JP2020052766A - Determination device and determination method - Google Patents

Abstract

To provide a determination device and a determination method which can accurately determine whether or not a site is a harmful site from URL of the site.SOLUTION: A determination device 100 includes: a vectorization unit 40 which vectorizes a character string of arbitrary URL using a URL vectorization model VM for regarding a character string included in URL as one sentence and vectorizing the character string; and a determination unit 60 which determines whether or not a site indicated by the URL to be determined is harmful using vectors obtained by vectorizing each of a plurality of character strings of URL that has been previously determined whether or not to be harmful by the vectorization unit 40, and a vector obtained by vectorizing the character string of the URL to be determined by the vectorization unit 40.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a determination device and a determination method for determining whether a URL site is harmful using a URL character string.

  2. Description of the Related Art Conventionally, as the types of services provided via a network increase, the number of sites providing various services has also increased. As a result, for example, the number of harmful sites such as phishing sites for impersonating sites that provide legitimate services and illegally acquiring user information such as credit card numbers is increasing. However, it is difficult for a user to determine whether a site provides a legitimate service by looking at the URL (Uniform Resource Locator) of the site.

  For example, Google (registered trademark) builds a database of insecure sites based on daily research and provides an API (Application Programming Interface) that allows an application such as a web browser to use the database (non-patented). Reference 1). This allows the user to determine whether the site is a legitimate site using an application such as a web browser.

  In addition, a filtering method capable of coping with a malicious URL has been proposed by determining the granularity of a partial URL used for filtering based on a common part of a tree structure in a group of malicious URLs and the state of each URL (Non-Patent Document) 2). Further, a method of detecting a phishing attack by making similar URL structures into rules and calculating similarity has been proposed (see Non-Patent Document 3).

Google Safe Browsing (https://developers.google.com/safe-browsing/v4/) Mitsuaki Akiyama, Takeshi Yagi, Mitsuyasu Ito, "Granularity Determination of URL Filtering Focusing on Tree Structure of Malicious URLs", IEICE Technical Report, No. 110, 266, pp. 53-58, 2010 P. Prakash et al, "PhishNet: Predictive Blacklisting to Detect Phishing Attackes", IEEE INFOCOM, pp. 139-157. 346-350, 2010

  However, the number of harmful sites is increasing every day, and the character strings of URLs are also changing. For this reason, it is difficult to uniquely determine the rules of the URL character string in the filtering. Also, it is difficult to cover all harmful sites in the database.

  An object of the present invention is to provide a determination device and a determination method that can accurately determine whether a site is harmful from the URL of the site.

  (1) A determination device according to the present invention includes a vectorization unit that vectorizes a character string of an arbitrary URL using a URL vectorization model for vectorizing a character string included in a URL as one sentence. A vector in which the character strings of the plurality of URLs that have been previously determined to be harmful or not by the vectorization unit are vectorized, and a vector in which the character string of the URL to be determined is vectorized by the vectorization unit, And a determination unit that determines whether or not the site indicated by the URL to be determined is harmful.

  (2) In the determination device according to (1), a label indicating a determination result as to whether each of the plurality of URLs is harmful and a character string of the plurality of URLs are vectorized by the vectorization unit. And a learning unit that generates a determination model for determining whether a site indicated by an arbitrary URL is harmful by machine learning using the vector as teacher data, and the determination unit is generated by the learning unit. The determination model may be used to determine whether the site indicated by the URL to be determined is harmful.

  (3) In the determination device according to (1), a label indicating a determination result as to whether or not each of the plurality of URLs is harmful corresponds to a vector in which the character string of each of the plurality of URLs is vectorized. A determining unit configured to determine whether a site indicated by the URL to be determined is harmful using the generated mapping data. good.

  (4) In the determination device according to (1), the URL vectorization model converts a short character string generated by dividing a URL character string into at least a query part, a path part, and a host name structure into one sentence. A vectorization model for generating a vector of a short character string for each structure from the character string of the URL for text vectorization as described above, wherein the vectorization unit uses the URL vectorization model to generate an arbitrary URL. Is vectorized for each of the structures, and the determining unit generates a vector generated for each of the structures from a plurality of URL character strings that are determined in advance as to whether they are harmful by the vectorizing unit, and the vectorizing unit Determining whether the site indicated by the URL to be determined is harmful, using a vector generated for each structure from the character string of the URL to be determined And it may be.

  (5) In the determination device according to (4), the determination unit may select a structure of the URL according to a type of a harmful site.

(6) In the determination device according to (4), the URL vectorization model further includes:
A vectorization model for generating a connected vector by connecting vectors generated for each of the structures from a URL character string, wherein the vectorization unit further uses the URL vectorization model to generate an arbitrary URL character string. Generating a connected vector obtained by connecting the vectors generated for each of the structures, and the determining unit further generates the connected vector generated from the character strings of the plurality of URLs that are determined in advance as to whether they are harmful by the vectorizing unit. Whether or not the site indicated by the URL to be determined is harmful may be determined using a vector and a connected vector generated from the character string of the URL to be determined by the vectorization unit.

