Method and device for blocking illegal and harmful information sites using website source analysis, and computer program

Abstract

To provide a method and device for blocking illegal / harmful information sites using website source analysis, which facilitate blocking harmful sites even if their URL addresses change.SOLUTION: A method for blocking illegal / harmful information sites using website source analysis according to one aspect of the present invention includes the steps of: analyzing a source of a target website requested for connection and obtaining unique information using a specific tag; referencing a harmful site DB in which information related to illegal / harmful information sites is constructed and determining whether the target website is a harmful site using the unique information; and allowing the connection to the target website if the target website is not a harmful site.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a method and device for blocking illegal and harmful information sites using website source analysis. [Background technology]

[0002] Content provided through websites may contain harmful content that may cause discomfort or have harmful effects. Illegal and harmful information sites that handle such harmful content include obscene, defamatory, fear-inducing, hacking, violent, illegal, anti-government, terrorist, and criminal sites. Most of these sites have servers located overseas and cannot be forcibly closed, so they are usually restricted by blocking access to the harmful sites.

[0003] Normally, methods for blocking access to harmful websites use URLs, DNS, etc. However, operators of harmful websites periodically change URL information and DNS information to circumvent such blocking methods, making it difficult for them to provide users with a function for blocking access to harmful websites.

[0004] One method that has been attempted to achieve this is a content-based blocking method that analyzes the content of websites, but the accuracy of the analysis of website content has decreased, and the processing speed has made it difficult to provide smooth service. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Republic of Korea Patent Publication No. 10-2023-0059015 Summary of the Invention [Problem to be solved by the invention]

[0006] Therefore, the present invention has been devised to solve the above-mentioned problems, and an object of the present invention is to provide a method and device for blocking illegal and harmful information sites using website source analysis, which makes it easy to block harmful sites even if their URL addresses are changed. Another object of the present invention is to provide a method and device for blocking illegal and harmful information sites using website source analysis, which can increase processing speed through relatively simple data comparison and provide smooth and accurate service. Further objects of the present invention will become clearer based on the following examples. [Means for solving the problem]

[0007] To achieve the object, according to one aspect of the present invention, there is provided a method for blocking illegal and harmful information sites using website source analysis, the method including the steps of: analyzing the HTML of a target website that has been requested to be accessed to obtain basic structure information; determining whether the site is harmful by referring to a pre-built harmful site database to search for a harmful site that matches the basic structure information; and allowing access to the target website if it is not a harmful site.

[0008] Here, as the basic structure information, any one of the structures from depth 2 to depth 4 below the HTML tag is used. Furthermore, information from which changeable values ​​such as tag values ​​and attributes have been removed is used as the basic structure information.

[0009] In addition, the harmful site DB stores metadata and immovable structural information that can extract immovable structural information for each harmful site, excluding areas with fluidity.When the target website is determined to be a harmful site, the metadata is used to extract the immovable structural information of the target website, and a further determination is made as to whether it is a second harmful site.

[0010] Furthermore, the area having fluidity is searched for by connecting to each harmful site registered in the harmful site DB at least twice at a preset time interval and comparing the sites.

[0011] Furthermore, the number of fluid areas is used to determine a re-search period for the fluid areas for updating the metadata for each harmful site.

[0012] Furthermore, a harmless site DB constructed in advance is referenced, and only when there is a harmless site identical to the basic structure information, a determination is made as to whether or not the site is the second harmful site.

[0013] In addition, the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and the harmful site DB is referenced and the unique information is used to determine whether the target website is a harmful site or not.

[0014] In addition, a favicon is acquired using the download address searched for from the HTML source of the target website requested to be connected as the unique information, and it is determined whether the website is harmful or not.

[0015] In addition, the RTA information is first searched for as the unique information from the source of the target website to determine whether it is a harmful site, and if the search for the RTA information fails, the Gtag unique information is obtained using the Gtag as the specific tag to determine whether it is a harmful site.

