Method, device, and computer program for blocking illegal / harmful information sites using website source analysis

Abstract

To provide a method and device for blocking illegal / harmful information sites using website source analysis, which facilitate blocking harmful sites even if their URL addresses change.SOLUTION: A method for blocking illegal / harmful information sites using website source analysis according to one aspect of the present invention includes the steps of: analyzing a source of a target website requested for connection and obtaining unique information using a specific tag; referencing a harmful site DB in which information related to illegal / harmful information sites is constructed and determining whether the target website is a harmful site using the unique information; and allowing the connection to the target website if the target website is not a harmful site.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a method and device for blocking illegal and harmful information sites using website source analysis. [Background technology]

[0002] Content provided through the website may contain harmful content that may cause discomfort or have harmful effects. Illegal and harmful information sites that handle such harmful content include obscene, defamatory, fear-inducing, hacking, violent, illegal trade, anti-government, terrorist, and criminal sites. Most of these sites have servers located overseas and cannot be forcibly closed, so they are usually restricted by blocking access to the harmful sites.

[0003] Normally, methods for blocking access to harmful sites use URLs, DNS, etc. However, operators of harmful sites periodically change URL information and DNS information to avoid such blocking methods, making it difficult for them to provide users with a function for blocking access to harmful sites.

[0004] One method that has been attempted to achieve this is a content-based blocking method that analyzes the content of websites. However, the accuracy of the analysis of website content has decreased, and the processing speed has made it difficult to provide smooth service. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Republic of Korea Patent Publication No. 10-2023-0059015 Summary of the Invention [Problem to be solved by the invention]

[0006] Therefore, the present invention has been devised to solve the above-mentioned problems, and an object of the present invention is to provide a method and device for blocking illegal / harmful information sites using website source analysis, which makes it easy to block harmful sites even if their URL addresses are changed. Another object of the present invention is to provide a method and device for blocking illegal and harmful information sites using website source analysis, which can increase processing speed through relatively simple data comparison and provide smooth and accurate service. Further objects of the present invention will become more apparent based on the embodiments described below. [Means for solving the problem]

[0007] In order to achieve the object, according to one aspect of the present invention, there is provided a method for blocking illegal / harmful information sites using website source analysis, the method including: analyzing the HTML of a target website requested for connection to obtain basic structure information; determining whether the site is harmful by referring to a pre-constructed harmful site DB to search for whether a harmful site with the same basic structure information exists; and allowing connection to the target website if it is not a harmful site.

[0008] Here, as the basic structure information, any one of the structures from depth 2 to depth 4 below the HTML tag is used. Furthermore, as the basic structure information, information from which changeable values ​​such as tag values ​​and attributes have been removed is used.

[0009] In addition, the harmful site DB stores metadata and immovable structural information that can extract immovable structural information for each harmful site excluding areas with fluidity, and when it is determined that the target website is a harmful site, the metadata is used to extract the immovable structural information of the target website, and a further determination is made as to whether it is a second harmful site.

[0010] Moreover, the area having fluidity is searched for by connecting to each harmful site registered in the harmful site DB at least twice at a preset time interval and comparing the sites.

[0011] Furthermore, the number of fluid areas is used to determine a period of time for re-searching the fluid areas for updating the metadata for each harmful site.

[0012] Also, by referring to a harmless site DB constructed in advance, only when there is a harmless site identical to the basic structure information, a judgment is made as to whether the site is the second harmful site or not.

[0013] In addition, the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and the harmful site DB is referred to to determine whether the target website is a harmful site or not using the unique information.

[0014] In addition, a favicon is obtained using a download address searched for as the unique information from the HTML source of the target website requested to be connected, and it is determined whether the website is a harmful website or not.

[0015] In addition, the RTA information is first searched for as the unique information from the source of the target website to determine whether it is a harmful site, and if the search for the RTA information fails, the Gtag is used as the specific tag to obtain Gtag unique information to determine whether it is a harmful site.

