Device and method for tracking roundabout address of overseas illegal website

Abstract

The invention provides a roundabout address tracking device and a roundabout address tracking method for overseas illegal websites. According to the present invention, on a device for tracking the roundabout address of an overseas illegal website, a data collection unit collects an hour URL change history of at least one illegal website; a learning unit that analyzes the relationship between the pre-change URL and the post-change URL from the URL change history of the time period by machine learning to learn the domain change pattern of the illegal website and construct a domain tracking model; the data input part is used for inputting an existing URL (Uniform Resource Locator) of the tracked illegal website; and applying the existing URL to the learned domain tracking model, including a tracking part, obtaining at least one roundabout URL predicted to be changed in the existing URL through a prediction result, and providing a predicted roundabout URL list. According to the method and the device, the roundabout URL of the overseas illegal website can be predicted based on artificial intelligence, and the next URL address which is expected to be opened after blocking is actively tracked and acquired.

Description

Technical Field

[0001] The present invention relates to a device and method for tracking detour addresses of overseas illegal websites, and more particularly, to a device and method for tracking detour addresses of overseas illegal websites, which can predict detour URLs of overseas illegal websites based on artificial intelligence and actively track the following URL addresses. Background Art

[0002] Recently, setting up overseas servers using webtoons, streaming media, Torrents, etc. or operating websites that illegally infringe copyright using cloud services has become a social focus.

[0003] Taking overseas cloud services as an example, due to the limitations of the application of domestic laws and active investigations, blocking domestic inflows has become a practical countermeasure rather than direct investigations.

[0004] However, on most illegal websites, if the URL is blocked, a detour website will be immediately opened and the service will continue.

[0005] In the country, in order to cut off the connection to overseas illegal websites, it is necessary to review the deliberation of the censorship committee, which takes at least three months. In addition, if the blocked website bypasses and resumes service, it takes about 3 to 7 days for reconfirmation and re-blocking.

[0006] Recently, illegal websites automatically change their URL addresses within 3 to 5 days, and the efficiency of blocking is very low.

[0007] If in the initial stage, URL changes used the method of sequentially increasing numbers from copytoon, such as copytoon1, copytoon 2, copytoon 3, etc., then recently it has evolved into a method of jumping numbers such as from copytoon 34 to copytoon 100, etc.

[0008] Therefore, in order to effectively block URLs, a technology that can actively track detour sites and obtain the following URLs is needed.

[0009] The technology that is the background of the present invention is initiated in Korean Patent Publication No. 10-2016-0028709 (published on March 14, 2016). Summary of the Invention

[0010] Problems to be Solved by the Invention

[0011] The present invention aims to provide a device and method for tracking detour addresses of overseas illegal websites, which can predict detour URLs of overseas illegal websites based on artificial intelligence, actively track and ensure the next URL address expected to be opened after interception.

[0012] Means for Solving the Problems

[0013] The present invention is a data collection unit, a device for tracking the circumvention addresses of overseas illegal websites, which collects the hourly URL change history of at least one illegal website; a learning unit analyzes the relationship between the URL before change and the URL after change from the URL change history during the above period through machine learning to learn the domain change pattern of the above illegal website and constructs a domain tracking model; a data input part inputs the existing URL of the illegal website to be tracked; and applies the above existing URL to the learned above domain tracking model, including a tracking part, which obtains at least one bypass URL expected to be changed from the above existing URL through the prediction result and provides a list of expected bypass URLs.

[0014] In addition, the above tracking part can sort the above multiple bypass URLs in descending order of probability values according to the specific probability values of the multiple bypass URLs obtained from the above domain tracking model and provide a list.

[0015] In addition, the above tracking part can filter out the top N credible bypass URLs with probability values higher than the set value according to the specific probability values of the multiple bypass URLs obtained from the above domain tracking model and provide them as a list.

[0016] In addition, the above domain change pattern may include at least one of whether the parameters of the interest parameters in the text of the URL change, the parameter change pattern, the parameter change period, whether the position between different interest parameters changes, the position change pattern, and the site nature of the URL, and the above interest parameters may include at least one of numbers, characters, and top-level domains (top-level domain, TLD) existing in the text of the URL.