[0016] According to another aspect of the present invention, there is provided an illegal / harmful information site blocking device using website source analysis, which includes: a communication unit for communicating with a user terminal; a storage unit for storing information about harmful sites; a structure extraction unit for analyzing the HTML of a target website requested to be connected from the user terminal to obtain basic structure information; a harmful determination unit for determining whether a site is harmful by searching for whether a harmful site identical to the basic structure information exists based on the harmful site information in the storage unit; and a connection control unit for allowing connection to the target website only if it is not a harmful site.

[0017] Here, the storage unit stores metadata that can extract immovable structural information for each harmful site, excluding areas with fluidity, and when the harmful judgment unit judges that the target website is a harmful site, it uses the metadata to extract immovable structural information for the target website and further judges whether it is a second harmful site.

[0018] In addition, the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and a harmful site database is referenced to determine whether the target website is a harmful site or not using the unique information. Further aspects, features, and advantages will become apparent from the following drawings, claims, and detailed description of the invention. [Effects of the Invention]

[0019] According to the present invention, by analyzing the HTML source of a website and identifying its unique identification information, it is possible to block illegal or harmful information sites even if the URL or DNS is changed. In addition, the present invention can smoothly provide a blocking service for illegal and harmful information sites with accuracy and faster processing speed by using only a portion of the information in the website source, such as HTML. [Brief explanation of the drawings]

[0020] [Figure 1] 1 is a functional block diagram showing the configuration of a harmful site blocking device using website source analysis according to an embodiment of the present invention; [Figure 2] 1 is a flowchart illustrating a harmful site blocking process using a website source analysis according to an embodiment of the present invention. [Figure 3] 10 is a flowchart illustrating a harmful site blocking process using structural information according to an embodiment of the present invention. [Figure 4] FIG. 10 is an exemplary diagram illustrating HTML for extracting structural information of a website according to an embodiment of the present invention. [Figure 5] 10 is a table illustrating harmful site DB information according to an embodiment of the present invention. [Figure 6] 1 is an exemplary diagram illustrating a basic structure and a static structure of a website according to an embodiment of the present invention. [Figure 7] 1 is an exemplary diagram illustrating a basic structure and a static structure of a website according to an embodiment of the present invention. [Figure 8] 10 is a flowchart illustrating a harmful site determination process that further utilizes immobile structure information according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0021] Since the present invention can be modified in various ways and can have multiple embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description, but it should be understood that this is not intended to limit the present invention to the specific embodiments, and that the present invention includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention.

[0022] When a component is referred to as being "coupled" or "connected" to another component, it should be understood that the component may be directly coupled or connected to the other component, but that there may be other components between them. On the other hand, when a component is referred to as being "directly coupled" or "directly connected" to another component, it should be understood that there are no other components between them.

[0023] Terms such as "first" and "second" are used to describe various components, but the components should not be limited by these terms. These terms are used only to distinguish one component from another. For example, terms such as "first threshold" and "second threshold" described below can be pre-specified as thresholds that are substantially different from each other or partially the same. However, since there is a possibility of confusion when they are expressed by the same word "threshold," for the sake of convenience, the terms "first" and "second" are used together.

[0024] The terms used in this application are merely used to describe specific embodiments and are not intended to limit the present invention. The singular expressions include the plural expressions unless the context clearly dictates otherwise. In this application, the terms "comprise" or "have" are intended to specify only the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should not be understood to preclude the presence or possible addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0025] Furthermore, it is natural that the components of the embodiments described with reference to each drawing are not limited to being applied only to the embodiment in question, but may be embodied in a manner that is included in other embodiments within the scope that maintains the technical idea of ​​the present invention, and that even if separate explanations are omitted, multiple embodiments may be re-embodied as a single integrated embodiment.