  (7) The determination method according to the present invention is a determination method realized by a computer, and uses a URL vectorization model for vectorizing a character string included in a URL by regarding the character string as one sentence. A vectorization step of vectorizing a column, and in the vectorization step, a vector in which character strings of a plurality of URLs that have been determined to be harmful or not are vectorized, and a character string of a URL to be determined is vectorized. A determination step of determining whether the site indicated by the URL to be determined is harmful using the determined vector.

  According to the present invention, it is possible to accurately determine whether or not a site is harmful from the URL of the site.

FIG. 2 is a diagram illustrating an example of a determination device according to the first embodiment. FIG. 5 is a diagram illustrating a generation process in the determination device according to the first embodiment. FIG. 5 is a diagram illustrating a determination process in the determination device according to the first embodiment. It is a figure showing an example of a judgment device concerning a 2nd embodiment. FIG. 13 is a diagram illustrating a generation process in the determination device according to the second embodiment. It is a figure which illustrates the judgment processing in the judgment device concerning a 2nd embodiment. It is a figure showing an example of a judgment device concerning a 3rd embodiment. It is a figure which illustrates the generation processing in the judgment device concerning a 3rd embodiment. It is a figure which illustrates the judgment processing in the judgment device concerning a 3rd embodiment.

  Hereinafter, embodiments of the present invention will be described.

[First Embodiment]
FIG. 1 is a diagram illustrating an example of the determination device according to the first embodiment.

  The determination device 100 according to the first embodiment is, for example, an information processing device (computer) such as a personal computer or a server having a control unit 10 such as a processor and a storage unit 20 such as a hard disk device or a memory. Further, the determination device 100 has an interface function with an external device such as an input / output device and a communication interface. Accordingly, the determination device 100 is connected to the external storage device 200, the storage device 300, and the storage device 400 via a wire or wirelessly. Note that the determination device 100 may be connected to the storage device 200, the storage device 300, and the storage device 400 via a network.

  The storage device 200 is a data server or the like including a hard disk device or the like, and stores URL data 210. The URL data 210 includes character strings of URLs of a plurality of sites, but may include an access log, a list of known harmful sites, a list of legitimate sites, and the like.

The storage device 300 is a data server or the like including a hard disk device or the like, and stores, for example, harmful URL data 310 to which a degree of malignancy is assigned. The storage device 300 may include, for example, URL data of Google Safe Browsing (registered trademark). It should be noted that the URL data is not limited to the URL data of Google Safe Browsing, and may be URL data to which an arbitrary site provides a degree of malignancy.
The storage device 400 is a data server including a hard disk device and the like, and stores, for example, regular URL data 410 indicating a regular URL provided by an arbitrary site.

  The determination device 100 controls the functions of the model generation unit 30, the vectorization unit 40, the learning unit 50, and the determination unit 60 by causing the control unit 10 to execute the determination processing program stored in the storage unit 20. Have.

The model generation unit 30 extracts necessary information from a set of URL data 210 stored in the storage device 200, for example, and divides each URL into short character strings. Here, the necessary information is a character string of a URL. Note that Ngram (N ≧ 2) may be applied as a method of dividing the URL character string into short character strings, but is not limited thereto. An arbitrary dividing method may be applied.
The model generation unit 30 generates a URL vectorization model VM (hereinafter, also referred to as a “vectorization model VM”) for vectorizing the URL that has become the divided character string as one sentence. I do. Here, for example, Doc2vec (registered trademark) (Q. Le and T. Mikolov, “Distributed Representations of sentences and documents”, Proceedings of the 31st International Conference on International Conference on Machine Learning, pp. II-) known to those skilled in the art. 1188-II-1196, 2014) may be used to generate the URL vectorized model VM. In this manner, a URL vectorization model for vectorizing a character string of an arbitrary URL as one sentence is generated.

  Note that Doc2vec generates the URL vectorized model VM based on machine learning such as deep learning. The URL vectorization model VM generated by Doc2vec can calculate the degree of similarity with another URL by vectorizing the URL as a sentence, and can search and group similar URLs. As described above, the model generation unit 30 generates the URL vectorization model VM for vectorizing a character string of an arbitrary URL as one sentence based on machine learning in Doc2vec, for example. The model generation unit 30 stores the generated URL vectorization model VM in the storage unit 20. Note that the model generation unit 30 uses Doc2vec when generating the URL vectorized model VM, but is not limited thereto. Other software that can generate a sentence vectorization model for vectorizing a sentence may be used.

In addition, the model generation unit 30 acquires the URL data 210 from one storage device 200, but acquires various URL data 210 from a plurality of storage devices 200, and also includes the harmful URL data 310 to which the malignancy is assigned, and The regular URL data 410 of the regular URL may be obtained. Alternatively, the model generating unit 30 may not only acquire the URL data 210 from the storage device 200 but also search various sites and acquire the URL data.
Hereinafter, for simplicity, unless otherwise specified, the URL vectorized model VM is also referred to as a “vectorized model VM”.