[0017] In addition, for the above domain change pattern, if the above interest parameter is a number, it may include at least one of a number increase mode, a number decrease mode, a number change period, a fixed number increase or decrease range, and a time series variable number increase or decrease range.

[0018] In addition, the above learning unit can also assign higher weights to the datasets collected recently during the setting period to continuously learn and update the above domain tracking model.

[0019] In the present invention, in the detour addressing method executed by the detour addressing device of overseas illegal websites, at least the hourly URL change history of one illegal website is collected; through machine learning, the relationship between the URL before change and the URL after change is analyzed from the URL change history records of the above time period to learn the domain change pattern of the above illegal website, and the step of constructing a domain tracking model; the step of obtaining the existing URL of the illegal website to be tracked; and applying the above existing URL to the above learned domain tracking model, including obtaining at least one detour URL expected to change from the above existing URL through the prediction result, and providing a list of expected detour URLs.

[0020] In addition, the above detour address tracking method may further include the step of purchasing and preempting selected partial detour URLs in the above list of expected detour URLs before the illegal website occupies them.

[0021] Advantages of the Invention

[0022] According to the present invention, the detour URLs of overseas illegal websites can be predicted based on artificial intelligence, and the next expected URL address to be opened after shielding can be actively tracked and obtained.

[0023] At the same time, the present invention further verifies whether the tracked URL address is the same as the existing URL address, thereby ensuring the reliability of the domain tracking model, and being able to effectively track and quickly intercept illegal infringement websites with continuously changing domains.

[0024] It is worth mentioning that the present invention can change the URL address at any time through overseas servers, effectively identify, track and block overseas illegal copyright infringement websites that illegally circulate copyright infringement objects through detour websites, enabling it to quickly respond to copyright infringement and activate the copyright circulation ecosystem. Description of the Drawings

[0025] Figure 1 Shows the composition diagram of the overseas illegal website detour address tracking device according to an embodiment of the present invention.

[0026] Figure 2 Is an example graph showing the domain change pattern of an illegal website.

[0027] Figure 3 Is an exemplary graph showing the way of performing identity verification by calculating hash values.

[0028] Figure 4 Is a graph illustrating the way of performing identity verification using advertisements or logos.

[0029] Figure 5 Illustrates using Figure 1 The device of tracks the detour address of overseas illegal websites.

[0030] Explanation of Reference Numerals

[0031] 100: Bypassing Address Tracking Device for Overseas Illegal Websites

[0032] 110: Data Collection Unit 120: Learning Unit

[0033] 130: Data Input 140: Tracking

[0034] 150: Verification Unit Detailed Implementation Manner

[0035] Then, with reference to the attached drawings, for the embodiments of the present invention, those with ordinary knowledge in the technical field to which the present invention pertains can easily implement it in detail. However, the present invention can be embodied in many different forms and is not limited to the embodiments described herein. To clearly illustrate the present invention in the drawings, parts irrelevant to the description are omitted, and similar parts are marked with similar reference numerals throughout the specification.

[0036] Throughout the specification, when it is said that a certain part is "connected" to another part, this includes not only the case of "direct connection", but also the case of "electrically connected" with other elements intervening in between. In addition, when a certain part "includes" a certain component, this means that more other components can be included, rather than excluding other components, unless there is a particularly contrary record.

[0037] The present invention relates to the technology of bypassing address tracking for overseas illegal websites, and proposes a technology for predicting the bypassing URL of overseas illegal websites based on artificial intelligence, actively tracking and obtaining the next expected URL address newly opened after shielding.

[0038] Figure 1 Shows a block diagram of the bypassing address tracking device for overseas illegal websites according to an embodiment of the present invention.

[0039] As Figure 1 shown, according to an embodiment of the present invention, the bypassing address tracking device 100 for overseas illegal websites includes a data collection unit 110, a learning unit 120, a data input unit 130, a tracking unit 140, and may further include a verification unit 150. Among them, the operations of each part 110 - 150 and the data flow between each part can be controlled by a controller (not shown).

[0040] The data collection unit 110 collects the hourly change history of the URLs of at least one illegal website.