[0026] In addition, when describing the present invention with reference to the accompanying drawings, the same or related reference numerals will be used to refer to the same components regardless of the reference numerals, and redundant descriptions thereof will be omitted. In describing the present invention, if a detailed description of related known art is deemed to unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

[0027] FIG. 1 is a functional block diagram showing the configuration of a harmful site blocking device using website source analysis according to one embodiment of the present invention, and FIG. 2 is a flowchart showing the harmful site blocking process using phicon according to one embodiment of the present invention.

[0028] 1, the harmful site blocking device according to this embodiment includes a communication unit 10, a storage unit 20, and a control unit 30, and the control unit 30 includes an information extraction unit 31, a harmful determination unit 32, and a connection control unit 33. It will be clear to those skilled in the art from the following description that each component of the control unit 30 does not necessarily need to be embodied in hardware, but may be embodied in software such as a program.

[0029] The harmful site blocking device may be implemented as a server and communicates with a client, i.e., a user terminal (not shown), via a communication network. For example, an agent installed in the user terminal transmits information about a target website to be accessed to the harmful site blocking device.

[0030] The communication unit 10 is a communication means for communicating with a user terminal, and is self-evident to those skilled in the art, so a more detailed description will be omitted.

[0031] The storage unit 20 stores information about illegal and harmful information sites (hereinafter referred to as harmful sites) in the form of a database (DB). Information about harmful sites, such as URLs, is stored, and in particular, according to this embodiment, Gtag identification information, RTA information, favicon information, and structure information (information about the structure that makes up a web page, which will be described in detail later) for each harmful site is stored.

[0032] A favicon is a website icon that appears in the favorites or address window of a web browser. The name is a combination of favorite and icon, and the most commonly used size is 16x16px, with the extension .ico. Since favicons are also used for harmful sites, information about such favicons is stored in the harmful site database as information about harmful sites. The method of using favicons will be explained in more detail later.

[0033] Gtag identifier is a unique identifier assigned to each website by Google (registered trademark) for purposes such as connection statistics. In other words, Gtag is a tool that uses a tracking code made up of Javascript used by Google Analytics. Below is an example of Gtag HTML (site: https: / / yadongkorea.org / ). TIFF0007803575000001.tif67162

[0034] In the HTML source, the unique information [G-P75R0T2VGR], which is the value of Gtag, is the Gtag identification information. Such Gtag identification information is stored and managed in the harmful site DB as information about harmful sites. RTA (Restricted to Adults) is information provided by an organization operated in the United States, and RTA labels can be used voluntarily and free of charge by any website that wishes to clearly and effectively label content as inappropriate for minors, making them universally applicable. While many harmful websites operate their servers overseas, such as in the United States, the United States has many legal adult sites, and these RTA labels tend to be used on adult websites. Therefore, within Japan, checking the RTA labels used on harmful sites, such as illegal adult sites, makes it easy to determine whether a site is harmful. These RTA labels are written in HTML as follows: <meta name="rating" content="adult"> or <meta name="rating" content="RTA-5042-1996-1400-1577-RTA">

[0035] And here is an example of the HTML RTA tag (site: https: / / www.xnxx.xxx / ): TIFF0007803575000002.tif147161

[0036] Therefore, when this RTA information is extracted from the source of the target website, the target website is identified as an adult-related harmful site and blocked.

[0037] The control unit 30 determines whether a target website requested for connection from a user terminal is a harmful site (referred to as harmfulness determination) using the RTA information, Gtag identification information, favicon, etc. described above, and blocks the site if it is harmful, and allows connection only if it is not harmful. In another example, the storage unit further stores structural information as information regarding harmful sites. This will be described in detail later.

[0038] The function of each component of the control unit 30 will be described with reference to FIG. The information extraction unit 31 of the control unit 30 analyzes the source (HTML, etc.) of the target website requested to be connected to and obtains unique information based on specific tags (e.g., Gtag unique information and / or RTA information, unique identification information such as a favicon) (S210).

