그래프 기반 악성 유저군 탐지: 온라인 광고 도메인에서의 적용

ܻߡझূ૑פয݂੉਋۰غয੿ࠁ੄࢚ࣁೠ੿بоઑ੺ؼࣻ੓਺ਸন೧ࠗఌ٘݀פ׮

ҟҊয࠭૚ ٣૑ణبق૕ ޙઁࢸݺ߂੿੄ Ӓې೐ҳ୷ ঈࢿਬ੷ҵఐ૑ݽ؛ Ѿҗঈࢿਬ੷ҵ੄ౠࢿ Ѿۿ

ҟҊয࠭૚ ҟҊݒ୓ XFC BQQ оࣻ੊ਸղחߑߨ ҟҊ઱ীѱҟҊ੗ܻܳ౸ݒೞৈࣻ੊ਸହ୹ೣ

ҟҊয࠭૚ ҟҊݒ୓ XFC BQQ оࣻ੊ਸղחߑߨ ҟҊ઱ীѱҟҊ੗ܻܳ౸ݒೞৈࣻ੊ਸହ୹ೣ ҟҊয࠭૚ ٣૑ణبق૕ ੿࢚੸੉૑ঋ਷ߑधਵ۽౟ې೗ਸૐоदெ
ࠗ׼ೞѱ੉੊ਸஂೞחѪ -> ҟҊ઱੄ҟҊബਯೞۅ -> ੿࢚ݒ୓ٜ੄ࣻ੊хࣗ -> ҟҊ୶ୌ೟णؘ੉ఠয়৏

*75 *OWBMJE5SBG fi D ਬ੷о੄بೞ૑ঋ਷ݒ୓ߑޙ ݠनী੄ೠ౟ې೗ 8PSME'FEFSBUJPOPGBEWFSUJTFST_ਸ*75ਵ۽୶੿ +VOJQFS3FTFBSDI64ীࢲೖ೧ӏݽח֙ র׳۞
֙ র׳۞ *75ܳ೙ఠ݂ೞӝਤೠӝٜࣿ਷য࠭੷ٜҗ੄՘হחࣿې੟ӝѱ੐ীсഃ੓ח࢚ട ҟҊ౟ې೗੄ח*75੉׮ 'PSCFT#FODINBSLTGPSBEGSBVE7JFXBCJMJUZBOEBECMPDLJOH] 5IF"E5FDI#PPL੢੄5IF$PTUPG"E'SBVE

(PBM য࠭੷ٜ੄਋ഥ࠺ਊ࢚थदఃӝ -> ࣻ੊ࢿঈച -> য࠭૚੄زӝઁѢ

য࠭੷੄࠺ਊਸૐоदఅࢤഝࣘ৘द ஭ର $"15$)"

য࠭੷੄࠺ਊਸૐоदఅࢤഝࣘ৘द ஭ର $"15$)" ௏٘դةച VHMJGZ

য࠭૚ݒ୓ $53 Ѣ૙ ౟ې೗೙ਃ ಁఢରױ   $53 ҟҊয࠭੷੄࠺ਊਸૐоदఅ৘द ੷൞੄؀਽
য࠭૚ݒ୓੄؀਽ $53$MJDL7JTJU

য࠭૚ݒ୓ $53 Ѣ૙ ౟ې೗೙ਃ ಁఢରױ   $53 য࠭૚ݒ୓ח؀۝੄EFWJDF৬ѐߊ੗о೙ਃೣ ->
࠺ਊ࢚थ -> ࣻ੊ࢿঈച ҟҊয࠭੷੄࠺ਊਸૐоदఅ৘द ੷൞੄؀਽ য࠭૚ݒ୓੄؀਽