[0041] In the embodiments of the present invention, overseas illegal websites may include illegal infringement websites that set up servers overseas or use cloud services, illegal service webcomics, TV dramas, movies, etc., as well as illegal websites related to entertainment such as games and gambling.

[0042] The data collection unit 110 can input and collect the URL change history data of multiple illegal websites through a user terminal or the like. The collected data is used for machine learning.

[0043] The learning unit 120 will analyze the data collected by the data collection unit 110 based on machine learning, and learn the domain tracking model according to the input current URL to predict the next expected detour URL to be opened.

[0044] Specifically, the learning unit 120 can analyze the relationship between the URL before change and the URL after change from the URL change history of each past time period collected from illegal websites through machine learning, learn the domain change pattern of illegal websites, and construct a domain tracking model.

[0045] The domain name change patterns of illegal websites may be diverse. In an embodiment of the present invention, the domain change patterns analyzed by machine learning may include a parameter of whether to change an interested parameter within the URL text, a pattern of changing the parameter, a period of changing the parameter, whether the position changes between different types of interested parameters, a pattern of changing the position, and one of the site natures of the URL.

[0046] Among them, the interested parameters may include at least one of numbers, characters, and top-level domains (top-level domains, TLDs) existing in the URL text. In addition, the site nature is related to the types of service contents provided by the website of the URL, and can be divided into entertainment, gambling, games, web comics, TV dramas, etc. According to the nature of the website, the preferred domain change method may be different, so the nature of the website may also be included in the learning pattern.

[0047] If the interested parameter is a number, the domain change pattern may include a number increase pattern, a number decrease pattern, a number change period, a fixed number increase or decrease amplitude, a number increase or decrease amplitude that changes in chronological order, etc.

[0048] Figure 2 is an example graph showing the domain change pattern of an illegal website. These Figure 2 show 10 typical cases.

[0049] First, in the first case, the number contained in the domain of the URL will be changed in a pattern of increasing by 1, and the URL after change is equivalent to adding 1 to the URL before change (before change: agit248.com, after change: agit249.com).

[0050] No. 2 shows how to change the domain to clear the rear part of the URL top-level domain (TLD), which is equivalent to deleting the rear address after the slash after "com". No. 3 is a variant example of No. 1, which is equivalent to a pattern of increasing the number by 2.

[0051] For No. 4, only the TLD is changed. If the top-level domain (TLD) is changed from org to cc (before change: tvhot.org, after change: tvhot.cc). No. 5 is equivalent to a change mode with a significant increase in numbers, and No. 6 shows a mode with a clustered increase in repeated numbers within the URL.

[0052] For No. 7, it is the situation of preempting 2 URLs simultaneously. If one of them is blocked, the other is bypassed for service. For No. 8, the positions of the numbers and characters constituting the URL change, and the numbers also belong to the changing mode.

[0053] For No. 9, it is the situation of serving similar domain names with the same domain name. In this case, it is also equivalent to preempting two domain names simultaneously. At the same time, No. 10 is equivalent to having more than two composite modes, which is equivalent to a combination of number change and TLD change.

[0054] Since it is actually unknown which domain change mode the illegal website will adopt, in this embodiment, it can let you learn the quantities of all modes. At the same time, by collecting and analyzing the recent domain change history records, model design can be carried out to preferentially apply the high-probability modes reflecting the recent trends.

[0055] The learning unit 120 can assign higher weights to the dataset recently collected during the setting period, so as to continuously learn and update the domain tracking model. In this case, by further reflecting the recent address modification trends and patterns, the performance and reliability of the domain tracking model can be improved.

[0056] In an embodiment of the present invention, the learning unit 120 can learn the domain tracking model based on deep learning algorithms and use various published machine learning algorithms. For example, DNN (Deep Neural Network), Recurrent Neural Network (RNN), Logistic Regression (LR) algorithms, etc. can all be applied.

[0057] The learning unit 120 can separately learn the URL change history data of each illegal website and construct multiple domain tracking models applicable to each website, but it can also comprehensively learn the URL change history data of all illegal websites and construct a domain tracking model applicable to the entire website.

[0058] After the model is completed by learning, prediction results can be provided to handle the input of the existing URL information of the tracked illegal website, so as to predict the detour URL address that may change.

