JP2009289246A - Message determining apparatus, method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve determining accuracy in determining, using a word dictionary or the like, the harmful effect of a web page of a URL in a message posted to a blog or the like by employing different harmful effect determining means depending on the capacity of a page description file such as HTML. <P>SOLUTION: A plurality of harmful effect determining means 31, 32, 33 for determining the harmful effect of a web page are used. Based on one or more reference values, a capacity determining means 45 determines the range of the data capacity of a web page description file (HTML file or the like) of the web page read by a page reading means 20 (capacity determining process). Depending on the determined range of the data capacity, a selection means 47 selects one or more of a plurality of harmful effect determining means 31, 32, 33 to determine the harmful effect of the web page (selection process). <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an improvement in technology for determining the harmfulness of a web page corresponding to a URL included in a message posted to a blog or the like.

  In recent years, along with the Internet, various message services via the Internet have rapidly spread and diversified. Message service is a service that allows users to exchange various messages, mainly text, via communication networks such as the Internet and mobile phone networks. Examples include electronic bulletin boards, blogs, and e-mails. It is done.

  In such a message service, posting a message containing a URL that is considered harmful, such as an adult site, pretending to be a comment or trackback on a blog article, a new post (parent article) or a response (child article) on an electronic bulletin board So-called spam (SPAM) is rampant, and a technique for detecting it and taking countermeasures has been proposed.

As an example, in the technique of Patent Document 1 by the present applicant, even if the URL in the message is not registered in the harmful URL list prepared in advance, the web page represented by the URL is recorded in the harmful judgment dictionary, that is, the prohibited word list. If it contains, the message is discarded.
JP 2007-265368 A

  However, the phrase expression varies depending on the purpose of creating the web page and the type of target device. For example, an expression such as “Unmodified hair” is displayed on a page for a personal computer, and “None” is displayed on a page for a mobile phone terminal. There is a tendency to be shortened like "Fix", and the same shortening tendency is seen in the page mainly with images and with few characters even for a personal computer.

  In addition, when determining whether or not a web page is harmful based on the number of matches with words recorded in the harm determination dictionary, the appropriate number of matches is different if the information amount of the web page is significantly different. For example, if the number of messages displayed on a bulletin board (BBS) is about several tens per screen, even if it can be based on whether or not it contains several suspicious words, the same standard is close to 1,000 per screen. If it is applied to a page containing a message, it may be judged as harmful in many cases, resulting in over-regulation, which may reduce practicality.

  As described above, it is difficult to properly determine a large number of web pages having various aspects using a single harmful judgment dictionary or uniform judgment standard as in the past, and a technique for improving judgment accuracy is required. It was.

  The present invention solves the above-described problems of the prior art, and its purpose is to use a page description file such as HTML when determining the harmfulness of a web page of a URL in a message posted to a blog using a word dictionary or the like. By applying different harmful determination means depending on the capacity, the determination accuracy is improved.

  According to an aspect of the present invention, in a message determination apparatus, a corresponding web page is read via a communication network based on a plurality of harmful determination means for determining the harmfulness of a web page and a URL included in a message of a message service. A page reading means, a capacity determination means for determining a data capacity range of the web page description file of the read web page based on one or more reference values, and according to the determined data capacity range, The selection means for determining the harmfulness of the web page by selecting one or more of the plurality of harmfulness determination means is realized by a computer.

  In this way, by changing which of the plurality of harmful determination means is applied according to the data capacity such as HTML, it is possible to use the web page according to whether it is for a personal computer or a mobile phone terminal, the length of the web page, etc. It is possible to make a harmful judgment with high accuracy.

  According to another aspect of the present invention, in any one of the above aspects, at least a part of the plurality of harmful determination means includes a harmful determination dictionary that corresponds to the data capacity range and includes different harmful phrase groups. And the content of the web page description file corresponding to the URL is checked against the noxious determination dictionary to determine whether it is harmful based on a match with the recorded word.

  In this way, according to the data capacity of the web page to be judged, by adopting a simple harmful judgment method such as matching with words recorded in the harmful judgment dictionary and changing the harmful dictionary to be used or changing it It is possible to easily and reliably change the contents of the harmful determination.