[0016] According to another aspect of the present invention, there is provided an illegal / harmful information site blocking device using website source analysis, which includes a communication unit for communicating with a user terminal, a storage unit for storing information regarding harmful sites, a structure extraction unit for analyzing HTML of a target website requested to be connected to by the user terminal to obtain basic structure information, a harmful determination unit for determining whether a site is harmful by searching for whether a harmful site identical to the basic structure information exists based on the harmful site information in the storage unit, and a connection control unit for allowing connection to the target website only if it is not a harmful site.

[0017] Here, the storage unit stores metadata that enables extraction of immovable structural information for each harmful site excluding fluid areas, and when the harmful judgment unit judges that the target website is a harmful site, it uses the metadata to extract immovable structural information of the target website and further judges whether it is a second harmful site.

[0018] In addition, the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and a harmful site DB is referred to to determine whether the target website is a harmful site or not using the unique information. Further aspects, features, and advantages will become apparent from the following drawings, claims, and detailed description of the invention. Effect of the Invention

[0019] According to the present invention, by analyzing the HTML source of a website and identifying unique identification information, it is possible to block illegal or harmful information sites even if the URL or DNS is changed. In addition, the present invention can smoothly provide a blocking service for illegal / harmful information sites with accuracy and faster processing speed by using only a portion of the information in the website source such as HTML. [Brief description of the drawings]

[0020] [Figure 1] 1 is a functional block diagram showing the configuration of a harmful site blocking device using website source analysis according to an embodiment of the present invention; [Diagram 2] 1 is a flowchart illustrating a harmful site blocking process using a website source analysis according to an embodiment of the present invention. [Diagram 3] 1 is a flowchart illustrating a harmful site blocking process using structure information according to an embodiment of the present invention. [Figure 4] FIG. 2 is an exemplary diagram showing HTML for extracting structural information of a website according to an embodiment of the present invention. [Diagram 5] 11 is a table illustrating harmful site DB information according to an embodiment of the present invention. [Figure 6] 1 is an exemplary diagram illustrating a basic structure and a static structure of a website according to an embodiment of the present invention. [Figure 7] 1 is an exemplary diagram illustrating a basic structure and a static structure of a website according to an embodiment of the present invention. [Figure 8] 1 is a flowchart illustrating a harmful site determination process that further utilizes immobile structure information according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Since the present invention can be modified in various ways and has a plurality of embodiments, a specific embodiment will be illustrated in the drawings and described in detail in the detailed description, but it is not intended to limit the present invention to the specific embodiment, and it should be understood that the present invention includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention.

[0022] When an element is referred to as being "coupled" or "connected" to another element, it should be understood that it may be directly coupled or connected to the other element, but that there may be other elements between them. On the other hand, when an element is referred to as being "directly coupled" or "directly connected" to another element, it should be understood that there are no other elements between them.

[0023] Terms such as "first" and "second" are used to describe various components, but the components should not be limited by the terms. The terms are used only to distinguish one component from another. For example, terms such as "first threshold" and "second threshold" described later can be specified in advance as thresholds that are substantially different from each other or partially the same value, but there is room for confusion when they are expressed by the same word "threshold", so for the convenience of classification, the terms "first" and "second" are used together.

[0024] The terms used in this application are merely used to describe certain embodiments and are not intended to limit the present invention. A singular expression includes a plural expression unless the context clearly indicates otherwise. In this application, the terms "include" or "have" are intended to specify the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, and are not intended to preclude the presence or additional possibility of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0025] Furthermore, it is to be understood that the components of the embodiments described with reference to each drawing are not limited to the applicable embodiment only, but may be embodied to be included in other embodiments within the scope of the technical idea of ​​the present invention, and that separate explanations may be omitted or multiple embodiments may be re-embodied as a single integrated embodiment.