[0059] To this end, the data input section 130 receives the existing URL of any illegal website to be tracked and passes it to the tracking section 140. Among them, the existing URL may correspond to the URL information before the address of the illegal website is changed.

[0060] The tracking unit 140 can apply the existing URL to the learned domain tracking model based on artificial intelligence, obtain at least one detour URL expected to be changed from the existing URL through the prediction result, and provide a list of detour expected URLs.

[0061] Similarly, according to an embodiment of the present invention, by introducing artificial intelligence, the learning-based detour site tracking algorithm can be utilized to maximize efficiency.

[0062] Among them, the tracking unit 140 can sort the above-mentioned multiple detour URLs in descending order according to the specific probability values of the multiple detour URLs obtained by the domain tracking model, and provide a list.

[0063] At the same time, the tracking unit 140 can filter out the top N reliable detour URLs with the above probability values higher than the set value according to the specific probability values of the multiple detour URLs obtained by the domain tracking model, and provide them as a list.

[0064] In addition, the tracking unit 140 can also purchase and preempt some of the detour URLs selected in the list of expected detour URLs before the illegal website is occupied. Among them, some of the URLs selected in the list may correspond to the detour URLs that are not currently occupied and are expected to be occupied in the future. In the list of detour expected URLs, they are likely to be the top-ranked URLs.

[0065] In an embodiment of the present invention, a process of verifying whether the detected detour URL is the same as the existing URL can be performed.

[0066] To this end, the verification unit 150 verifies the domain tracking result by judging whether the sites between the tracked detour URL and the existing URL are the same.

[0067] Here, the verification unit 150 can perform the similarity verification of the site between the most prioritized detour URL and the existing URL in the "list of expected detour URLs" sorted in descending order of probability values. If the sites are the same, the similarity verification process can be ended. However, if it is found that the sites are not the same between the most prioritized detour URL and the existing URL, the next-order detour URL can be selected to perform the similarity verification of the site with the existing URL, and the process can be repeated when it is confirmed to be the same URL.

[0068] In an embodiment of the present invention, the verification unit 150 can determine whether the sites between the detour URL and the existing URL are the same by comparing the URL purchase times between the detour URL and the existing URL and at least one piece of feature information extracted from the URL connection page.

[0069] Here, the feature information may include at least one of a logo image, an advertisement image, and a hash value detected on the URL connection page.

[0070] Generally, in the case of an advertisement layout, sometimes advertisements are placed at designated positions, doubling each time the website is logged in. After the URL detour is opened, some changes may occur, such as adding new advertisements or terminating the release of advertisements with expired contract terms. However, if the same advertisement banner exists on the connection page, it has the same registration code and hash value. In addition, for the logo image, it always provides the same file at the same position, and the overall website layout and appearance also remain unchanged. Considering this, in an embodiment of the present invention, the verification unit 150 can extract features such as the logo or advertisement image, hash value, etc. displayed on the login page as feature information, and understand whether the websites are the same based on the comparison and matching of the feature information.

[0071] Among them, based on a pre-learned deep learning algorithm, the verification unit 150 can detect relevant feature information of advertisements or logo images from the connection page of the URL. At this time, in order to detect relevant features on the connection screen, a hash value calculation tool or a feature recognition algorithm such as CNN can be used.

[0072] By comparing this feature information, an example of website consistency verification is specifically described as follows:

[0073] Figure 3 is an exemplary graph showing the method of using hash value calculation for identity verification. Figure 3 In (a) of, it shows the method of calculating the hash value using the HashTab tool. The hash comparison of the file whose hash value needs to be confirmed can be performed by right-clicking > Properties > Running File Hash. At this time, the identity of the file can be determined by the MD5 hash value. The file to be the object of hash value detection can correspond to the logo or advertisement image file displayed on the connection screen. Figure 3 In (b) of, it shows the method of calculating the hash value using an online tool provided on the Web. By dropping the file whose hash value needs to be confirmed onto the Web to calculate the hash value and comparing the results, identity verification can be performed.