  According to another aspect of the present invention, in any one of the above aspects, the selection unit is configured to determine a plurality of harmful determination criteria including the number of matching words with words recorded in the harmful determination dictionary according to the determined data capacity range. One or two or more are selected and applied by an AND or OR logical operation.

  In this way, harmful judgment criteria such as the number of words are switched according to the HTML file data capacity, and a plurality of harmful judgment criteria are applied in a relationship of AND or OR, so that the harmful judgment is made according to the situation such as the target or the situation. The accuracy can be further improved.

  According to another aspect of the present invention, in any one of the above aspects, the harmfulness determination unit including the harmfulness determination dictionary includes, as the harmfulness determination dictionary, a black word dictionary and a gray word dictionary corresponding to a difference in harmfulness. One or both of the number of matching words in the black word dictionary and the number of matching words in the gray word dictionary is used for each data capacity range as the predetermined harmful judgment criterion.

  Thus, the determination accuracy is further improved by determining the number of matching words in the harmful determination criterion for each black word dictionary and gray word dictionary corresponding to the harmful degree and in combination with the page data capacity range.

  As another preferred additional mode that can be combined with the above modes, if the URL in the blog posting is not in the harmful URL list and is unknown, the harmfulness check is removed and the hierarchy at the end of the URL is removed. In this state, an example of detecting a harmful URL with an excellent meaning by adding a meaningless character string at the end while avoiding excessive restriction of a short URL is shown.

  That is, according to one aspect of the present invention, in a message determination device, a harmful URL list in which URLs of harmful web pages are recorded and URLs included in a message input to a message service are checked against the harmful URL list. A URL determination unit that performs a harmful determination that determines that it is harmful if there is a match, and sets the URL that the URL determination unit has not determined as harmful as an unknown URL, and sets a communication network for a web page corresponding to the unknown URL. A page reading unit that reads the page, a harmful determination unit that determines whether or not the read web page is harmful, and the unknown URL corresponding to the web page that the harmful determination unit determines to be harmful For the end-side character string separated by the specified hierarchy delimiter Two or more layers are removed, tail removal means, and the unknown URL from which the tail has been removed are also subjected to the page reading and the harmful determination. The tail determination registration means for registering in the harmful URL list is realized by a computer.

  As described above, when the URL in the message is unknown in the harmful URL list and is unknown and is determined to be harmful when the page is read, it is also harmful for the URL cut from the lower layer at the end of the URL separated by “/”, “?”, Etc. By determining, it is possible to detect and register a harmful URL even for a short URL impersonated by adding a lower layer, and the determination accuracy can be effectively improved.

  In the present invention, in addition to a dedicated electronic circuit, a predetermined computer program executes each processing step corresponding to each of the above means to an arithmetic control unit of a computer having hardware such as a memory and input / output means. This can be realized. A method having such processes (for example, a message determination method) and such a computer program (message determination program) are also aspects of the present invention according to the above and following aspects.

  As another aspect of the present invention, in any one of the aspects described above, the harmfulness determination means is provided with a harmfulness determination dictionary in which harmful words are stored as recorded words, and the webpage read from the webpage corresponding to the URL If the content of the description file is checked against the noxious judgment dictionary and whether or not it is harmful based on the match with the recorded words, the noxious judgment can be easily performed by a simple method of matching with the dictionary recorded words. Can be implemented. Note that the removal of the tail seems to be effective in many cases if it is performed for one layer, but the following processing procedure is particularly suitable when it is performed for a plurality of layers.

  According to another aspect of the present invention, in any one of the aspects described above, for the unknown URL, (1) the web page pointed to by the URL is read by the page reading means, and (2) the harmful judgment means is used for the read web page. It is determined whether it is harmful or harmless. (3) If it is determined that it is harmful, the tail removing means temporarily stores the URL in a predetermined storage area, and for one layer after a predetermined hierarchy delimiter at the end of the URL. By cutting the character string, it is processed into the URL of the remaining upper layer part, and the processed URL is processed again from the above (1), but (4) it is determined to be harmless and determined to be harmful When a URL is temporarily stored, the tail determination registration unit registers the temporarily stored URL in the harmful URL list. To.

  As described above, the URL determined to be harmful is repeatedly checked after removing the tail, and when it is no longer harmful, it is harmful by a simple recursive process of registering the last harmful URL in the harmful URL list. The shortest URL redirected to the page can be specified and registered, and a highly accurate determination can be realized regardless of the number of layers of the camouflaged redundant character string.

