WEB-BASED TRACEBACK SYSTEM AND METHOD USING REVERSE CACHING PROXY

• US 20100030891A1
• Filed: 05/18/2009
• Published: 02/04/2010
• Est. Priority Date: 07/30/2008
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: KIM, Jong Hyun, RYU, Jong Ho, CHO, Hyun Sook, KIM, Geon Lyang, SOHN, Seon Gyoung, CHANG, Beom Hwan, NA, Jung-Chan, JEONG, Chi Yoon
• Granted Patent: US 8,341,721 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/5683 Storage of data provided by user terminals, i.e. reverse caching

Abstract

Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users'"'"' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.

Claims

1. A web-based traceback system using reverse caching proxy, the web-based traceback system comprising:

a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and

a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server,

wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.

2. The web-based traceback system of claim 1, wherein the reverse caching proxy server comprises a database storing a blacklist of illegitimate servers and an HTTP header analysis module determining whether the client has attempted to access the web server through the anonymous server.

3. The web-based traceback system of claim 2, wherein, if it is determined that the client has attempted to access the web server through the anonymous server, the HTTP header analysis module determines whether the anonymous server is included in the blacklist, and adds the anonymous server to the blacklist if the anonymous server is not included in the blacklist.

4. The web-based traceback system of claim 2, wherein the reverse caching proxy server further comprises a cache directory caching a web page of the web server, and, if it is determined that the client has not used the anonymous server to transmit the HTTP packet, the reverse caching proxy server issues a request for a web page requested by the client to the cache directory, rather than to the web server.

5. The web-based traceback system of claim 4, wherein, if the web page requested by the client does not exist in the cache directory, the reverse caching proxy server issues a request for the web page requested by the client to the web server.

6. The web-based traceback system of claim 1, wherein the web tracking server comprises a web tracking processing module maintaining a connection to the reverse caching proxy server and receiving information indicating whether the client has attempted to access the web server through the anonymous server from the reverse caching proxy server, a track code insertion module receiving the information indicating whether the client has attempted to access the web server through the anonymous server from the web tracking processing module and inserting a tracking code into a response page to be transmitted to the client by the web server, an extended markup language (XML) socket communication module performing XML socket communication with the tracking code when the tracking code is automatically executed in the web browser of the client, and a database receiving network information of the client from the XML socket communication module and storing the received network information.

7. The web-based traceback system of claim 6, wherein the tracking code is written in Javascript, transmits one of an internet protocol (IP) address, a media access control (MAC) address and host information of the client to the web tracking server through XML socket communication when automatically executed in the web browser of the client, and is closed when the transmission of the network information of the client is complete.

8. The web-based traceback system of claim 7, wherein the web tracking processing module transmits network information of the client to a network information search server during the transmission of the network information of the client by the tracking code, receives location information corresponding to the network information of the client from the network information search server, and stores the received location information in the database.

9. A web-based traceback method using reverse caching proxy, which is performed by a reverse caching proxy server provided between a client and a web server, the web-based traceback method comprising:

receiving an HTTP packet transmitted to the web server by the client, analyzing the header of the HTTP packet transmitted by a client and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and

if the client is determined to have attempted to access the web server through the anonymous server, transmitting a response page for the HTTP packet to the client, the response page having a tracking code inserted therein,

wherein the tracking code transmits network information of the client.

10. The web-based traceback method of claim 9, wherein the tracking code is written in Javascript and is automatically executed in a web browser of the client.

11. The web-based traceback method of claim 9, wherein the network information of the client comprises one of an IP address, a MAC address and host information of the client.

12. The web-based traceback method of claim 9, wherein the reverse caching proxy server caches a web page of the web server, and may transmit the cached web page, instead of a web page requested by the client, to the client if the client attempts to legitimately access the web server.

13. The web-based traceback method of claim 9, wherein the tracking code transmits network information of the client to the web tracking server through XML socket communication when automatically executed in a web browser of the client.