೙ఠ݂Ѿ੿ ఐ૑੿ഛب ఐ૑࠺ਊ ت दр زੌಁఢী؀ೠఐ૑੹ۚ بݫੋ੹ޙо੄౸ױ ݒ਋֫਺ ࠺ऱҊदр੉׮ࣗѦܿ
૒੽زੌೠ࠙ࢳ૓೯೙ਃ   ૑োߊࢤ ੗زചػѾ੿ SVMF - CBTFE .- ֫਺ ੷۴ೞҊࡅܴ पदрژח઱ӝ੸ੋఐ૑

ҟҊয࠭૚ ޙઁࢸݺ߂੿੄ Ӓې೐ҳ୷ য࠭੷ҵఐ૑ݽ؛ Ѿҗয࠭੷ҵ੄ౠࢿ Ѿۿ

ҊبചغחҟҊয࠭૚ ݒ୓ ߑޙࣻ ௿ܼࣻ $US "
௿ܼ ߑޙ

ҊبചغחҟҊয࠭૚౟ې೗טܻӝ ݒ୓ ߑޙࣻ ௿ܼࣻ $US "
௿ܼ ߑޙ ߑޙ

ҊبചغחҟҊয࠭૚ӏݽ੄҃ઁपഅ ݒ୓ ߑޙࣻ ௿ܼࣻ $US "
# $ ௿ܼ ߑޙ ߑޙ

ಁఢয࠭੷ٜ਷য࠭૚ݒ୓ী؀ೠҕాߑޙ੉݆׮ ࠺Ү؀࢚ݒ୓ Ҁ஖חਬ੷࠺ਯ "#64*/( ֫਺ #*( ֫਺ "#64*/( ઺р
"#64*/( ઺р "#64*/( ઺р ࠺Ү؀࢚ݒ୓ Ҁ஖חਬ੷࠺ਯ #*( ֫਺ #*( ઺р #*( ծ਺ #*( ծ਺ #*( ݒ਋ծ਺ ౠ੿য࠭૚ݒ୓"#64*/( ౠ੿੿࢚ݒ୓/03."-

ҊبചغחҟҊয࠭૚Ҁஜ࠺ਯ઴੉ӝ ݒ୓ ߑޙࣻ ௿ܼࣻ $US "
# $ ௿ܼ ߑޙ ߑޙ

ಁఢ੿࢚ਬ੷ٜ਷য࠭૚ݒ୓ܳѢ੄ߑޙೞ૑ঋ਺ j j j ௿ܼ ߑޙ ߑޙ

ಁఢ੿࢚ਬ੷ٜ਷য࠭૚ݒ୓ܳѢ੄ߑޙೞ૑ঋ਺ Ҋ݀ؽ j j j ௿ܼ ߑޙ ߑޙ

઱੄ࢎ೦য࠭੷ٜب੿࢚ݒ୓ܳ੉ਊೣ j j j ௿ܼ ߑޙ ߑޙ

઱੄ࢎ೦ஶబஎоਬࢎೠݒ୓ՙܻبҕాߑޙ੉݆਺ j j j ௿ܼ ߑޙ ߑޙ

য࠭੷ಁఢઙ೤ ಁఢয࠭੷ٜ਷য࠭૚ݒ୓ী؀ೠҕాߑޙ੉݆਺ ಁఢ੿࢚੸ੋਬ੷ٜ਷য࠭૚ݒ୓ܳѢ੄ߑޙೞ૑ঋ਺ ઱੄ࢎ೦ য࠭੷ٜب੿࢚ݒ୓ܳ੉ਊೣ ஶబஎоਬࢎೠݒ୓ՙܻبҕాߑޙ੉݆਺

য࠭੷ಁఢઙ೤ ಁఢয࠭੷ٜ਷য࠭૚ݒ୓ী؀ೠҕాߑޙ੉݆਺ ಁఢ੿࢚੸ੋਬ੷ٜ਷য࠭૚ݒ୓ܳѢ੄ߑޙೞ૑ঋ਺ ઱੄ࢎ೦ য࠭੷ٜب੿࢚ݒ୓ܳ੉ਊೣ ஶబஎоਬࢎೠݒ୓ՙܻبҕాߑޙ੉݆਺ -> Ӓې೐ޙઁtਬ੷ݒ୓Ӓې೐uীࢲҊ݀ػয࠭੷ҵఐ૑