  According to another aspect of the present invention, in any of the above aspects, an API (Application Program Interface) call including an input message as a parameter is received from an information processing process or system that implements each service and is a caller. In addition, an API delivery means (API interface unit) that returns the result of the harmful determination to the caller as an API return value for the call is realized by the computer.

  In this way, by making it possible to use calls from various services via the API, a larger number of determination examples become the basis, so the accumulation of harmful URL information can be enhanced, and the determination accuracy can be further improved. Thus, it becomes possible to use highly accurate judgments based on accumulated information widely from more services.

  As described above, according to the present invention, when determining the harmfulness of a web page of a URL in a message posted to a blog or the like using a word dictionary or the like, different harmful determination means such as HTML are applied according to the page description file capacity. As a result, the determination accuracy can be improved.

  Next, the best mode for carrying out the present invention (hereinafter referred to as “embodiment”) will be described with reference to the drawings. It should be noted that assumptions common to those already described in the background art and problems are omitted as appropriate.

[1. Constitution〕
In the present embodiment, as shown in the functional block diagram of FIG. 1, messages input from a contributor A1 or A2 to a functional unit or server (1 or the like) that implements a message service such as a blog or an electronic bulletin board. This is related to a message determination device 2 (hereinafter referred to as “the present device”) that provides a function for determining the harmfulness of the device, and can also be grasped as a method and a computer program corresponding to the present device.

  There are two possible routes for the device 2 to provide the message harmfulness judgment function, and it is not essential to implement both of them simultaneously, but one of them is harmful directly from the blog function unit or the server 1. The sex determination request is received to the URL determination means 15, and the determination result is output from the dedicated harmful notification means 65 to the blog administrator B by e-mail or the like in the form of confirmation of harmful writing or recommendation for deletion. is there.

  The other one is to make a determination request and answer a result from a plurality of service processes or systems (functional units, servers, etc.) via a predetermined standardized API interface, which will be described later.

  Although not shown in the drawings, the present apparatus 2 includes a computer having a calculation control unit such as a CPU, a storage device such as a main memory and an external storage device (such as an HDD), and a computer having hardware such as an input / output unit. By introducing the program in advance, it is realized as a server computer or the like, and has the elements 10 to 80 shown in FIG.

  Among these elements 10 to 80, information groups such as lists and dictionaries are realized by storing corresponding information as files on the storage device. Each of the other means is realized by having the computer program execute the information processing step corresponding to each means by the computer program. However, part or all of each element may be realized by an electronic circuit such as wired logic in accordance with technical conditions and mounting modes.

  The features of the present embodiment configured as described above can be broadly divided into two outlines. The first outline is correspondence to the tail disguise of the short URL, and the second outline is the data capacity of the web page. It is the proper use of the appropriate harmful judgment means.

[2. (First overview)
First, the first outline will be described. That is, in the present apparatus 2, the harmful URL list 10 is a list of URLs of web pages that are known in advance and are harmful. Then, the URL determination means 15 is used in messages (comments, posts, mails, etc.) input (including not only new posts and outgoing calls but also arrivals and receptions) by message services (blogs, electronic bulletin boards, emails, messengers, etc.). If the URL included in the URL is matched with the harmful URL list 10, it is determined that the URL is harmful (this processing is referred to as “URL determination processing” from the viewpoint of the method; the same applies hereinafter).

  Then, the page reading unit 20 sets a URL that the URL determination unit 10 has not determined to be harmful as an unknown URL, and reads the web page corresponding to the unknown URL via a communication network (such as the Internet or a mobile phone network). Crawling) (page reading process), and the harmfulness determination means 30 makes a harmful determination as to whether the web page read in this way is harmful (harmful determination process).

  At this time, for the unknown URL corresponding to the web page that is determined to be harmful by the harmfulness determination means 30, the tail removal means 50 is a character on the end side that is separated by a predetermined hierarchy delimiter (“/”, “?”, Etc.). One or two or more layers are removed from the column (end removal processing), and the end determination registration unit 60 also reads the above-described page read into the page reading unit 20 and the harmful determination unit 30 for the unknown URL from which the end is removed in this way If the harmful URL is determined to be harmful, the removed unknown URL is registered in the harmful URL list 10 (tail determination registration process).

