CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority under 35 U.S.C. §119 to Korean Patent Application No. 10-2012-0106449, filed on Sep. 25, 2012, the disclosure of which is incorporated herein by reference in its entirety. 
       TECHNICAL FIELD 
       [0002]    The present invention relates to a data monitoring method, and in particular, to an apparatus and method for monitoring web application telecommunication data by user, which monitor web application telecommunication data. 
       BACKGROUND 
       [0003]    Recently, business systems within an organization are constructed with web applications and used for tasks. Moreover, since security accidents using the web applications occur frequently, web application telecommunication data are monitored. 
         [0004]    A related art monitoring system performs an access control and an audit trail on web application telecommunication data by web client user on the basis of user identification information. 
         [0005]    As an example, a related art system extracts user identification information using an Internet Protocol (IP) address of a web client. However, a plurality of web client users use the same IP address or IP addresses are dynamically changed in a network environment such as Dynamic Host Configuration Protocol (DHCP), Network Address Translation (NAT), or Virtual Private Network (VPN). Thus, it is difficult to extract user identification information from the IP address of the web client. 
       SUMMARY 
       [0006]    Accordingly, the present invention provides an apparatus and method for monitoring web application telecommunication data by user, which monitor web application telecommunication data by user with an identification information profile. 
         [0007]    In one general aspect, an information identification apparatus includes a collector collecting web application telecommunication data transmitted and received between a web server and a web client; a storage storing an identification information profile about a method of extracting user identification information by web server; and an extractor selecting user login-related web application telecommunication data among the web application telecommunication data with reference to the identification information profile, extracting a [web server address, login session identification information, and user identification information] list from the selected web application telecommunication data, extracting at least one piece of information of the web server address and the login session identification information from the web application telecommunication data after the user login, and determining whether the extracted information is matched with at least one piece of information in the list. 
         [0008]    Other features and aspects will be apparent from the following detailed description, the drawings, and the claims. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]      FIG. 1  is a block diagram illustrating an information identification apparatus according to an embodiment of the present invention. 
           [0010]      FIGS. 2A and 2B  is a flowchart illustrating a user identification method according to an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS 
       [0011]    The advantages, features and aspects of the present invention will become apparent from the following description of the embodiments with reference to the accompanying drawings, which is set forth hereinafter. The present invention may, however, be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present invention to those skilled in the art. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms “a,” “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. 
         [0012]    Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. 
         [0013]      FIG. 1  is a block diagram illustrating an information identification apparatus according to an embodiment of the present invention. 
         [0014]    Referring to  FIG. 1 , an information identification apparatus  10  according to an embodiment of the present invention includes a collector  110 , a storage  130 , and an extractor  120 . 
         [0015]    The collector  110  collects web application telecommunication data that are transmitted and received between a web client and a web server and include web client request data and web server response data, in a proxy scheme, an inline scheme, or a minoring scheme. 
         [0016]    The storage  130  stores an identification information profile in which a method of extracting user identification information in each web server has been defined. 
         [0017]    Here, the identification information profile includes at least one of: URL information of user login web client request data including user identification information and an address of the web server; a parameter name (parameter name for user identification information) of the user login web client request data including the user identification information; and a cookie name (cookie name for login session identification information) of web server response data corresponding to web client request data including login session identification information. 
         [0018]    The extractor  120  analyzes the collected web application telecommunication data with reference to an identification information profile, and extracts a [web server address, login session identification information, and user identification information] list from web client request data and web server response data through the following operations {circle around (1)}, {circle around (2)}, and {circle around (3)}. 
         [0019]    {circle around (1)} Operation of Extracting User Identification Information 
         [0020]    Specifically, the extractor  120  checks at least one of the web server address and URL information of the collected web client request data, and determines whether at least one of the checked web server address and URL information is the user login web client request data corresponding to the identification information profile. 
         [0021]    When corresponding web client request data is the user login web client request data, the extractor  120  extracts a parameter value, corresponding to a parameter name for user identification information based on the identification information profile, as user identification information. 
         [0022]    {circle around (2)} Operation of Extracting Login Identification Information 
         [0023]    The extractor  120  finds a cookie value corresponding to a cookie name for user login session identification information based on the identification information profile, in user login web server response data corresponding to the collected user login web client request data. 
         [0024]    The extractor  120  checks the login session identification information in the cookie value, and stores the checked login session identification information together with the user identification information and web server address of the user login web client request data. That is, the extractor  120  stores the [web server address, login session identification information, and user identification information] list. 