[0026] In addition, when describing the present invention with reference to the accompanying drawings, the same or related reference numbers are used for the same components regardless of the drawing numbers, and duplicate descriptions thereof will be omitted. In describing the present invention, if a detailed description of related known technology is deemed to unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

[0027] FIG. 1 is a functional block diagram showing the configuration of a harmful site blocking device using website source analysis according to one embodiment of the present invention, and FIG. 2 is a flowchart showing a harmful site blocking process using phicon according to one embodiment of the present invention.

[0028] 1, the harmful site blocking device according to the present embodiment includes a communication unit 10, a storage unit 20, and a control unit 30, and the control unit 30 includes an information extraction unit 31, a harmful determination unit 32, and a connection control unit 33. It will become clear to those skilled in the art from the following description that each component of the control unit 30 does not necessarily need to be embodied in hardware, but may be embodied in software, such as a program.

[0029] The harmful site blocking device may be implemented in the form of a server and communicates with a client, i.e., a user terminal (not shown), via a communication network. For example, an agent installed in the user terminal transmits information about a target website to be accessed to the harmful site blocking device.

[0030] The communication unit 10 is a communication means for communicating with a user terminal, and as it is obvious to those skilled in the art, a more detailed description will be omitted.

[0031] The storage unit 20 stores information about illegal / harmful information sites (hereinafter, referred to as harmful sites) in the form of a database (DB). URLs and the like are stored as information about harmful sites, and in particular, according to this embodiment, Gtag identification information, RTA information, favicon information, and structure information (information about the structure that constitutes a web page, which will be described in detail later) for each harmful site are stored.

[0032] A favicon is a website icon in the favorites or address window of a web browser. The name is a compound word of Favorite and Icon, and the most commonly used size is 16x16px, and the extension is ico. Since favicons are also used for harmful sites, information about such favicons is stored in the harmful site DB as information about harmful sites. The method of using favicons will be explained in more detail later.

[0033] Gtag identification information is a unique identification information that Google (registered trademark) assigns to each website for connection statistics, etc. In other words, Gtag is a tool that uses a tracking code made of Javascript used by Google Analytics. Below is an example of Gtag HTML (site: https: / / yadongkorea.org / ). TIFF2025017319000002.tif67162

[0034] In the HTML source, the unique information [G-P75R0T2VGR], which is the value of Gtag, is the Gtag identification information. Such Gtag identification information is stored and managed in the harmful site DB as information about harmful sites. RTA (RESTRICTED TO ADULTS) is information provided by an organization operated in the United States, and the RTA label can be used voluntarily and free of charge by any website that wishes to clearly and effectively label content as inappropriate for minors, making it universally available. Many harmful websites often operate their servers overseas, such as in the United States, but in the United States, there are many legal adult sites, and these RTA labels tend to be used on adult websites. Therefore, in Japan, it is easy to determine whether a site is harmful by checking the RTA labels used on harmful sites such as illegal adult sites. These RTAs are written in HTML as follows: <meta name="rating" content="adult"> or <meta name="rating" content="RTA-5042-1996-1400-1577-RTA">

[0035] And here is an example of the HTML RTA tag (site: https: / / www.xnxx.xxx / ): TIFF2025017319000003.tif147161

[0036] Therefore, when these RTA information are extracted from the source of the target website, the target website is identified as an adult-related harmful site and blocked.

[0037] The control unit 30 judges whether a target website requested to be connected from a user terminal is a harmful site (called harmfulness judgment) using the above-mentioned RTA information, Gtag identification information, favicon, etc., and blocks the site if it is harmful, and allows the connection only if it is not harmful. According to another example, the storage unit further stores structural information as information about harmful sites. This will be described in detail later.

[0038] The function of each component of the control unit 30 will be described with reference to FIG. The information extraction unit 31 of the control unit 30 analyzes the source (HTML, etc.) of the target website requested to be connected to and obtains unique information based on a specific tag (e.g., Gtag unique information and / or RTA information, unique identification information such as a favicon) (S210).