The vectorization unit 40 reads the vectorization model VM from the storage unit 20, and uses the vectorization model VM, for example, URL data that has been previously determined to be harmful or an arbitrary URL such as a URL to be determined. Vectorize the character string of
More specifically, the vectorizing unit 40 receives, for example, the harmful URL data 310 to which the degree of malignancy is assigned from the storage device 300, and a URL vector obtained by vectorizing the character string data of the URL and the URL of the URL. Teacher data including a label indicating the degree of malignancy is generated, and the generated teacher data is stored in the storage unit 20.
In addition, the vectorization unit 40 receives, for example, the normal URL data 410 from the storage device 400, and a URL vector obtained by vectorizing the character string data of the URL, and a label indicating that the URL is a normal URL. Is generated, and the generated teacher data is stored in the storage unit 20. In addition, the vectorization unit 40 converts a URL not included in the harmful URL data 310 among a plurality of URLs of the URL data 210 acquired from the storage device 200 into a URL vector that is vectorized as a regular URL, and the URL May be generated, and the generated teacher data may be stored in the storage unit 20.
Further, the vectorization unit 40 vectorizes the character string of the URL to be determined.

  The learning unit 50 executes, for example, supervised machine learning by inputting the teacher data stored in the storage unit 20. By doing so, the learning unit 50 generates the determination model ML for determining whether the site of the URL to be determined is harmful. The learning unit 50 stores the generated determination model ML in the storage unit 20. Here, the determination model may be a binary model that determines whether the site of the URL to be determined is harmful according to the contents of the label indicating the malignancy of the URL. Further, the site of the URL to be determined may be a multi-value model for determining the type of malignancy such as a malware distribution site, an adult site, a phishing site, a fraud site, and the like.

  The determination unit 60 inputs the vector of the URL of the determination target vectorized by the vectorization unit 40 to the determination model ML, and determines whether the site indicated by the URL of the determination target is harmful. The determination unit 60 displays the determination result on a display such as an LCD (Liquid Crystal Display) included in the determination device 100, for example. The learning unit 50 may execute the machine learning by adding the vector of the URL to be determined and the determination result, and may update the determination model ML. Thereby, the determination device 100 can improve the determination accuracy of the harmful URL.

  FIG. 2A is a diagram illustrating a generation process in the determination device 100 according to the first embodiment. The process illustrated in FIG. 2A is executed, for example, when an administrator or the like of the determination device 100 operates an input device such as a keyboard and a mouse included in the determination device 100.

  In step S1, the model generation unit 30 extracts necessary information from a set of URL data 210 stored in the storage device 200, divides each URL into short character strings, and obtains a character string thus divided. The generated URL is regarded as one sentence, and a URL vectorization model VM (vectorization model VM) is generated. The model generation unit 30 stores the generated URL vectorization model VM in the storage unit 20.

  In step S2, for example, the vectorizing unit 40 inputs, from the storage device 300, harmful URL data 310 to which the degree of malignancy is assigned, and a URL vector obtained by vectorizing the character string data of the URL, and the degree of malignancy of the URL. Is generated, and the generated teacher data is stored in the storage unit 20. Further, the vectorization unit 40 receives the normal URL data 410 from the storage device 400, and obtains a URL vector obtained by vectorizing the character string data of the URL, and a label indicating that the URL is a normal URL. The generated teacher data is stored in the storage unit 20.

In step S3, the learning unit 50 inputs the teacher data stored in the storage unit 20, and performs supervised machine learning. By doing so, the learning unit 50 generates the determination model ML for determining whether the site of the URL to be determined is harmful. The learning unit 50 stores the generated determination model ML in the storage unit 20.
The process of generating the URL vectorized model VM in step S1 and the process of generating the teacher data in step S2 and the determination model ML in step S3 may be executed separately.

FIG. 2B is a diagram illustrating a determination process in the determination device 100 according to the first embodiment. The process illustrated in FIG. 2B is executed, for example, when an administrator or the like of the determination device 100 operates the input device of the determination device 100.
In step S4, the determination unit 60 acquires the URL to be determined from the URL data 210 or the like of the storage device 200.
In step S5, the vectorization unit 40 reads the URL vectorization model VM from the storage unit 20, and vectorizes the character string of the URL to be determined acquired in step S4 using the URL vectorization model VM.

  In step S6, the determination unit 60 inputs the vector of the URL of the determination target vectorized by the vectorization unit 40 to the determination model ML, and determines whether the site of the URL of the determination target is harmful. The determination unit 60 displays the determination result on the display of the determination device 100.