[0039] That is, specific information used by the target website, such as Gtag and / or RTA information, is acquired using predefined specific tags, such as Gtag and / or RTA tags. The information extraction unit 31 also acquires the favicon of the target website requested for connection. The information extraction unit 31 can download the favicon using a download address retrieved from the HTML source of the target website. If the HTML source does not contain a download address, the unit attempts to load the favicon.ico file in the root directory. For example, if the xkeeper.com site does not specify a favicon download address, the favicon can be downloaded by calling [xkeeper.com / favicon.ico].

[0040] The harmful determination unit 32 determines whether a website is harmful by using the unique information acquired based on the harmful site DB (S220). That is, the harmful determination unit 32 determines whether a website is harmful by searching for a harmful site that has the same favicon as the favicon of the target website, or by searching for a harmful site that has the same value as the Gtag unique information of the target website, or by determining whether RTA information exists in the source of the target website (S220). As an example, after first checking the RTA information, if no RTA exists, the harmful site determination can be performed using the favicon or Gtag unique information.

[0041] The connection control unit 33 allows connection to the target website only if it is not a harmful site, according to the determination result of the harmful determination unit 32 (S230). In other words, according to this embodiment, by using specific unique information obtained by source analysis of the target website as a harmfulness determination method, harmful sites can be identified and blocked even if they change their connection information (such as URL).

[0042] Here, if the RTA information is not confirmed in S210 and the acquisition of the Gtag-specific information and favicon fails, a harmfulness judgment is made using the structural information of the target website as described above (hereinafter referred to as a structurally based judgment of whether the site is harmful).

[0043] FIG. 3 is a flowchart illustrating a harmful site blocking process using structural information according to an embodiment of the present invention. Referring to FIG. 3, the source of the target website is analyzed to attempt to obtain RTA information, Gtag specific information, and favicon (S310), and success is confirmed (S320). If the RTA information, Gtag specific information, or favicon is obtained, a harmfulness determination is performed using the corresponding information as in FIG. 2, and a determination is made as to whether or not to allow access to the target website (S330).

[0044] On the other hand, if the acquisition of RTA information, Gtag specific information, and favicon fails, the HTML source of the target website is analyzed to acquire basic structure information (S340), and by referring to the harmful site database to search for harmful sites that have the same basic structure information as the target website, it is determined whether the site is harmful based on its structure and whether to block it (S350).

[0045] The following provides a more detailed description of the structure information of a target website and the method for determining whether the website is harmful based on the structure information. FIG. 4 is an exemplary diagram showing HTML for extracting structural information of a website according to one embodiment of the present invention, FIG. 5 is a table illustrating harmful site DB information according to one embodiment of the present invention, and FIGS. 6 and 7 are exemplary diagrams showing the basic structure and immobile structure of a website according to one embodiment of the present invention.

[0046] Referring to FIG. 4, HTML information can be confirmed as source information of the target website, and the HTML information can be rendered, and unnecessary information such as text and attributes can be removed. For example, a structure from 2 depths to 4 depths under a tag (4 depths is used in this figure) can be used as basic structure information. As shown in the figure, Tags can be used to differentiate depths, tag, Tags and the like can also be used as structural information.

[0047] Referring to FIG. 6, which shows an example for ease of understanding, for example, structural information up to depth 3 is used as basic structural information. At this time, information from which mutable values ​​such as tag values ​​and attributes are removed is used as basic structural information. In other words, only the framework structure that constitutes the website is used, and the content within it is removed. As shown in FIG. 6, structural information from depths 2 to 4 is used as basic structural information for each area that constitutes the main page screen of the website.

[0048] Furthermore, among the areas that make up this basic structure, there are almost always fluid areas whose contents and internal structures change from time to time. For example, areas that provide real-time stock information, auction information, gambling information, etc., change their structure and contents from time to time, but are usually used in the form of rolling banners, and in this case, their structure and contents are fluid.

