표준 웹 환경 디바이스 핑거프린트를 활용한 이용자 인증모델 연구
A Study on User Authentication Model Using Device Fingerprint Based on Web Standard
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
편리한 인터넷 이용환경을 조성하기 위해 정부에서는 공공·민간 웹사이트의 플러그인 제거 정책을 추진하고 있다. 일반적으로 금융서비스를 제공하는 금융기관 웹사이트는 전자금융거래 안정성 강화를 위해 이상금융거래 탐지시스템을 운영 중이며 이용자의 정보를 수집 및 분석하기 위해 설치형 소프트웨어를 사용하고 있다. 따라서 플러그인 제거정책에 따라 별도의 소프트웨어 설치 없이 이용자의 정보를 수집할 수 있는 대체 기술 및 대응정책이 필요하다. 본연구는 표준 웹 환경에서 사용 가능한 디바이스 핑거프린팅 기술들을 소개하고 다양한 기법 중 선택할 수 있는 가이드라인을 제시한다. 그리고 디바이스 핑거프린트를 활용한 머신러닝 기반 이용자 인증모델을 제안한다. 실제로 크롬과익스플로러 이용자로부터 디바이스 핑거프린트를 수집하여 머신러닝 알고리즘 기반 Multi-class 인증모델을 생성하였으며 실험 결과, 크롬 기반 모델은 약 85%~89%의 성능을 보였으며 익스플로러 기반 모델은 약 93%~97%의성능을 보였다.
Abstract
The government is pursuing a policy to remove plug-ins for public and private websites to create a convenient Internetenvironment for users. In general, financial institution websites that provide financial services, such as banks and credit cardcompanies, operate fraud detection system(FDS) to enhance the stability of electronic financial transactions. At this time, theinstallation software is used to collect and analyze the user's information. Therefore, there is a need for an alternativetechnology and policy that can collect user's information without installing software according to the no-plug-in policy. Thispaper introduces the device fingerprinting that can be used in the standard web environment and suggests a guideline toselect from various techniques. We also propose a user authentication model using device fingerprints based on machinelearning. In addition, we actually collected device fingerprints from Chrome and Explorer users to create a machine learningalgorithm based Multi-class authentication model. As a result, the Chrome-based Authentication model showed about85%~89% perfotmance, the Explorer-based Authentication model showed about 93%~97% performance.
참고문헌 (28)
- Guidelines for removal of public website plugins, "Ministry of the Interior and Safety", ~ (2018)
- Guidelines for improving private public website plugins, "Ministry of the Science and ICT", ~ (2018)
- 2019Current status of private and public plug-in improvements, "Ministry of Science and ICT", ~ (2019)
- P. Eckersley, "How unique is your web browser?", International Symposium on Privacy Enhancing Technologies Symposium, pp.1~19 (2010), Springer
- "Fraud Detection System Technical guide", Financial Security Agency, ~ (2014)
- 장석은, "웹 기반 디바이스 핑거프린팅을 이용한 온라인사기 및 어뷰징 탐지기술에 관한 연구", 정보보호학회논문지, 28(5), pp.1179~1195 (2018), 한국정보보호학회[DOI]
- Mayer, J. R., "Any person... a pamphleteer:Internet Anonymity in the Age of Web 2.0", pp.2009
- K. Mowery, "Pixel perfect: Fingerprinting canvas in HTML5", Proceedings of W2SP, pp.1~12 (2012)
- "Interezen"[URL]
- "Empowering Smarter Authentication and Fraud Decisioning in an Evolving Digital Landscap", LexisNexis, ~ (2019)
- "IP address"[URL]
- "Concept of DOM"[URL]
- "HTTP Header"[URL]
- G. Acar, "The Web Never Forgets:Persistent Tracking Mechanisms in the Wild", Proceedings of the 2014ACM SIGSAC Conference on Computer and Communications Security (CCS ’14), pp.674~689 (2014), ACM
- P. Laperdrix, "Morellian Analysis for Browsers: Making Web Authentication Stronger with Canvas Fingerprinting", International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, pp.43~66 (2019), Springer
- P. Laperdrix, "Beauty and the beast:Diverting modern web browsers to build unique browser fingerprints", 2016 IEEE Symposium on Security and Privacy(SP), pp.878~894 (2016), IEEE
- S. Englehardt, "Online tracking: A 1-million-site measurement and analysis", Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp.1388~1401 (2016)
- Survey on Device Fingerprinting, "The Spanish Data Protection Agency", ~ (2019)
- D. Fifield, "Fingerprinting web users through font metrics", International Conference on Financial Cryptography and Data Security, pp.107~124 (2015), Springer
- T. Unger, "SHPF : Enhancing http (s)session security with browser fingerprinting", 2013 International Conference on Availability, Reliability and Security, pp.255~261 (2013), IEEE
- I. Sanchez-Rola, "Clock around the clock:time-based device fingerprinting", Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp.1502~1514 (2018)
- A. Gómez-Boix, "Hiding in the crowd: an analysis of the effectiveness of browser fingerprinting at large scale", Proceedings of the 2018 World Wide Web Conference, pp.309~318 (2018)
- P. Laperdrix, "Browser Fingerprinting : A survey", ACM Transactions on the Web, 14(2) (2020)
- F. Alaca, "Device fingerprinting for augmenting web authentication: classification and analysis of methods", Proceedings of the 32nd Annual Conference on Computer Security Applications, pp.289~301 (2016)
- "Can I Use"[URL]
- A. Vastel, "FP-STALKER: Tracking browser fingerprint evolutions", 2018 IEEE Symposium on Security and Privacy (SP), pp.728~741 (2018), IEEE
- S. V. Stehman, "Selecting and interpreting measures of thematic classification accuracy", Remote sensing of Environment, 62(1), pp.77~89 (1997)
- E. Flood, "Browser Fingerprinting", Master, pp.2012