  As described above, in the first embodiment, the determination device 100 determines a URL vector obtained by regarding the harmful URL data 310 and the character string data of the URL of the normal URL data 410 as one sentence, And machine learning is performed by using the label assigned to the. And the determination model ML is generated. Then, the determination device 100 considers the character string data of the URL to be determined as one sentence using the vectorization model VM to vectorize and inputs the vectorized determination target URL vector to the determination model ML, It is determined whether the site of the URL to be determined is harmful.

  In other words, the determination device 100 performs machine learning using the URL vectors of the URL data 210, the harmful URL data 310, and the regular URL data 410, and the label assigned to each URL vector as the teacher data, so that the harmfulness is high. Automatically learn the URL structure. Accordingly, the determination device 100 can accurately determine whether or not the site of the URL to be determined is harmful without using any filtering rule (such as a signature). Further, the determination device 100 can automatically follow the URL of the attacker that changes every day by constantly repeating learning and verification, and can improve responsiveness.

  After acquiring the URL data 210 of the storage device 200, the harmful URL data 310 of the storage device 300, and the normal URL data 410 of the storage device 400, the determination device 100 executes the determination process in the determination device 100. Access data can be prevented from leaking when making inquiries. In addition, since the determination device 100 performs the determination process in the determination device 100, the cost of communication with the outside (time and money) can be reduced.

[Second embodiment]
Next, a second embodiment will be described. In the second embodiment, a character string extracted based on context features of a URL (for example, a query structure, a path structure, a structure of a host name, and the like) is converted into a single sentence and vectorized. That is, vectorization is performed for each character string extracted for each contextual feature of the URL. In order to distinguish the vector generated for each contextual feature from the URL vector in the first embodiment, it is referred to as a structure-specific URL vector.
As described above, according to the second embodiment, a vectorization generation model (for each structure) is created based on the URL vector for each structure, machine learning (for each structure) is performed, and a judgment model (for each structure) is generated. There are features.
For example, a URL of a harmful site such as a malware distribution site has a characteristic in a URL query structure, and a URL of a harmful site such as an adult site has a characteristic in a path structure. By creating a structure-based determination model based on a URL, for example, a structure-based URL vector obtained by converting a character string relating to a query structure of a URL to be determined into a vector is converted to a malware distribution site based on the structure-based determination model. Can be determined.
FIG. 3 is a diagram illustrating an example of the determination device according to the second embodiment. In FIG. 3, elements having the same functions as the elements of the determination device 100 according to the first embodiment are denoted by the same reference numerals, and detailed description is omitted.

  The determination device 100A according to the second embodiment includes a model generation unit 30a, a vectorization unit 40a, a learning unit 50a, and a control unit 10 executing a determination processing program stored in the storage unit 20. It has a function with the determination unit 60a.

The model generation unit 30a generates a URL vectorization model (also referred to as a “structure-specific URL vectorization model”) for each URL contextual feature (eg, query structure, path structure, host name structure, etc.).
More specifically, the model generation unit 30a extracts, for example, from a set of URL data 210 stored in the storage device 200 based on the contextual features of the URL (for example, a query structure, a path structure, a structure of a host name, and the like). The character string of the URL to be performed (referred to as “URL character string by structure”) is divided into short character strings by applying, for example, Ngram (N ≧ 2), as in the first embodiment.
The model generation unit 30a generates a structure-specific URL vectorization model VM for vectorizing the character string by URL of the URL that has been divided as described above as one sentence. Here, similarly to the first embodiment, for example, a structure-based vectorization model may be generated using Doc2vec known to those skilled in the art. In this manner, a structure-specific URL vectorization model for generating a vector by regarding a structure-based character string of an arbitrary URL as one sentence is generated. Here, assuming that K is the number of types of structures showing the contextual features of the URL, a URL vectorization model VM (1) -VM (K) for each structure is generated. Then, the model generation unit 30a stores the generated structure-specific URL vectorization models VM (1) to VM (K) in the storage unit 20.

The vectorization unit 40a, for example, based on the structure-specific URL vectorization model VM (i) (1 ≦ i ≦ K), for example, URL data in which a malware distribution site, an adult site, or the like is determined in advance, or a URL to be determined A character string by URL structure extracted from a character string of an arbitrary URL such as a URL based on a contextual characteristic of the URL (eg, a query structure, a path structure, a structure of a host name, etc.) is regarded as one sentence and vectorized. .
A case related to the query structure will be described as an example.
The vectorization unit 40a selects a structure-specific URL vectorization model VM (i) based on the specified structure, and uses the structure-specific URL vectorization model VM (i) to read from the storage device 300, for example, The harmful URL data 310 determined to be a malware distribution site is input, and a structure-specific URL vector in which a character string included in a query structure extracted from the character string data of the URL is vectorized, and the URL is a malware distribution site Is generated, and the generated teacher data is stored in the storage unit 20.
Similarly, the vectorization unit 40a inputs the regular URL data 410 from the storage device 400 by using the structure-specific URL vectorization model VM (i), and converts the query structure extracted from the character string data of the URL into a query structure. It generates teacher data including a structure-specific URL vector in which the included character strings are vectorized and a label indicating that the URL is a regular URL, and stores the generated teacher data in the storage unit 20.
Further, the vectorization unit 40a uses the structure-specific URL vectorization model VM (i) to vectorize a character string included in the query structure extracted from the URL to be determined.
As described above, the vectorization unit 40a selects the structure-specific URL vectorization model VM (i) based on the specified structure, and uses the structure-specific URL vectorization model VM (i) to convert the URL. The character string for each structure is regarded as one sentence and vectorized.