[0074] Figure 4 is a graph illustrating the method of using advertisements or logos for identity verification. In Figure 3In it, the connection screen via the existing URL address is shown on the left side, and the connection screen via the detour URL address is shown on the right side. At this time, the logo (MANATOON) in the upper left corner of the screen remains unchanged, and the layout of the advertisement changes slightly. At this time, if the feature similarity between the logo images exceeds the critical value, it can be considered that the logos are the same, and it can be determined that the two websites are the same; if the feature similarity between the provided advertisement banner images exceeds the critical value, it can be considered that the advertisements are the same, and the two websites can be identified as the same website. At this time, the result of confirming all the advertisement banners existing on the connection screen shows that if multiple matching advertisement banners meet the preset conditions, it can also be determined as the same website.

[0075] In addition, the verification unit 150 can determine that if the URL purchase time between the detour URL and the existing URL is the same, or the purchase time of the above detour URL is within the site blocking time of the above existing URL, the sites between the detour URL and the existing URL are the same.

[0076] Generally, the operators of illegal websites will uniformly purchase multiple similar URL addresses in advance to prevent the website from being blocked from access. Therefore, in the case where the purchase times of the two URLs are the same, they can be regarded as the same website. At the same time, if the website connection is blocked, there is also a tendency to repurchase similar URLs. Therefore, if the predicted detour URL is an address purchased and generated within a certain period of time (for example, within 3 days) after the existing URL is blocked, it can be regarded as the same website.

[0077] In addition, the verification unit 150 can determine that if the feature information detected on the URL connection page between the detour URL and the existing URL matches, the sites between the detour URL and the existing URL are the same.

[0078] Of course, in order to improve the accuracy of identity verification, if the URL purchase time between the detour URL and the existing URL is the same, or the purchase time of the detour URL is within the site blocking time of the above existing URL, and at the same time meets the condition that the feature information detected on the URL connection page matches, it can be determined that the sites between the detour URL and the existing URL are the same.

[0079] In addition, the verification unit 150 can also use the large amount of traffic flowing into illegal websites and the domain name change pattern to filter the situation where domain tracking is performed on a third-party advertising website that has nothing to do with the website. In addition, the verification unit 150 can confirm whether the website is an actual service-providing website or a website for notifying the detour address if the website announces the detour fact before the change. Similarly, the verification unit 150 can filter the third-party advertising website and distinguish the detour address announcement website.

[0080] According to an embodiment of the present invention, the detour address tracking device 100 can be a server or device for real-time predicting, verifying, monitoring, and surveilling illegal website detour addresses, or it can be a web or application-based application implemented on a user terminal. In this case, the terminal can be networked with the detour address tracking device 100 while running the application (application) to provide detour address tracking and verification services.

[0081] Figure 5 It illustrates the method of Figure 1 using the device to track the detour address of overseas illegal websites.

[0082] First, the data collection unit 110 collects the hourly URL change history S510 of at least one illegal website. Then, the collected data is transferred to the learning unit 120.

[0083] The learning unit 120 analyzes the relationship between the URLs before and after the change contained in the URL change history through artificial intelligence to construct a domain tracking model S520.

[0084] These learning groups 120 can use the time URL change history of illegal websites as learning data, and through artificial intelligence algorithms, generate a domain tracking model based on the currently input URL to predict the next expected at least one detour URL.

[0085] The model can be learned through deep learning by the learning unit 120, and the reliability of the model can be improved by learning the big data of the URL change history of one or more illegal websites.

[0086] After constructing the model through learning, as long as the existing URL information of the illegal website to be tracked is input into the model, the URL address that may be changed in the future can be predicted.

[0087] For this purpose, the data input section 130 will receive the existing URL of the illegal website to be tracked S530.

[0088] Then, the tracking unit 140 applies the existing URL of the target illegal website to be tracked to the pre-learned domain tracking model to obtain at least one predicted detour URL changed from the existing URL as a result S540.

[0089] Moreover, the tracking unit 140 provides a list of predicted bypass URLs of the target illegal website derived from the domain tracking model S550.

[0090] After that, the verification unit 150 will determine whether the tracked detour URL is the same as the existing URL to verify the domain tracking result obtained in the S540 stage S560.

[0091] According to the present invention described above, it is possible to predict the detour URL of overseas illegal websites based on artificial intelligence, actively track and obtain the expected next URL address after interception.