[0039] That is, by using a preset specific tag such as Gtag and / or RTA tag, the information extraction unit 31 acquires the unique information used in the target website, such as Gtag unique information and / or RTA information. The information extraction unit 31 also acquires the favicon of the target website requested to be connected. The information extraction unit 31 can also download the favicon using a download address found in the HTML source of the target website. If the HTML source does not contain a download address, the information extraction unit 31 attempts to read the favicon.ico file in the root directory. For example, if the favicon download address is not specified on the xkeeper.com site, it can be downloaded by calling [xkeeper.com / favicon.ico].

[0040] The harmful determination unit 32 judges whether a website is harmful by using the unique information acquired based on the harmful site DB (S220). That is, it judges whether a website is harmful by searching for a harmful site having the same favicon as the favicon of the target website, or by searching for a harmful site having the same value as the Gtag unique information of the target website, or by judging whether RTA information exists in the source of the target website (S220). As an example, after first checking the RTA information, if there is no RTA, it can also be judged whether a website is harmful by using the favicon or Gtag unique information.

[0041] The connection control unit 33 permits a connection to the target website only if it is not a harmful site, depending on the result of the determination by the harmful determination unit 32 (S230). In other words, according to this embodiment, by using specific unique information obtained by source analysis of the target website as a method for determining harmfulness, it becomes possible to identify and block harmful sites even if they change their connection information (such as URL).

[0042] Here, if the RTA information is not confirmed in S210 and acquisition of the Gtag-specific information and favicon fails, a harmfulness judgment is made using the structural information of the target website as described above (hereinafter referred to as a structure-based judgment of whether or not the site is harmful).

[0043] FIG. 3 is a flow chart illustrating a harmful site blocking process using structure information according to an embodiment of the present invention. Referring to FIG. 3, the source of the target website is analyzed to attempt to obtain RTA information, Gtag unique information, and favicon (S310), and success is confirmed (S320). If the RTA information, Gtag unique information, or favicon is obtained, a harmfulness determination is performed using the corresponding information as in FIG. 2, and a determination is made as to whether or not to allow access to the target website (S330).

[0044] On the other hand, if acquisition of the RTA information, Gtag unique information, and favicon fails, the HTML source of the target website is analyzed to acquire basic structure information (S340), and the harmful site DB is referred to to search for whether there is a harmful site that has the same basic structure information as the target website, thereby determining whether it is a harmful site based on its structure and whether to block it (S350).

[0045] The structure information of a target website and a structure-based method of determining whether a website is harmful will be described in more detail below. FIG. 4 is an exemplary diagram showing HTML for extracting structural information of a website according to one embodiment of the present invention, FIG. 5 is a table illustrating harmful site DB information according to one embodiment of the present invention, and FIG. 6 and FIG. 7 are exemplary diagrams showing the basic structure and immobile structure of a website according to one embodiment of the present invention.

[0046] Referring to FIG. 4, HTML information can be confirmed as source information of a target website, and the HTML information can be rendered and unnecessary information such as text and attributes can be removed. For example, a structure from 2 depths to 4 depths under a tag (4 depths are used in this figure) can be used as basic structure information. As shown in the figure, Depth can be classified using tags, tag, Tags and the like can also be used as structural information.

[0047] Referring to FIG. 6 which shows an example for ease of understanding, for example, structural information up to depth 3 is used as basic structural information. At this time, information from which changeable values ​​such as tag values ​​and attributes are removed is used as basic structural information. In other words, only the framework structure that constitutes the website is used, and the contents therein are removed. As shown in FIG. 6, structural information from depth 2 to 4 is used as basic structural information for each area that constitutes the main page screen of the website.

[0048] In addition, among the areas constituting this basic structure, there are almost all fluid areas whose contents and internal structures change from time to time. For example, areas providing real-time stock information, auction information, gambling information, etc., change their structures and contents from time to time, but are usually used in the form of rolling banners, in which case their structures and contents are fluid.