  The learning unit 50a executes, for example, supervised machine learning by inputting teacher data generated for each URL structure stored in the storage unit 20 (structure (i): 1 ≦ i ≦ K). By doing so, the learning unit 50a generates the structure-based determination model ML (i) for determining whether the site of the URL to be determined is harmful from the structure-based character string of the URL according to the structure (i). . The learning unit 50 stores the generated structure-based determination model ML (i) in the storage unit 20. Here, as the determination model, the site of the URL to be determined may be a determination model ML (i) for each structure that determines the type of malignancy such as a malware distribution site, an adult site, a phishing site, a fraudulent site, and the like.

  The determination unit 60a determines the type of a malware distribution site, an adult site, or the like to be determined as a harmful site based on, for example, an instruction from a manager or the like input via the input device of the determination device 100A. The determination unit 60a selects the structure-based vectorization model VM (i) and the structure-based determination model ML (i) of the structure (i) according to the determined site type (1 ≦ i ≦ K). The determination unit 60a reads the structure-based vectorization model VM (i) and the structure-based determination model ML (i) of the selected structure (i) from the storage unit 20. The vectorization unit 40a converts the character string of the URL structure (i) to be determined into a vector using the structure-specific vectorization model VM (i). The determination unit 60a inputs a vector of the structure (i) of the URL to be determined to the structure-based determination model ML (i), and determines whether the site of the URL to be determined is harmful. That is, the determination unit 60a can determine whether the site of the URL to be determined is harmful, according to the type of the harmful site. Then, the determination unit 60a displays the determination result on the display of the determination device 100A, for example.

  The learning unit 50a may execute the machine learning by adding the vector of the structure (i) of the URL to be determined and the determination result, and may update the structure-based determination model ML (i). Thereby, the determination device 100A can improve the determination accuracy of the harmful URL.

  FIG. 4A is a diagram illustrating a generation process in the determination device 100A according to the second embodiment. The process illustrated in FIG. 4A is executed, for example, when an administrator of the determination device 100A operates the input device of the determination device 100A.

  In step S11, the model generating unit 30a extracts necessary information (character string by URL structure) from the set of URL data 210 stored in the storage device 200, and divides the character string by URL structure into short character strings. Then, the structure-based character string of the URL that has been divided as described above is regarded as one sentence, and the structure-based URL vectorization model VM (i) is generated. The model generation unit 30 stores the generated structure-specific URL vectorization model VM (i) in the storage unit 20.

  In step S12, the vectorization unit 40a generates teacher data for each URL structure. For example, harmful URL data 310 to which a degree of malignancy is given is input from the storage device 300, and teacher data including a URL vector obtained by vectorizing a character string according to the structure of the URL and a label indicating the degree of malignancy of the URL are provided. Is generated, and the generated teacher data is stored in the storage unit 20. Further, the vectorization unit 40a inputs the regular URL data 410 from the storage device 400, a URL vector obtained by vectorizing the structure-based character string of the URL, and a label indicating that the URL is a regular URL, Is generated, and the generated teacher data is stored in the storage unit 20.

In step S13, the learning unit 50a inputs the teacher data generated for each URL structure stored in the storage unit 20, and performs supervised machine learning. By doing so, the learning unit 50a generates the structure-based determination model ML (i) for determining whether the site of the URL to be determined is harmful. The learning unit 50 stores the structure-based determination model ML (i) generated for each URL structure in the storage unit 20.
Note that the process of generating the structure-specific URL vectorization model VM in step S11 and the process of generating the teacher data in step S12 and the structure-based determination model ML in step S13 may be executed separately.

FIG. 4B is a diagram illustrating a determination process in the determination device 100A according to the second embodiment. The process illustrated in FIG. 4B is executed, for example, when an administrator of the determination device 100A operates the input device of the determination device 100A.
In step S14, the determination unit 60a acquires a URL to be determined from the URL data 210 or the like of the storage device 200.
In step S15, the determination unit 60a determines the type of a malware distribution site or an adult site to be determined as a harmful site based on an instruction from the administrator or the like input via the input device of the determination device 100A. The determination unit 60a selects the structure-based vectorization model VM (i) and the structure-based determination model ML (i) of the structure (i) according to the determined site type.