For example, if the unknown URL “shortXX.com/aa/xx1” is determined to be harmful, the part “/ xx1” after the first hierarchical delimiter “/” on the end side is removed. If it is determined to be harmful even if it is shortened and "shortOO.com/aa" is registered, the harmful URL is registered in this shortened state. Thereafter, the URL obtained by combining other spoofed parts such as “ shortXX.com/aa/yy2 ” is also determined by matching with the “ shortxxx.com/aa ” part registered in the harmful URL list. Hazard determination is possible.

  As described above, when the URL in the message is unknown in the harmful URL list and is unknown and is determined to be harmful when the page is read, it is also harmful for the URL cut from the lower layer at the end of the URL separated by “/”, “?”, Etc. By determining, it is possible to detect and register a harmful URL even for a short URL impersonated by adding a lower layer, and the determination accuracy can be effectively improved.

  In the present invention and this embodiment, the harmful determination means can be realized by machine learning such as SVM (support vector machine), but the harmful determination means stores harmful words stored as recorded words. By providing a determination dictionary and configuring the contents of the web page description file corresponding to the URL to collate with the harmful determination dictionary and determine whether it is harmful based on the presence / absence and number of matches with the recorded words Therefore, it is possible to easily carry out a harmful determination by a simple method of matching with a dictionary recorded word.

  The removal of the tail seems to be effective in many cases if it is performed on one layer, but the following recursive processing procedure is particularly suitable when it is performed on a plurality of layers.

[3. (Recursive procedure)
That is, this recursive processing procedure is performed for unknown URLs based on control by the control means 80 such as a control routine.
(1) The page reading means 20 reads the web page pointed to by the URL,
(2) Determine whether the harm determination means 30 is harmful or harmless for the read web page,
(3) When it is determined to be harmful, the tail removing means 50 temporarily stores the URL in a predetermined storage area and cuts a character string for one layer after the predetermined layer delimiter at the URL end. Then, after processing into the URL of the remaining upper layer part, the processed URL is processed again from the above (1).
(4) When the URL determined to be harmless and determined to be harmful is temporarily stored, the tail determination registration unit registers the temporarily stored URL in the harmful URL list.

  As an example, as shown in FIG. 2, when the URL of state 1 (shortOO.com/aa/bb/cc?=1234) is determined to be harmful, after the first hierarchy delimiter “?” On the end side The part “? = 1234” of FIG. Similarly, if it is harmful, the part “/ cc” after the next hierarchy delimiter “/” is removed to determine state 3 and then state 4, and if it is determined to be harmless for the first time in state 4, it is finally harmful. The URL “shortOO.com/aa/bb” in the state 3 is registered as a harmful URL.

  As described above, the URL determined to be harmful is repeatedly checked after removing the tail, and when it is no longer harmful, it is harmful by a simple recursive process of registering the last harmful URL in the harmful URL list. The shortest URL redirected to the page can be specified and registered, and a highly accurate determination can be realized regardless of the number of layers of the camouflaged redundant character string.

[4. Example of overall processing procedure)
Here, the flowchart of FIG. 3 shows a processing procedure when the first outline is realized by the recursive processing procedure as described above. In this example, when checking a comment posted on a blog or the like, priority is given only to the harmful URL list with priority given to quick response (FIG. 3 (1)), and there is no match with the harmful URL list. The URL check is separately processed in a batch or the like (FIG. 3 (2)).

  That is, the URL determination means 15 replies that it is harmless if there is no URL in a message such as a comment that needs to be checked (step S51) (step S56). S51) The harmful URL list 10 is checked (step S52), and if it matches in the sense that any harmful URL in the list is included (step S53), it is answered that it is harmful (step S54). If there is no harmful URL that matches with the harmful URL list 15 (step S53), the URL is stored as an unknown URL to be checked (step S55).

  Thereafter, in batch processing at a predetermined interval (every tens of minutes to every night, etc.) (FIG. 3 (2)), for each URL to be checked stored as described above, a web page indicating the page is displayed. The reading unit 20 actually refers to and reads (step S61), and the harmfulness determination unit 30 determines whether or not the URL is harmful by using a harmfulness determination dictionary or the like, that is, a harmful determination (step S62).