         [0025]    {circle around (3)} Operation of Matching User Identification Information 
         [0026]    The extractor  120  checks a web server address and login session identification information that is a cookie value corresponding to a cookie name for login session identification information, in web client request data collected after the login of a user. And the extractor  120  compares the checked address and information with the stored [web server address, login session identification information, and user identification information] list to match user identification information. 
         [0027]    At this point, when information in the stored [web server address, login session identification information, and user identification information] list is matched with the web server address and login session identification information of web client request data after the login of the user, the extractor  120  or another element (not shown) may check a user of the web client request data after the login of the user on the basis of user identification information in the list. Therefore, the extractor  120  or the other element (not shown) checks web client request data by user, and performs at least one of an audit trail and an access control. 
         [0028]    As described above, the information identification apparatus  10  may check web application telecommunication data by user through the above-described operations, and perform an audit trail and an access control. 
         [0029]    Hereinafter, a user identification method according to an embodiment of the present invention will be described with reference to  FIG. 2A and 2B . 
         [0030]      FIG. 2A and 2B  is a flowchart illustrating a user identification method according to an embodiment of the present invention. 
         [0031]    Referring to  FIG. 2A and 2B , the information identification apparatus  10  determines whether web client request data is included in collected web application telecommunication data in operation S 210 . 
         [0032]    The information identification apparatus  10  checks at least one of a web server address and URL information of the web client request data, and compares at least one of the checked web server address and URL information with URL information based on an identification information profile, in operation S 220 . 
         [0033]    The information identification apparatus  10  determines whether the collected web client request data are the user login web client request data in operation S 230 . At this point, when compares the at least one of the web server address and URL information is matched with URL information the user login web client request data based on the identification information profile, the information identification apparatus  10  may determine corresponding data as the user login web client request data. 
         [0034]    When the collected web client request data are the user login web client request data, the information identification apparatus  10  extracts a parameter value, corresponding to a parameter name for user identification information based on the identification information profile, as user identification information in operation S 240 . 
         [0035]    Subsequently, the information identification apparatus  10  determines whether there are user login web server response data corresponding to the collected web client request data in operation S 250 . 
         [0036]    In operation S 260 , the information identification apparatus  10  checks login session identification information in a cookie value corresponding to a cookie name for login session identification information based on the identification information profile, in the user login web server response data. 
         [0037]    In operation S 270 , the information identification apparatus  10  stores a [web server address, login session identification information, and user identification information] list. 
         [0038]    When web client request data after the login of the user are collected, the information identification apparatus  10  checks a web server address and a cookie value corresponding to a cookie name for login session identification information to determine login session identification information in operation S 280 . 
         [0039]    In operation S 290 , the information identification apparatus  10  matches the web server address and login session identification information after the login of the user with the stored [web server address, login session identification information, and user identification information] list. 
         [0040]    At this point, when information in the stored [web server address, login session identification information, and user identification information] list is matched with a web server address and login session identification information of web client request data after the login of the user, the information identification apparatus  10  checks user identification information of the web client request data. Subsequently, the information identification apparatus  10  or another element (not shown) may check corresponding web client request data by user on the basis of the user identification information of the checked web client request data, and perform an audit trail and an access control. 
         [0041]    As described above, the present invention can extract web client user identification information from web application telecommunication data and support an access control or an audit trail for each web client user, even in a network environment (including DHCP, NAT, or VPN) or an environment in which user identification information is not included in cookie information of web client request data. 
         [0042]    Moreover, the present invention decrypts a plain text included in cookie information of web client request data or decrypts encrypted user identification information, thereby identifying a user. Also, even when cookie information includes only login session identification information without user identification information for security reasons, it is able to extract the user identification information. 
         [0043]    A number of exemplary embodiments have been described above. Nevertheless, it will be understood that various modifications may be made. For example, suitable results may be achieved if the described techniques are performed in a different order and/or if components in a described system, architecture, device, or circuit are combined in a different manner and/or replaced or supplemented by other components or their equivalents. Accordingly, other implementations are within the scope of the following claims.
Provided are an apparatus and method for monitoring web application telecommunication data by user. An information identification apparatus includes a collector collecting web application telecommunication data transmitted and received between a web server and a web client; a storage storing an identification information profile about a method of extracting user identification information by web server; and an extractor selecting user login-related web application telecommunication data among the web application telecommunication data with reference to the identification information profile, extracting a [web server address, login session identification information, and user identification information] list from the selected web application telecommunication data, extracting at least one piece of information of the web server address and the login session identification information from the web application telecommunication data after the user login, and determining whether the extracted information is matched with at least one piece of information in the list.