[0049] Therefore, metadata is generated that can identify areas with a fluid structure within the entire structure of a rendered website and extract non-fluid structural information. The initial overall structural information is compared with future structural information, and the unchanged portions are considered to be non-fluid structural information (hereinafter referred to as non-fluid structural information). For example, when building a harmful site database, a website registered as a harmful site can be accessed at least twice at a preset time interval (e.g., 10 seconds) and compared with each other to search for fluid areas where content changes. The metadata that can extract the fluid areas thus searched for is stored in the harmful site database as the corresponding harmful site information.

[0050] Figure 7 shows an immobile structure in which the fluid regions have been removed using the metadata in the basic structure of Figure 6. 5, which shows a schematic example of information stored in the harmful site DB, hash values ​​and their metadata are stored as information about the basic structure information and immovable structure information. It will be obvious to those skilled in the art that the use of hash values ​​can significantly improve the speed and accuracy of information comparison.

[0051] If only the basic structure of the target website is used, blocking errors may occur that also block access to harmless websites with the same basic structure. Therefore, by further performing a second harmfulness judgment using the immobile structure information described above, blocking errors that block access to harmless websites can be reduced.

[0052] FIG. 8 is a flowchart illustrating a harmful site determination process that further utilizes immobile structure information according to an embodiment of the present invention. Referring to FIG. 8, harmfulness determination is performed using basic structure information of the target website (S810), and it is confirmed whether the determined website is harmful or not (S820). If it is determined that the site is not harmful (that is, if no harmful site having the same basic structure is registered in the DB), the user terminal is permitted to connect to the target website (S830).

[0053] On the other hand, if it is determined to be a harmful site, immobility structure information is obtained using the metadata stored as information about the harmful site, and a determination is made as to whether it is a second harmful site by referring to the harmful site DB (S840, S850).

[0054] According to this embodiment, a first determination of whether a site is harmful is made using the basic structure, and if a site is determined to be harmful, an additional determination of whether a site is harmful is made using immovable structure information, thereby maximizing the prevention of blocking errors for harmless sites. Furthermore, by comparing structure information stored as hash values, harmfulness can be determined more quickly and accurately.

[0055] According to one example, the number of fluid areas is used to determine the re-search period for the fluid areas for updating the metadata for each harmful site. The larger or more fluid areas are, the higher the probability that the structure of the website itself will be changed, allowing for faster response to structural changes to harmful sites. Of course, if it is determined that the metadata has been changed, the basic structure itself is also likely to be changed, so whether or not there has been a change to the basic structure is also checked.

[0056] According to one example, website information about harmless sites is compiled into a database (called the harmless site database (not shown)), and by referring to this, it is possible to determine whether the site is the second harmful site described above only if there is a harmless site identical to the basic structure information. In other words, if information about harmful sites with the same basic structure as the target website exists in the database, but information about harmless sites does not exist in the database, the target website is directly determined to be a harmful site without being determined to be the second harmful site.

[0057] A computer program stored on a computer-readable medium for performing the method for blocking illegal and harmful information sites using website source analysis according to the present invention may be provided.

[0058] The method for blocking illegal and harmful information sites using website source analysis described above can be embodied as computer-readable code on a computer-readable recording medium. Computer-readable recording media include any type of recording medium that stores data decodable by a computer system. Examples include read-only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, and optical data storage devices. Furthermore, computer-readable recording media can be distributed among computer systems connected via a computer network and stored and executed as readable code in a distributed manner.