In step S16, the vectorization unit 40a reads the structure-specific URL vectorization model VM (i) selected in step S15 from the storage unit 20, and uses the structure-specific URL vectorization model VM (i) to determine the determination target. The character string according to the URL structure (i) is vectorized.
In step S17, the determination unit 60a inputs the vector of the structure (i) of the URL to be determined to the structure-based determination model ML (i), and determines whether the site of the URL to be determined is harmful. The determination unit 60a displays a determination result on a display of the determination device 100A.

  As described above, in the second embodiment, the determination device 100A converts the character string of the URL into the URL extracted based on the contextual characteristics of the URL (for example, the query structure, the path structure, the structure of the host name, and the like). Machine learning is executed using the structure-specific URL vectors obtained by vectorizing the structure-specific character strings and the labels assigned to the structure-specific URL vectors to generate the structure-specific determination model ML (i). Then, the determination device 100A uses the structure-based vectorization model VM (i) to vectorize the structure-based character string of the URL to be determined as one sentence, and converts the structure-based URL vector to be determined into the structure-based determination model. By inputting to ML (i), for example, it can be determined whether or not the site of the URL to be determined is a malware distribution site.

  In the second embodiment, the determination device 100A determines, for each structure indicating the contextual features of the URL, a vector of the URL of the URL data 210, the harmful URL data 310, and the normal URL data 410, and a label assigned to each vector. Is used as learning data to automatically learn a highly harmful URL structure. Accordingly, the determination device 100A can accurately determine whether or not the site of the URL to be determined is harmful without using any filtering rule (such as a signature). In addition, the determination device 100A can automatically follow the URL of an attacker that changes daily by constantly repeating learning and verification, thereby improving responsiveness.

  After acquiring the URL data 210 of the storage device 200, the harmful URL data 310 of the storage device 300, and the regular URL data 410 of the storage device 400, the determination device 100A executes a determination process in the determination device 100A. Access data can be prevented from leaking when making inquiries. In addition, since the determination device 100A executes the determination process in the determination device 100A, communication costs (time and money) with the outside can be reduced.

[Modification of Second Embodiment]
The determination device 100A according to the second embodiment is configured based on an instruction from a manager or the like input via the input device of the determination device 100A, and the vectorization model VM (i) for one structure (i) and The structure-based determination model ML (i) is selected, but is not limited thereto. For example, as a modified example of the second embodiment, the determination device 100A is configured to output two or more structure-specific vectors of two or more structures (i) based on an instruction from an administrator or the like input via the input device of the determination device 100A. The modelized model VM (i) and the structure-based determination model ML (i) may be selected.

  In this case, the control unit 10 has a function as, for example, a vector combining unit (not shown) that combines vectors of two or more selected structures in each of the harmful URL, the regular URL, and the URL to be determined. Is preferred.

  The learning unit 50a performs supervised machine learning using each label and the combined vector of the harmful URL and each label and the combined vector of the regular URL, and two or more structures are combined. Generate a judgment model. Then, the determination unit 60a inputs the vector in which the URLs to be determined are combined into a determination model in which two or more structures are combined, and determines whether the site of the URL to be determined is harmful. Thereby, the determination device 100A can determine a plurality of types of harmful sites.

[Third Embodiment]
Next, a third embodiment will be described. In the third embodiment, the learning unit that executes the machine learning is omitted, and the site of the URL to be determined is determined based on the degree of similarity between the vector of the harmful URL or the regular URL and the vector of the URL to be determined. Determine whether it is harmful.
In the following description of the third embodiment, a case is described in which a URL vectorization model VM that vectorizes a URL as one sentence is used, but the present invention is not limited to this. A plurality of structure-based vectorization models (i) that vectorize the URL for each structure based on the contextual features of the URL may be used.

  FIG. 5 is a diagram illustrating an example of the determination device according to the third embodiment. In FIG. 5, elements having the same functions as the elements of the determination device 100 according to the first embodiment are denoted by the same reference numerals, and detailed description is omitted.

  The determination device 100B according to the third embodiment includes a model generation unit 30, a vectorization unit 40, a determination unit 60b, and a control unit 10 executing a determination process program stored in the storage unit 20. It has a function with the associating unit 70.

The association unit 70 acquires the harmful URL data 310 from the storage device 300, for example. The vectorization unit 40 vectorizes each of the harmful URLs of the acquired harmful URL data 310 using the URL vectorization model VM. Then, the associating unit 70 assigns a label indicating harm to each of the harmful URL vectors.
The associating unit 70 acquires the regular URL data 410 from the storage device 400. The vectorization unit 40 vectorizes each of the normal URLs of the obtained normal URL data 410 using the URL vectorization model VM. Then, the associating unit 70 assigns a label indicating the normal to each of the normal URL vectors. In addition, the association unit 70 may set each of the URLs not included in the harmful URL data 310 among the plurality of URLs of the URL data 210 acquired from the storage device 200 as the regular URL.
The associating unit 70 stores, in the storage unit 20, the vectors and labels associated with the plurality of harmful URLs and the vectors and labels associated with the plurality of regular URLs as the association data TD.