  As a result, if it is determined that it is harmful (step S63), if there is still a hierarchy delimiter such as “/” or “?” On the end side of the top domain portion of the current URL (step S64), the end removing means 50 deletes the part after the last delimiter from the current URL (step S66) and repeats the process from page reading (step S61). Prior to this deletion (step S66), the URL immediately before the deletion is changed. Temporary storage is performed in a predetermined storage area (step S65).

  If the URL determined to be harmful (step S63) no longer has a delimiter (step S64), the top domain itself is a harmful URL. Therefore, the tail determination registration means 60 uses the current URL, that is, the top domain as the harmful URL list. 10 (step S67), the processing is terminated for the URL, and the next unknown URL is set as a processing target.

  When the harm determination (step S62) determines harmless (step S63), if the URL immediately before deletion is temporarily stored (step S68), the previous URL is harmful (step S63) and the end is deleted. As a result (step S66), it is a case where a non-hazardous hierarchy such as the top domain of the short URL service has been reached, the tail determination registration means 60 adds the URL immediately before being harmful to the harmful URL list 15 (step S69). ), The process is terminated for the URL, and the next unknown URL is set as a processing target.

  Note that if the URL, which is one level higher than the end of the URL, cannot be accessed or read due to an error, it is determined that the URL is not harmful (step S63), and the URL before removal is registered as a harmful URL (step S63). Step S69).

[5. Other examples of processing procedures]
FIG. 4 is a flowchart showing an example of a processing procedure for associating a redirect source and a redirect destination in a short URL and efficiently performing harmful registration by limiting the removal of the tail to one layer.

  In this example, it is determined whether or not the URL to be checked is a redirect URL by a return code at the time of reading (step S21). If the URL is not a redirect URL (step S21), the page reading unit 20 reads the page and the harmfulness determining unit 30 If it is determined to be harmful (step S22), the tail determination registration means 60 registers the URL in the harmful URL list 10 (step S23).

  On the other hand, if the URL to be checked is a redirect URL (step S21), the URL determination means 15 is not registered as a result of collation with the harmful URL list 10 (step S24), and the page reading means 20 reads the page. When it is determined that it is harmful (step S22), the tail determination registration unit 60 registers the redirect source URL and the redirect destination URL in the harmful URL list 10 (step S29). In this case, the first redirect source URL and the final redirect destination URL are registered.

  In addition, if there is a URL (referred to as “upper layer URL”) one level higher than the redirect source URL (step S30), the tail determination registration unit 60 sends a page to the page reading unit 20 and the harmful determination unit 30 for the upper layer URL. When it is a harmful site, it is determined to be harmful after reading, and an upper layer URL is registered instead of the original URL (step S27), and the process proceeds to the next URL (steps S21 to S21).

  In this example, the “up one layer” URL is the “/” symbol or “?” ”Symbol, and if it is“ / ”, the URL with the right side deleted,“? ” ], The URL including the symbol is deleted from the right side, but the type of the hierarchy delimiter symbol and the handling thereof can be changed as appropriate.

  As for the redirect URL (step S21), if the URL determination unit 15 collates with the harmful URL list 10 and the redirect destination URL is a harmful site, that is, a harmful URL (step S24), the tail determination registration unit 60 sets the redirect source URL. Is registered in the harmful URL list 10 (step S25), and the URL above one level (step S26) is subjected to the same processing as above (step S27).

  In this way, depending on the registration status and harmfulness of the redirect destination URL, only the redirect source, or the redirect source URL and the redirect destination URL are harmfully registered in the harmful URL list 10 and the removal of the tail is performed one level of the redirect source URL. By limiting to the upper limit, the processing becomes efficient and the processing load is reduced.

[6. Second outline)
The second outline is to use harmful determination means corresponding to the data capacity of the web page in determining the harmfulness of the web page corresponding to each URL.

  That is, the data capacity range of the web page description file (HTML file etc.) of the web page read by the page reading means 20 using the plurality of harmful judgment means 31, 32, 33 (FIG. 1) for judging the harmfulness of the web page. Is determined based on one or more reference values (capacity determination processing), and the selection means 47 includes a plurality of harmful determination means 31, according to the data capacity range determined here. By selecting one or more of 32, 33, the harmfulness of the web page is determined (selection process).