ਬ੷ݒ୓Ӓې೐ীࢲҊ݀ػয࠭੷ҵఐ૑ ޙઁ੿੄

Ӓې೐ై৔ ਬ੷ݒ୓ -> ݒ୓ݒ୓ ޙઁ੿੄ ਬ੷ݒ୓Ӓې೐ীࢲҊ݀ػয࠭੷ҵఐ૑

Ӓې೐ై৔ QSPKFDUJPO ݒ୓ ਬ੷ ݒ୓ ݒ୓ .PUJG tݒ୓ ->
ਬ੷ -> ݒ୓u " # $ " # $

Ӓې೐ై৔ QSPKFDUJPO ݒ୓ ਬ੷ ݒ୓ ݒ୓ .PUJG tݒ୓
-> ਬ੷ -> ݒ୓u " # $ " # $

ݒ୓ݒ୓۽ై৔ೞח੉ਬ ਬ੷ݒ୓ ਗࠄ ݒ୓ݒ୓ై৔ ਬ੷ਬ੷ై৔ ؘ੉ఠ֢੉ૉ ݆਺ ੸਺ ૘҅ബҗ
઺р Ӓې೐௼ӝ _# _. #_ दпചդ੉ب ઺р ए਑ HFQIJदпചో੉ਊоמ য۰਑ ੉࢚ఐ૑ۨಌ۠झ ݆਺ ૒ҙࢿ ݒ୓ݺਸాೠ૒ҙ੸੉೧оמ

য࠭੷ಁఢઙ೤tݒ୓ݒ୓uӒې೐ীࢲبध߹оמೠо ಁఢয࠭੷ٜ਷য࠭૚ݒ୓ী؀ೠҕాߑޙ੉݆਺ -> য࠭૚ݒ୓ՙܻҕਬػਬ੷੄࠺ਯ੉֫਺ ಁఢ੿࢚੸ੋਬ੷ٜ਷য࠭૚ݒ୓ܳѢ੄ߑޙೞ૑ঋ਺ -> য࠭૚ݒ୓ҵ੉Ҋ݀ؽ ઱੄ࢎ೦ য࠭੷ٜب੿࢚ݒ୓ܳ੉ਊೣ
ஶబஎоਬࢎೠݒ୓ՙܻبҕాߑޙ੉݆਺ فಁఢݽفݒ୓ݒ୓ై৔Ӓې೐ীࢲয࠭૚ݒ୓ՙܻޡ஖ѱ݅٘חਃࣗ -> Ҋ݀غחݒ୓ҵఐ૑ ழޭפ౭ఐ૑ -> ঈࢿழޭפ౭ध߹