  The determination unit 60b reads the association data TD from the storage unit 20, and obtains a plurality of harmful URL vectors and labels and a plurality of regular URL vectors and labels. Then, the determination unit 60b calculates the cosine similarity, the Euclidean distance, and the like between the vector of the URL to be determined, which is vectorized by the vectorization unit 40, and the respective vectors of the harmful URL and the regular URL. The determination unit 60b compares the calculated cosine similarity, the Euclidean distance, and the like with a predetermined threshold value, and determines whether the site of the URL to be determined is harmful. The determination unit 60b displays the determination result on the display of the determination device 100B.

  In calculating the cosine similarity, the Euclidean distance, and the like, the determination unit 60b calculates the cosine similarity, the Euclidean distance, and the like with the vector of the URL to be determined in order from the vector of the harmful URL indicating the highest harmfulness in the label. It may be calculated.

  The determination unit 60b may add a label corresponding to the determination result to the vector of the URL to be determined, and update the association data TD. Thereby, the determination device 100B can improve the determination accuracy of the harmful URL.

  FIG. 6A is a diagram illustrating a generation process in the determination device 100B according to the third embodiment. The process illustrated in FIG. 6A is executed, for example, when the administrator of the determination device 100B operates the input device of the determination device 100B.

  In step S21, the model generation unit 30 extracts necessary information from the set of URL data 210 stored in the storage device 200, divides each URL into short character strings, and obtains a character string thus divided. The generated URL is regarded as one sentence, and a URL vectorization model VM (vectorization model VM) is generated. The model generation unit 30 stores the generated URL vectorization model VM in the storage unit 20.

  In step S22, the vectorizing unit 40 acquires the harmful URL data 310 from the storage device 300. The vectorization unit 40 vectorizes each of the harmful URLs of the acquired harmful URL data 310 using the URL vectorization model VM generated in step S21. In addition, the vectorization unit 40 acquires the regular URL data 410 from the storage device 400. The vectorization unit 40 vectorizes each of the normal URLs of the obtained normal URL data 410 using the URL vectorization model VM.

In step S23, the associating unit 70 assigns a label indicating harm to each of the harmful URL vectors. In addition, the associating unit 70 assigns a label indicating normal to each of the normal URL vectors. Then, the association unit 70 stores the plurality of harmful URL vectors and labels and the plurality of regular URL vectors and labels in the storage unit 20 as association data TD.
The process of generating the URL vector model VM in step S21 and the process of generating the association data TD in steps S22 and S23 may be executed separately.

FIG. 6B is a diagram illustrating a determination process in the determination device 100B according to the third embodiment. The process illustrated in FIG. 6B is executed, for example, when the administrator of the determination device 100B operates the input device of the determination device 100B.
In step S24, the determination unit 60b acquires the URL to be determined from the URL data 210 or the like of the storage device 200.
In step S25, the vectorization unit 40 reads the URL vectorization model VM from the storage unit 20, and vectorizes the character string of the URL to be determined acquired in step S24 using the URL vectorization model VM.
In step S26, the determination unit 60b reads the association data TD from the storage unit 20, and obtains a plurality of harmful URL vectors and labels and a plurality of normal URL vectors and labels. Then, the determining unit 60b calculates the cosine similarity, the Euclidean distance, and the like between the vector of the URL to be determined vectorized in step S25 and the vectors of the harmful URL and the regular URL.

  For example, when there is a vector of a harmful URL whose cosine similarity is equal to or greater than a threshold value, the determination unit 60b determines that the site of the URL to be determined is harmful. On the other hand, when there is no harmful URL vector having a cosine similarity equal to or greater than the threshold value and there is no similar harmful URL, the determination unit 60b determines that the site of the URL to be determined is normal. Alternatively, when there is a vector of a similar harmful URL whose Euclidean distance is equal to or less than the threshold, the determination unit 60b determines that the site of the URL to be determined is harmful. On the other hand, when there is no similar harmful URL vector whose Euclidean distance is equal to or smaller than the threshold, the determination unit 60b determines that the site of the URL to be determined is normal. Then, the determination unit 60b displays the determination result on the display of the determination device 100B.

  The determination unit 60b may add a label corresponding to the determination result to the vector of the URL to be determined, and update the association data TD. Thereby, the determination device 100B can improve the determination accuracy of the harmful URL.

  As described above, in the third embodiment, the determination device 100B calculates the degree of similarity between each vector of the harmful URL and the regular URL and the vector of the URL to be determined, and determines the site of the URL to be determined. Is harmful or not. Accordingly, the determination device 100B can accurately determine whether or not the site of the URL to be determined is harmful without using any filtering rule (such as a signature). In addition, the determination device 100B constantly updates the URL vectorization model VM and the association data TD based on the determination result, thereby enabling automatic tracking of an attacker's URL that changes daily, thereby improving responsiveness. I can do it.