  In this way, by changing which of the plurality of harmful determination means is applied according to the data capacity such as HTML, it is possible to use the web page according to whether it is for a personal computer or a mobile phone terminal, the length of the web page, etc. It is possible to make a harmful judgment with high accuracy.

[7. (Diversification of dictionaries and standards)
As the plurality of harmful determination means used as described above, those based on machine learning such as SVM (for example, the harmful determination means 33) can be used. However, as shown in FIG. (For example, 31 and 32), there are provided the harmful determination dictionaries D1 and D2 corresponding to the data capacity range and including different harmful words and phrases as recorded words, and the content of the web page description file corresponding to the URL is determined to be harmful. It can be configured to collate with D1 or D2 and determine whether it is harmful based on the match with the recorded word.

  In this way, it is not essential and can be omitted, such as switching or combining harmful dictionaries to be used, as well as adopting a simple harmful judgment method of matching against words recorded in the harmful judgment dictionary, but it is also possible to omit it Thus, the contents of the harmful determination can be easily and reliably changed according to the data capacity of the web page to be determined.

[8. Combination of criteria)
In addition, the plurality of harmful determination means as described above are not limited to alternative selection. For example, the URL is an AND condition that is determined to be harmful by using a plurality of harmful determination means and harmful determination criteria. Can be determined freely, or can be determined to be harmful if one of them is determined to be harmful (OR condition).

  Also, depending on the data volume, there are multiple criteria for determining how many words, etc. per web page are considered harmful, as well as using multiple harmful judgment means and multiple harmful judgment dictionaries. You may apply by selection or the combination by logical operations, such as AND and OR.

  In this case, the selection means 47 selects one or two or more harmful judgment criteria including the number of matching words with the recorded words of the harmful judgment dictionary according to the determined data capacity range, and ANDs or ORs them. It is applied by the logical operation of In this way, harmful judgment criteria such as the number of words are switched according to the HTML file data capacity, and a plurality of harmful judgment criteria are applied in a relationship of AND or OR, so that the harmful judgment is made according to the situation such as the target or situation The accuracy can be further improved.

  A particularly desirable aspect is that in the harmful judgment means having the harmful judgment dictionary, the classification of the harmful judgment dictionary or its recorded words is divided into black words, that is, black words and gray words, that is, gray words, according to the degree of harmfulness, Black word dictionary (black word group) and gray word dictionary (gray word group), and the number of matching words in the black word dictionary and the number of matching words in the gray word dictionary for each data capacity range as predetermined harmful judgment criteria One or both of the above are used.

  As an example, as shown in Fig. 5 (conceptual diagram of data structure), the words recorded in the black word dictionary for general pages are, for example, "Amateurism", "Browsing under 18 years old", "Nude exposure", "Adult" Video information ”can be considered, and the words recorded in the gray word dictionary for general pages can be, for example,“ exposure system ”,“ Are you 18 years old or older ”,“ best amateur ”,“ adult video ”, and the like.

  In addition, the low-capacity harmful judgment dictionary contains many simple expressions such as using half-width katakana. For example, the exposure words in the black word dictionary are “exposure video”, “over 18 years old?”, “Best amateur”, “adult video” And the like, and examples of words recorded in the low-capacity gray word dictionary are “exposure”, “over 18 years old”, “amateur”, “adult video”, and the like. In this application, katakana is represented by full-width characters. However, for low-capacity applications, katakana is collated with reference to half-width characters or without distinguishing between full-width and half-width characters.

  Thus, the determination accuracy is further improved by determining the number of matching words in the harmful determination criterion for each black word dictionary and gray word dictionary corresponding to the harmful degree and in combination with the page data capacity range.

  The number of dictionaries is not limited to two, such as black and gray. For example, in addition to a black word dictionary that is determined to be harmful by one word, a gray word dictionary that is determined to be harmful by two words, and 3 A configuration such as a gray word dictionary that is determined to be harmful by a word, such that a plurality of dictionaries that have different numbers of reference words for harmful determination are sequentially determined to be harmful, and if any of the dictionaries satisfies the reference word number, it is determined to be harmful By doing so, it is possible to realize excellent determination accuracy based on more detailed harmful determination criteria.