[0059] Although the present invention has been described above with reference to preferred embodiments, it will be understood by those skilled in the art that various modifications and variations of the present invention can be made without departing from the spirit and scope of the present invention as set forth in the claims below. [Explanation of symbols]

[0060] 10. Communications Department 20. Storage 30 Control 31 Information extraction part 32 Hazard Determination Department 33 Connection control section

Claims

1. In blocking illegal and harmful information sites, An information extraction unit of a control unit of the harmful site blocking device analyzes the HTML of the target website requested to be accessed and acquires basic structure information; a harmful determination unit of the control unit refers to a harmful site DB previously constructed in a storage unit of the harmful site blocking device, and searches for a harmful site identical to the basic structure information to determine whether the site is harmful; If the target website is not a harmful site, a connection control unit of the control unit allows connection to the target website; The harmful site DB stores metadata and immovable structure information from which immovable structure information excluding areas with mobility can be extracted for each harmful site, A method for blocking illegal and harmful information sites using website source analysis, characterized in that when the target website is determined to be a harmful site, the immobile structural information of the target website is extracted using the metadata, and a second determination is made as to whether it is a harmful site.

2. The method for blocking illegal and harmful information sites using website source analysis as described in claim 1, characterized in that the basic structure information is a structure of any one of depths 2 to 4 under the HTML <body> tag.

3. 3. The method for blocking illegal and harmful information sites using website source analysis according to claim 2, wherein information from which variable values ​​of tag values ​​and attributes are removed is used as the basic structure information.

4. The method for blocking illegal and harmful information sites using website source analysis as described in claim 1, characterized in that the fluid area is searched for by connecting to and comparing each harmful site registered in the harmful site database at least twice at a predetermined time interval.

5. The method for blocking illegal and harmful information sites using website source analysis, as described in claim 4, characterized in that the number of fluid areas is used to determine the re-search period of the fluid areas for updating the metadata for each harmful site.

6. A method for blocking illegal and harmful information sites using website source analysis as described in claim 1, characterized in that a pre-constructed harmless site database is referenced and a determination is made as to whether the site is the second harmful site only if there is a harmless site that has the same basic structure information.

7. The method for blocking illegal and harmful information sites using website source analysis as described in claim 1, characterized in that the source of the target website requested to be connected is analyzed to obtain unique information using a specific tag, and the harmful site database is referenced and the unique information is used to determine whether the target website is a harmful site.

8. The method for blocking illegal and harmful information sites using website source analysis as described in claim 7, characterized in that a favicon is obtained using a download address searched from the HTML source of the target website requested to be connected as the unique information, and whether the site is harmful or not is determined.

9. The method for blocking illegal and harmful information sites using website source analysis as described in claim 7, characterized in that RTA information is first searched for from the source of the target website as the unique information to determine whether it is a harmful site, and when the search for the RTA information fails, Gtag is used as the specific tag to obtain Gtag unique information to determine whether it is a harmful site.

10. 2. A computer program stored on a computer-readable medium for executing the method for blocking illegal and harmful information sites using website source analysis according to claim 1, wherein the computer program causes a computer to perform the following steps, the steps comprising: Analyzing the HTML of the target website requested for connection to obtain basic structure information; a step of judging whether the site is harmful by searching for a harmful site having the same basic structure information as the site in question by referring to a harmful site DB constructed in advance; and allowing connection to the target website if the target website is not a harmful site.

11. a communication unit for communicating with a user terminal; a storage unit for storing information about harmful sites; a structure extraction unit that analyzes the HTML of the target website requested to be connected from the user terminal and acquires basic structure information; a harmfulness determination unit that determines whether a harmful site is a harmful site by searching for whether a harmful site identical to the basic structure information exists based on the harmful site information in the storage unit; a connection control unit that allows a connection to the target website only if the target website is not a harmful site; The storage unit stores respective metadata from which immovable structural information excluding a mobile area can be extracted for each harmful site, The harmful determination unit, when determining that the target website is a harmful site, extracts the immobile structural information of the target website using the metadata and further determines whether it is a second harmful site.

12. The illegal / harmful information site blocking device using website source analysis described in claim 11, characterized in that it analyzes the source of the target website requested to be connected to, obtains unique information using a specific tag, and determines whether the target website is a harmful site using the unique information by referring to a harmful site database.

Images