claim 1, wherein the phishing server information includes at least one of VPS (Virtual Private Server) information, C&C (Command & Control) information, IP address, access route, and log transmission history.

9. The leaked information protection system of claim 1, characterized in that the dummy data includes at least one of an unidentifiable or unrecognizable photo of a person, a contact in an unused phone number format, a document containing meaningless content, unidentifiable SMS data, and a unique identification number in an unused format.

10. The information leakage protection system according to claim 1 , wherein the work target device executes the phishing application based on a user input.

11. The system for protecting information leaks according to claim 10, further comprising an application acquisition unit configured to check the phishing application, acquire the phishing application, and transmit the phishing application to the operation target device.

12. The system of claim 11, wherein the dummy data is transmitted to the phishing server via the phishing application.

13. The information leakage protection system according to claim 1 , wherein the work target device includes at least one of a mobile device, a virtual machine, and an emulator.

14. extracting phishing server information of a phishing application and analyzing leaked data transmitted to a phishing server corresponding to the phishing server information; generating dummy data including virtual information based on the leaked data; transmitting the dummy data to the phishing server or the operation target device.

15. The method of claim 14, further comprising: checking phishing application information corresponding to the phishing application to acquire the phishing application.

16. The step of transmitting the dummy data to the phishing server or the operation target device includes: transmitting the dummy data to the operation target device; executing the phishing application on the work target device based on user input; The method of claim 14, further comprising: transmitting the dummy data to the phishing server via the phishing application.

Images