[9. Example of determination procedure according to capacity]
As described above, an example of the processing procedure for properly using the harmful determination means and the reference according to the data capacity is illustrated in the flowchart of FIG. This flowchart corresponds to step S62 in FIG.

  That is, the capacity determination means 45 acquires the capacity of the HTML file of the web page that is the object of the harmful determination (may be a web page description file in a markup language of another standard) (step S71), and 12KB for mobile terminals etc. For low capacity pages below (kilobytes) (step S72), using the low capacity page harmful determination dictionary D1, and applying the low capacity page determination criteria J1 such as black 1 word or gray 2 words, A harmful determination is performed (step S81).

  For general pages of more than 12 KB to less than 30 KB (steps S72, S73), using the general page harmful determination dictionary D2 and applying the general page determination criteria J2 such as the four gray words are harmful. A determination is made (step S82). Furthermore, for pages with a large capacity of 30 KB or more (step S73), since it will be over-regulated if a small number of words is used as a reference, it uses a machine learning determiner based on the SVM classifier instead of the number of words. (Step S83).

[10. Use by API]
In addition, this apparatus can be called from various services by an API (Application Program Interface). That is, the API delivery means 70 (API interface unit) implements a service and includes a message input from a process or system (function unit such as an electronic bulletin board shown in FIG. 1 or a server) that is a caller as a parameter. The API call is accepted, and the result of the harmful determination is returned to the caller as an API return value for the call (API delivery process).

In this case, for example, the return value of the API is
(1) Match with harmful site URL (2) Harmful judgment: Adult expression, dating (3) Harmful judgment: Defamation, slander, discrimination (4) Harmful judgment: Affirmation and promotion of suicide, violence, drug abuse (5) Harmful judgment: A combination of multiple parameters that correspond to harmful types such as business information that irritates euphoria. For each parameter, parameter values such as points according to the number of matches with the words in the harmful judgment dictionary for that item May be returned. In this case, a pattern such as 100 points for each individual parameter, 50 points for an adult expression parameter, and 34 points for a business information parameter can be considered for a certain web page.

  In the case of such an implementation, each service process or system makes a rejection of posting or recommends deletion to an administrator in accordance with the return value in accordance with each function or policy.

  As described above, the configuration (API delivery means 70) that enables calling from various services via the API is not essential and can be omitted. However, by adopting the configuration, more judgment examples are based. Therefore, the accumulation of harmful URL information can be enhanced and the determination accuracy can be further improved, and high-accuracy determination based on the stored information can be widely used from more services.

[11. Other embodiments]
In addition, since the said embodiment is only an illustration and this invention is not limited to the said embodiment, the example which is illustrated next and another example are also included. For example, the message determination apparatus may be realized by a combination / cooperation of a plurality of computers and servers in charge of each function such as the above-described means.

  In addition, the timing at which the harmful determination is performed is free for implementation. For example, the harmful determination is not performed at the time of inputting the message, and the blog of each user hosted in the functional unit of the blog or the server 1 It is possible to detect harmful spam or the like by circulating a new post of a registered thing or an element (blog part) such as a predetermined image in a predetermined time period or time.

  Further, the target of the harmful determination is not limited to the URL in the message body, but also includes URLs included in the input contents exposed to the viewer along with the message, such as the link destination URL of the name and the display related to the profile.

  In the above-described embodiment, an unknown URL that does not match the harmful URL list 10 is not returned on the spot as a harmful response, and harmful determination using a dictionary or the like is performed after the fact. Although shown (FIG. 3), the example performed at the time of contribution to such a harmful determination is also considered.

  The processing procedure in such an example is shown in FIG. In this example, even if there is no match in the comparison with the harmful URL list (step S53), the harmful judgment based on the harmful judgment dictionary is continued on the spot while removing the tail according to FIG. 3 (2) (step S65). (Step S62), if it can be determined that it is harmful (step S63), not only additional registration to the harmful URL list (steps S67 and S69) but also a reply indicating that it is harmful (step S54).

  In addition, as a method of reflecting the harmful judgment result to the service, the posted content is immediately reflected in the blog, while the harmful judgment result and the message judged harmful are notified to the posted blog administrator by e-mail etc. However, this is not limited to this, but if it can be determined that it is harmful before or after posting the post, the message posting can be rejected or the message deleted without waiting for the administrator's operation. Examples are also possible.