  In addition, after acquiring the URL data 210 of the storage device 200, the harmful URL data 310 of the storage device 300, and the regular URL data 410 of the storage device 400, the determination device 100B executes a determination process in the determination device 100B. Access data can be prevented from leaking when making inquiries. In addition, since the determination device 100B performs the determination process in the determination device 100B, the cost of communication with the outside (time and money) can be reduced.

  The embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments. In addition, the effects described in the above-described embodiments merely enumerate the most preferable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

[Modification 1 of Embodiment]
In the determination device 100 according to the first embodiment, the vectorization unit 40, the learning unit 50, and the determination unit 60 are arranged in the determination device 100, but may be distributed and arranged in an external device including a cloud, for example. . Also, in the determination device 100A according to the second embodiment, the vectorization unit 40a, the learning unit 50a, and the determination unit 60a may be distributed and arranged in an external device including a cloud. In addition, in the determination device 100B according to the third embodiment, the vectorization unit 40, the determination unit 60b, and the association unit 70 may be distributed and arranged in an external device including a cloud.
For example, with respect to another model generation device such as a cloud, the determination device 100 may generate the URL vectorized model VM by accessing the model generation device.

[Modification 2 of Embodiment]
Although the determination device 100 according to the first embodiment and the determination device 100B according to the third embodiment generate the URL vectorization model VM using the URL data 210 of the storage device 200, for example, the URL vectorization model VM May be generated in advance by an external computer and stored in the storage device 200 or the like. In this case, the determination device 100 and the determination device 100B obtain the URL vectorization model VM from the storage device 200 and store the URL vector model VM in the storage unit 20.
Similarly, in the second embodiment, the structure-specific URL vectorization models VM (1) to VM (K) may be generated in advance by an external computer and stored in the storage device 200 or the like. By doing so, the determination device 100A may acquire the structure-specific URL vectorization model VM (1) -VM (K) from the storage device 200.

Reference Signs List 10 control unit 20 storage unit 30 model generation unit 40 vectorization unit 50 learning unit 60 judgment unit 100 judgment device

Claims (7)

A vectorization unit that vectorizes a character string of an arbitrary URL using a URL vectorization model for vectorizing a character string included in the URL as one sentence;
A vector in which a plurality of URL character strings that have been previously determined to be harmful or not by the vectorization unit are vectorized, and a vector in which the character string of the URL to be determined is vectorized by the vectorization unit is: A determining unit that determines whether the site indicated by the URL to be determined is harmful;
A determination device comprising: By performing machine learning using, as teacher data, a label indicating a determination result as to whether or not each of the plurality of URLs is harmful and a vector in which the character string of the plurality of URLs is vectorized by the vectorization unit. A learning unit that generates a determination model for determining whether a site indicated by an arbitrary URL is harmful,
The determination device according to claim 1, wherein the determination unit determines whether a site indicated by the URL to be determined is harmful using the determination model generated by the learning unit. A mapping unit that generates a mapping data by associating a label indicating a determination result as to whether or not each of the plurality of URLs is harmful with a vector in which the character strings of the plurality of URLs are vectorized. In addition,
The determination device according to claim 1, wherein the determination unit determines whether a site indicated by the determination target URL is harmful using the generated association data. The URL vectorization model converts the URL character string into at least a query part, a path part, and a structure of a host name, and converts the short character string generated into a single sentence into a sentence vector. A vectorization model for generating a short string vector for each structure from
The vectorization unit vectorizes a character string of an arbitrary URL by the structure using the URL vectorization model,
The determination unit includes:
A vector generated for each structure from the character strings of a plurality of URLs that are determined in advance as harmful or not by the vectorization unit, and a vector generated for each structure from the character string of the URL to be determined by the vectorization unit. The determination apparatus according to claim 1, wherein the determination unit determines whether the site indicated by the URL to be determined is harmful using a vector and the vector.   The determination device according to claim 4, wherein the determination unit selects the structure of the URL according to a type of a harmful site. The URL vectorization model further comprises:
A vectorization model for generating a connected vector by connecting vectors generated for each structure from a URL character string,
The vectorization unit further includes:
Using the URL vectorization model to generate a connected vector obtained by connecting the vectors generated for each structure from a character string of an arbitrary URL,
The determination unit further includes:
The connected vector generated from the character strings of the plurality of URLs that have been previously determined to be harmful or not by the vectorizing unit, and the connected vector generated from the character string of the URL to be determined by the vectorizing unit, The determination device according to claim 4, wherein the determination unit determines whether the site indicated by the URL to be determined is harmful. A determination method implemented by a computer,
A vectorization step of vectorizing an arbitrary character string using a URL vectorization model for vectorizing the character string included in the URL as one sentence,
In the vectorization step, the determination is performed by using a vector obtained by vectorizing a plurality of URL character strings that have been determined to be harmful or not and a vector obtained by vectorizing the URL character string to be determined. A determining step of determining whether the site indicated by the target URL is harmful;
A determination method comprising:

Images