[0049] Therefore, metadata is generated that can check areas with a fluid structure in the entire structure of the rendered website and extract non-fluid structure information. The initial entire structure information is compared with future structure information, and the unchanged part is regarded as non-fluid structure information (hereinafter referred to as non-fluid structure information). For example, when constructing a harmful site DB, a website registered as a harmful site can be connected to the website at least twice at a preset time interval (e.g., 10 seconds) and compared with each other to search for fluid areas where the content changes. The metadata that can extract the fluid areas searched for in this way is stored in the harmful site DB as the corresponding harmful site information.

[0050] FIG. 7 shows an immobile structure in which the fluid regions have been removed using metadata from the basic structure of FIG. 5, which shows a schematic example of information stored in the harmful site DB, the hash values ​​and metadata of the basic structure information and immovable structure information are stored as information on the basic structure information and immovable structure information. It will be obvious to those skilled in the art that the speed and accuracy of information comparison can be significantly improved when hash values ​​are used.

[0051] If only the basic structure of the target website is used, a blocking error may occur in which access to harmless websites with the same basic structure is also blocked. For this reason, by further performing a second harmfulness judgment using the immobile structure information as described above, it is possible to reduce blocking errors that block access to harmless websites.

[0052] FIG. 8 is a flowchart illustrating a harmful site determination process that further utilizes immobile structure information according to an embodiment of the present invention. Referring to FIG. 8, a harmfulness determination is performed using basic structure information of a target website (S810), and it is confirmed whether the website is a harmful site (S820). If it is determined that the website is not a harmful site (that is, if no harmful site having the same basic structure is registered in the DB), the user terminal is permitted to connect to the target website (S830).

[0053] On the other hand, if it is determined to be a harmful site, immobility structure information is obtained using metadata stored as information about the harmful site, and a determination is made as to whether it is a second harmful site by referring to the harmful site DB (S840, S850).

[0054] According to this embodiment, a first harmful site is judged using the basic structure, and if it is judged to be a harmful site, an additional judgment is made using immovable structure information to judge whether it is a second harmful site, thereby preventing blocking errors for harmless sites to the greatest extent possible. Also, by comparing structure information stored as hash values, a quicker and more accurate harmfulness judgment can be made.

[0055] Here, according to one example, the number of fluid areas is used to determine a re-search period for fluid areas for updating metadata for each harmful site. The larger or more the fluid areas are, the higher the probability that the structure of the website itself will be changed, so that the structure of the harmful site can be responded to more quickly. Of course, if it is recognized that the metadata has been changed, the basic structure itself is also likely to be changed, so at this time, it is further confirmed whether or not there is a change to the basic structure.

[0056] According to one example, website information on harmless sites is compiled into a database (called the harmless site database (not shown)), and by referring to this, a determination as to whether or not it is the second harmful site described above can be made only if a harmless site identical to the basic structure information exists. In other words, if information on harmful sites with the same basic structure as the target website exists in the database, but information on harmless sites does not exist in the database, the target website is directly determined to be a harmful site without making a determination as to whether or not it is the second harmful site.

[0057] A computer program stored in a computer-readable medium for performing the method for blocking illegal / harmful information sites using website source analysis according to the present invention may be provided.

[0058] The method for blocking illegal / harmful information sites using website source analysis described above can be embodied as computer readable code in a computer readable recording medium. The computer readable recording medium includes any type of recording medium in which data decodable by a computer system is stored. For example, it may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, etc. Also, the computer readable recording medium may be distributed among computer systems connected by a computer communication network and stored and executed as readable code in a distributed manner.