  For example, in the example shown in the conceptual diagram of FIG. 8, when a blog functional unit or server 1 posts a message (step S11), it sends a check request to the message determination device 2 similar to that shown in FIG. When an answer of harmful is received (step S13), the post is deleted or blog posting is avoided (step S16).

The figure which shows the structure of embodiment of this invention. The figure which shows the example of URL registration in embodiment of this invention. The flowchart which shows the whole process sequence in embodiment of this invention. The flowchart which shows the other example of the whole processing procedure in embodiment of this invention. The figure which shows an example of the harmful determination dictionary in embodiment of this invention. The flowchart which shows the process sequence which uses a harmful | toxic determination means properly according to data capacity in embodiment of this invention. The figure which shows other embodiment of this invention. The figure which shows other embodiment of this invention.

Explanation of symbols

A (A1, A2) Contributor B Blog administrator 1 Blog functional part or server 2 Message judging device 10 Harmful URL list 15 URL judging means 20 Page reading means 30 (31, 32, 33) Harmful judging means D (D1 D2) Hazard determination means 45 Capacity determination means 47 Selection means 50 End removal means 60 End determination registration means 65 Hazard notification means 70 API delivery means 80 Control means

Claims (9)

A plurality of harmful determination means for determining the harmfulness of a web page;
Page reading means for reading a corresponding web page via a communication network based on a URL included in a message input to a message service;
Capacity determination means for determining the data capacity range of the web page description file of the read web page based on one or more reference values;
A selection unit that determines the harmfulness of the web page by selecting one or more of the plurality of harmful determination units according to the determined data capacity range;
Is realized by a computer. At least some of the plurality of harmful determination means are
Corresponding to the data capacity range, having a harmful judgment dictionary with different harmful words and phrases as recorded words,
The content of the web page description file corresponding to the URL is collated with the harmfulness judgment dictionary to determine whether or not it is harmful based on a match with the recorded words. Message determination device. The selecting means selects one or two or more of a plurality of harmful judgment criteria including the number of coincident words with words recorded in the harmful judgment dictionary according to the determined data capacity range and performs an AND or OR logical operation. The message determination device according to claim 2, wherein the message determination device is configured to be applied. The harmful determination means having the harmful determination dictionary includes:
As the harmfulness judgment dictionary, it has a black word dictionary and a gray word dictionary according to the difference in harmfulness,
The number of matching words in the black word dictionary or the number of matching words in the gray word dictionary is used as the harmful determination criterion determined in advance for each data capacity range. Or the message determination apparatus of 3 description. A page reading process for reading a corresponding web page via a communication network based on a URL included in a message input to the message service;
A capacity determination process for determining a data capacity range of the web page description file of the read web page based on one or more reference values;
Selection that determines the harmfulness of the web page by selecting one or more of a plurality of different harmful determination processes that determine the harmfulness of the web page according to the determined data capacity range Processing,
Is executed by a computer. At least a part of the plurality of harmful determination processes is
Corresponding to the data capacity range, using a pre-recorded harmful judgment dictionary with different harmful words and phrases as recorded words,
6. The message determination method according to claim 5, wherein the content of the web page description file corresponding to the URL is compared with the harmful determination dictionary to determine whether the content is harmful based on a match with the recorded word. . The selection process selects one or more of a plurality of harmful determination criteria including the number of matching words with words recorded in the harmful determination dictionary according to the determined data capacity range, and performs an AND or OR logical operation. The message determination method according to claim 6, wherein the message determination method is applied. The harmful determination process includes
As the harmfulness judgment dictionary, using a black word dictionary and a gray word dictionary according to the difference in harmfulness,
The predetermined harmful judgment criterion is one or both of the number of matching words in the black word dictionary and the number of matching words in the gray word dictionary for each data capacity range. Or the message determination method of 7. By controlling the computer
A page reading process for reading a corresponding web page via a communication network based on a URL included in a message input to the message service;
A capacity determination process for determining a data capacity range of the web page description file of the read web page based on one or more reference values;
Selection that determines the harmfulness of the web page by selecting one or more of a plurality of different harmful determination processes that determine the harmfulness of the web page according to the determined data capacity range Processing,
A message determination program for executing

Images