Ӓې೐ై৔ ਬ੷ݒ୓ -> ݒ୓ݒ୓ ޙઁ੿੄ ਬ੷ݒ୓Ӓې೐ীࢲҊ݀ػয࠭੷ҵఐ૑ ݒ୓ݒ୓Ӓې೐ীࢲঈࢿழޭפ౭ఐ૑

بݫੋ૑धਸഝਊೠ੹୊ܻ दпചبҳHFQIJ ݒ୓ݒ୓Ӓې೐ҳ୷ (SBQI'SBNFTNPUJG   0 O? ->
0 O

ҕాߑޙ࠺ਯച ݒ୓ ݒ୓ " #
$ ݒ୓ ݒ୓ " # $ ਬ੷ࣻݺ ਬ੷ࣻݺ

Ӓې೐࢓ಝࠁӝ ҕాߑޙ࠺ਯ੘਷ч ҕాߑޙ࠺ਯ௾ч

ಁఢҕాߑޙ੉݆׮ ੿࢚ য࠭૚ $ " #

ಁఢয࠭૚ݒ୓ҵ੉Ҋ݀ؽ ੿࢚ য࠭૚

ಁఢҊ݀ؽ ੿࢚ য࠭૚ ழޭפ౭ఐ૑ܳా೧੿࢚җয࠭૚ݒ୓ҵܻ࠙оמ ޙઁ೧Ѿ੄оמࢿߊѼ

7JFX ழޭפ౭ఐ૑ ݒ୓ݒ୓ Ӓې೐ য࠭੷೙ఠ݂ ਗࠄ۽Ӓ ঈࢿ ழޭפ౭࠙ܨ য࠭੷ҵఐ૑ݽ؛

ழޭפ౭ఐ૑ঌҊ્ܻ8$$ 8FBLMZ$POOFDUFE$PNQPOFOU 8$$
੿࢚ҵ য࠭੷ҵ

ழޭפ౭ఐ૑ঌҊ્ܻ8$$ ҕాߑޙ࠺ਯ੘਷ч ҕాߑޙ࠺ਯ௾ч

ழޭפ౭ఐ૑ঌҊ્ܻ4$$ 4USPOHMZ$POOFDUFE$PNQPOFOU 4$$
੿࢚ҵ য࠭੷ҵ

ழޭפ౭ఐ૑ঌҊ્ܻ4$$ 4USPOHMZ$POOFDUFE$PNQPOFOU 4$$
੿࢚ҵ য࠭੷ҵ ୭ઙழޭפ౭ఐ૑ঌҊ્ܻ4$$

ழޭפ౭ఐ૑ঌҊ્ܻ4$$ 4$$ TUSPOHMZ

੿࢚җঈࢿழޭפ౭ܳ࠙ܨೞӝ

੿࢚җঈࢿழޭפ౭࠺Ү WT

ঈࢿழޭפ౭࠙ܨӝળ ঈࢿழޭפ౭ח ழޭפ౭ղࠗোѾبо૑ա஖ѱ֫਺ ũDPOOFDUJWJUZ ੿࢚ݒ୓੉ਊ੗ٜ੉ߑޙೡഛܫ੉ծ਺ ũQFSTPOBMJ[FEQBHFSBOL ࣗࣘػݒ୓੄੉ਓٜՙܻ੄োѾبо֫਺   ũDMVTUFSJOHDPFG
fi DJFOU WT

tࣗࣘػݒ୓੄੉ਓٜՙܻ੄োѾبо֫਺u ஶబஎ੄ਬࢎبо֫਷ݒ୓ٜ ੿࢚

tࣗࣘػݒ୓੄੉ਓٜՙܻ੄োѾبо֫਺u ੉ਓݒ୓ٜ੉׮নೣ ੿࢚ ੉ਓݒ୓оೠ੿ؽ য࠭੷

য࠭੷ҵఐ૑ݽ؛QTFVEPDPEF abusers = ∅ USER_MEDIA_GRAPH = CREATE_GRAPH(traffic_log) MEDIA_MEDIA_PROJECTED_GRAPH =
PROJECTION(USER_MEDIA_GRAPH, motif = “m->u->m") communities = SCC(MEDIA_MEDIA_PROJECTED_GRAPH) abusive_communities = ABUSIVE_COMMUNITY_DETECTION(communities, parameters)

য࠭੷ҵఐ૑ݽ؛QTFVEPDPEF abusers = ∅ USER_MEDIA_GRAPH = CREATE_GRAPH(traffic_log) MEDIA_MEDIA_PROJECTED_GRAPH =
PROJECTION(USER_MEDIA_GRAPH, motif = “m->u->m") communities = SCC(MEDIA_MEDIA_PROJECTED_GRAPH) abusive_communities = ABUSIVE_COMMUNITY_DETECTION(communities, parameters) FOR each community ∈ abusive_communities DO abusers = abusers ∪ ABUSER_DETECTION(community) END FOR RETURN abusers