[0092] At the same time, by further verifying whether the tracked URL address is the same as the existing URL address, the reliability of the domain tracking model can be ensured, and effective tracking and rapid blocking of illegal infringement websites with continuously changing domains can be carried out.

[0093] In addition, the present invention can also change the URL address at any time through overseas servers, effectively recognize, track and block overseas illegal copyright infringement websites that illegally circulate copyright infringement objects through detour websites, enabling it to quickly respond to copyright infringement and activate the copyright circulation ecosystem.

[0094] The present invention has been described with reference to the embodiments shown in the drawings, but this is only an example. If you have the general knowledge in this technical field, you will understand that various modifications and other equivalent embodiments can be achieved therefrom. Therefore, the true technical protection scope of the present invention should be determined according to the technical idea of the appended patent application scope.

Claims

1. A device for tracking the indirect address of an overseas illegal website, wherein: The circuitous address tracking device of the overseas illegal website includes: The data collection department collects the time URL change history of at least one illegal website; A learning unit, which analyzes the relationship between the URL before the change and the URL after the change from the URL change history in the time period through machine learning to learn the domain change pattern of the illegal website and build a domain tracking model; A data input section for inputting an existing URL of an illegal website to be tracked; and The tracking unit applies the existing URL to the learned domain tracking model, obtains at least one detour URL that is expected to be changed from the existing URL through the prediction result, and provides a detour expected URL list.

2. The device for tracking the detour address of an overseas illegal website according to claim 1, wherein: The tracking unit sorts the plurality of detour URLs in order of higher probability values ​​based on the plurality of detour URL specific probability values ​​derived from the domain tracking model and provides a list.

3. The device for tracking the detour address of an overseas illegal website according to claim 1, wherein: The tracking unit screens and lists top N trusted detour URLs whose probability values ​​are higher than a set value based on a plurality of detour URL specific probability values ​​derived from the domain tracking model.

4. The device for tracking the detour address of an overseas illegal website according to claim 1, wherein: The domain change mode includes whether to change the parameters of the interested parameters in the URL text, the parameter change mode, the parameter change period, whether the positions between different interested parameters change, the position change mode and at least one site property of the URL, The interest parameter includes at least one of numbers, characters and top-level domains (TLD) present in the URL text.

5. The device for tracking the detour address of an overseas illegal website according to claim 4, wherein: In the domain change mode, if the parameter of interest is a number, the detour address tracking device includes at least one of a number increase mode, a number decrease mode, a number change cycle, a fixed number increase or decrease amplitude, and a number increase and decrease amplitude that changes in time sequence.

6. The device for tracking the detour address of an overseas illegal website according to claim 1, wherein: The learning unit continuously learns and updates the domain tracking model by assigning a higher weight to a learning dataset that has been recently collected within a set period.

7. A method for tracking a detour address, which is executed based on a detour address tracking device for an overseas illegal website, wherein: The detour address tracking method comprises: Steps to collect URL change history of at least one illegal website; The step of analyzing the relationship between the URL before the change and the URL after the change from the URL change history of the time period through machine learning, learning the domain change pattern of the illegal website, and building a domain tracking model; Steps for obtaining the existing URL of the illegal website being tracked; and The existing URL is applied to the learned domain tracking model, and at least one detour URL that is expected to be changed from the existing URL is obtained through prediction results, and a detour expected URL list is provided.

8. The method for tracing a detour address according to claim 7, wherein: In the step of providing the predicted bypass URL list, the list is provided by arranging the plurality of detour URLs in order of higher probability values ​​based on the plurality of detour URL-specific probability values ​​derived from the domain tracking model.

9. The method for tracing a detour address according to claim 7, wherein: In the step of providing the predicted bypass URL list, the list is provided by filtering the top N trusted bypass URLs exceeding the probability value setting values ​​based on the multiple bypass URL specific probability values ​​derived from the domain tracking model.

10. The method for tracing a detour address according to claim 7, wherein: The domain change mode includes whether to change the parameters of the interested parameters in the URL text, the parameter change mode, the parameter change period, whether the positions between different interested parameters change, the position change mode and at least one site property of the URL, The interest parameter includes at least one of a number, a character, and a top-level domain (TLD) in the tracking URL text.

Images