[0059] Although the present invention has been described above with reference to a preferred embodiment, it will be understood by those skilled in the art that the present invention can be modified and changed in various ways without departing from the spirit and scope of the present invention as set forth in the claims below. [Explanation of symbols]

[0060] 10. Communications Department 20. Storage 30 Control 31 Information extraction part 32 Hazard Determination Department 33 Connection control section

Claims

1. In blocking illegal and harmful information sites, Analyzing the HTML of the target website requested to be accessed to obtain basic structure information; A step of judging whether the site is a harmful site by searching for a harmful site having the same basic structure information as the harmful site DB that has been constructed in advance; and allowing a connection to the target website if the target website is not a harmful website.

2. The method for blocking illegal and harmful information sites using website source analysis as described in claim 1, characterized in that the basic structure information is a structure of any one of depths 2 to 4 under the HTML <body> tag.

3. 3. The method of claim 2, wherein the basic structure information is information from which variable values ​​such as tag values ​​and attributes are removed.

4. The harmful site DB stores metadata and immovable structure information from which immovable structure information excluding areas with fluidity can be extracted for each harmful site, and the immovable structure information, The method for blocking illegal / harmful information sites using website source analysis as described in claim 1, characterized in that when the target website is determined to be a harmful site, the metadata is used to extract immobile structural information of the target website, and a determination is further made as to whether it is a second harmful site.

5. The method for blocking illegal / harmful information sites using website source analysis as described in claim 4, characterized in that the area of ​​fluidity is searched for by connecting to and comparing each harmful site registered in the harmful site DB at least twice at a preset time interval.

6. The method for blocking illegal and harmful information sites using website source analysis as described in claim 5, characterized in that the number of fluid areas is used to determine a re-search period for the fluid areas for updating the metadata for each harmful site.

7. The method for blocking illegal / harmful information sites using website source analysis as described in claim 4, characterized in that a pre-constructed harmless site database is referenced, and a determination as to whether the site is the second harmful site is made only if a harmless site identical to the basic structure information exists.

8. The method for blocking illegal / harmful information sites using website source analysis as described in claim 1, characterized in that the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and the harmful site DB is referred to and the unique information is used to determine whether the target website is a harmful site or not.

9. The method for blocking illegal / harmful information sites using website source analysis according to claim 8, characterized in that a favicon is obtained using a download address searched from the HTML source of the target website requested to be connected as the unique information, and it is determined whether the site is harmful.

10. The method for blocking illegal / harmful information sites using website source analysis as described in claim 8, characterized in that RTA information is first searched for from the source of the target website as the unique information to determine whether it is a harmful site, and when the search for the RTA information fails, Gtag is used as the specific tag to obtain Gtag unique information to determine whether it is a harmful site.

11. A computer program stored in a computer-readable medium for performing a method for blocking an illegal / harmful information site using a source analysis of a website, the computer program causing a computer to perform the following steps, the steps comprising: Analyzing the HTML of the target website requested to be accessed to obtain basic structure information; A step of judging whether the site is a harmful site by searching for a harmful site having the same basic structure information as the harmful site DB that has been constructed in advance; and allowing a connection to the target website if the target website is not a harmful site.

12. A communication unit for communicating with a user terminal; A storage unit for storing information regarding harmful sites; a structure extraction unit that analyzes HTML of a target website requested by the user terminal to acquire basic structure information; a harmfulness determination unit that determines whether a harmful site is a harmful site by searching for a harmful site identical to the basic structure information based on the harmful site information in the storage unit; and a connection control unit that permits connection to the target website only if the target website is not a harmful site.

13. The storage unit stores metadata for each harmful site from which immovable structural information excluding a mobile area can be extracted, The device for blocking illegal and harmful information sites using website source analysis as described in claim 12, characterized in that when the harmful judgment unit judges that the target website is a harmful site, it extracts immobile structural information of the target website using the metadata and further judges whether it is a second harmful site.

14. The illegal / harmful information site blocking device using website source analysis as described in claim 12, characterized in that it analyzes the source of the target website requested to be connected to, obtains unique information using a specific tag, and prioritizes determining whether the target website is a harmful site by referring to a harmful site database and using the unique information.

Images