Ѿҗ بݫੋ੹ޙо੄੿ࢿ੸੿۝੸࠙ࢳਸ߄ఔਵ۽ղࠗ੸ਵ۽য࠭૚੄बनҊغ঻؍ݒ୓ٜ੉੗زఐ૑ؽ ݒ׳नӏݒ୓оߊѼؽ ৉ਵ۽೧׼ӝߨ੉଺਷ݒ୓ٜਸѨࣻೠѾҗয࠭૚ݒ୓۽౸߹

ߑޙപࣻ੗୓о݆਺ ೞܖী؊׮নೠݒ୓ܳߑޙೣ য࠭੷ҵ੄ౠࢿ

$53਷؊ծ਺ য࠭੷ҵ੄ౠࢿ

ҟҊয࠭૚ ޙઁࢸݺ߂੿੄ Ӓې೐ҳ୷ ঈࢿਬ੷ҵఐ૑ݽ؛ Ѿҗঈࢿਬ੷ҵ੄ౠࢿ Ѿۿ

Ѿۿ Ӓې೐ޙઁ۽߸ജೞৈ೧Ѿ -> tழޭפ౭ఐ૑ܙӝ߈uਵ۽୽࠙൤ఐ૑оמ ৆૑ா੉झ୊ܻܳੜ೧઱যঠೣ ঈࢿ -> ੉࢚஖ ੉࢚஖
-> ঈࢿ য࠭૚਷ט૓ചೞৈ೦࢚؀୊೧ঠೣয࠭੷оࣻ੊ࢿਸ੏ਸٸө૑ࣿې੟ӝ ׮ܲبݫੋীࢲب੸ਊоמtਬ੷ݒ୓u -> tਬ੷࢚ಿuਵ۽ҙ҅ܳ߄Բݶ׮ܲޙઁ۽ഛ੢оמೣ

بݫੋ؀஖ j j j

খਵ۽੄ߑೱ Ӓې೐ై৔ QSPKFDUJPO ߑߨҊبച ੐߬٬ਸഝਊೞৈtਬ੷ݒ୓uਗࠄӒې೐ীࢲ੉࢚ఐ૑ (// (SBQI/FVSBM/FUXPSL UFNQPSBMӒې೐੉࢚ఐ૑ द҅ৌӝ߈੉࢚ఐ૑

ଵҊޙ೴ $MBVEJB1FSMJDI 6TJOHDP - WJTJUBUJPOOFUXPSLTGPSEFUFDUJOHMBSHFTDBMFPOMJOFEJTQMBZBEWFSUJTJOHFYDIBOHFGSBVE ֙ ;IVP8BOH
%FUFDUJOH3FWJFX4QBNNFS(SPVQTWJB#JQBSUJUF(SBQI1SPKFDUJPO ֙ 4VEJQUB$IPXEIVSZ #PUOFUEFUFDUJPOVTJOHHSBQICBTFEGFBUVSFDMVTUFSJOH ֙ +JOMPOH)V ('%"8FJHIUFE)FUFSPHFOFPVT(SBQI&NCFEEJOH#BTFE"QQSPBDIGPS'SBVE%FUFDUJPOJO.PCJMF"EWFSUJTJOH ֙ $MFBSDPEF 5IF"E5FDI#PPLCZ$MFBSDPEF ੢5IF$PTUPG"E'SBVE ֙ $IBSU$"HHBSXBM 0VUMJFS - "OBMZTJT OE&EJUJPO ੢0VUMJFS%FUFDUJPOJO(SBQITBOE/FUXPSLT ֙ 'PSCFT#FODINBSLTGPSBEGSBVE7JFXBCJMJUZBOEBECMPDLJOH ֙

2" ҙ҅ܳࠁ૑ঋਵݶޙઁبউࠁੌࣻ੓णפ׮   Ӓې೐חҙ҅ܳ٘۞շפ׮

그래프 기반 악성 유저군 탐지: 온라인 광고 도메인에서의 적용

그래프 기반 악성 유저군 탐지: 온라인 광고 도메인에서의 적용

More Decks by kakao

Other Decks in Programming

Featured

Transcript