CN110019946A - A kind of method and its system identifying harmful video - Google Patents
A kind of method and its system identifying harmful video Download PDFInfo
- Publication number
- CN110019946A CN110019946A CN201711499942.9A CN201711499942A CN110019946A CN 110019946 A CN110019946 A CN 110019946A CN 201711499942 A CN201711499942 A CN 201711499942A CN 110019946 A CN110019946 A CN 110019946A
- Authority
- CN
- China
- Prior art keywords
- video
- weight factor
- image file
- domain name
- address
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/70—Information retrieval; Database structures therefor; File system structures therefor of video data
- G06F16/73—Querying
- G06F16/735—Filtering based on additional data, e.g. user or group profiles
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/70—Information retrieval; Database structures therefor; File system structures therefor of video data
- G06F16/78—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
- H04L63/306—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information intercepting packet switched data communications, e.g. Web, Internet or IMS communications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/24—Systems for the transmission of television signals using pulse code modulation
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Signal Processing (AREA)
- Data Mining & Analysis (AREA)
- Multimedia (AREA)
- Computer Networks & Wireless Communication (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Computation (AREA)
- Technology Law (AREA)
- Computational Linguistics (AREA)
- Evolutionary Biology (AREA)
- Library & Information Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
A kind of method and its system identifying harmful video, method include: to obtain the path URL of video, and then obtain domain name, IP address according to the path URL, and export the first weight factor, the second weight factor based on the relevant inquiring of the IP address and domain name；And, further obtain the image file of multiple frame pictures in video, and extract DC coefficient in the compression domain of image file, so as to image file carry out part decompression after identify described image file, and according to identification image file result export third weight factor；Comprehensive first weight factor and the second weight factor and third weight factor, identify to whether the video belongs to harmful video.The disclosure can provide a kind of scheme for identifying harmful video using various modes in conjunction with the database that big data is made, use image processing means few as far as possible.
Description
Technical field
The disclosure belongs to information security field, such as is related to a kind of method and its system for identifying harmful video.
Background technique
In information-intensive society, it is full of information flow, including but not limited to text, video, audio, picture etc. everywhere.Wherein, video
File frequently includes auditory information and visual information, and ability to express is more comprehensive.However, with universal, the net of mobile Internet
A large amount of harmful video contents are full of on network, the features such as due to vision intuitive, impact, harmfulness is more more than harmful text
Originally, harmful picture and harmful audio etc., therefore these harmful videos are identified, and then be filtered, delete, eliminating danger
Evil, is very necessary.
Identification for network nocuousness video, present technology mainly have and can be divided into two major classes, one is conventional method,
It wherein again include two classes: (1) recognition methods based on single mode feature.Such methods are mainly to extract the visual signature of video,
According to these features come structural classification device.Such as in violence video identification, common feature have video motion vector, color,
Texture and shape etc..(2) recognition methods based on multi-modal Fusion Features, such methods are mainly to extract multiple moulds of video
The feature of state is merged with structural classification device.Such as in violence video identification, other than video features, many methods are also
Extract audio frequency characteristics, including short-time energy, burst of sound etc..Some methods also contemplate the text around network video, from this
Continue to extract some features in a little texts for fusion recognition.Another kind is the method for deep learning: (1) CNN utilizes convolution mind
Identifying processing is carried out to the harmful image of sensitivity in data bank through network, the internal feature of harmful objectionable video is obtained, utilizes
Whether there is harmful information in the video frame that the harmful video frame practised judges.(2) RNN Recognition with Recurrent Neural Network directly will
Harmful video information, frame of the study to harmful video, benefit are identified in video sequence input Recognition with Recurrent Neural Network in data bank
Judge identify whether new video is harmful video with the harmful video frame learnt.(3) CNN+RNN is learnt using CNN
Spatial-domain information in video in picture frame is finally combined the two using the time domain information in RNN identification video sequence
Identification judgement is carried out, video is identified using the frame learnt.
Existing image processing means mainly have following two method: conventional method and deep learning method.It is wherein traditional
Classical method word packet model, the model are made of four parts in method: (1) feature extraction phases (2) feature of bottom is compiled
Code (3) feature convergence (4) is classified using suitable classifier.Deep learning model is the model of another image procossing,
Mainly there is self-encoding encoder, is limited Boltzmann machine, deepness belief network, convolutional neural networks, Recognition with Recurrent Neural Network etc..With meter
Calculation machine hardware is constantly progressive, database it is perfect, using traditional method calculating process compared to for deep learning more
Simply, deep learning method can learn to more meaningful data, and constantly carry out parameter adjustment according to task, so for
In terms of image procossing, deep learning model has more powerful feature representation ability.
Existing recognition methods is all insufficient on recognition efficiency, in the situation of big data and Artificial Intelligence Development
Under, how harmful video is efficiently identified, with regard to becoming a problem in need of consideration.
Summary of the invention
Present disclose provides a kind of methods for identifying harmful video, comprising:
Step a) obtains the path URL of video, and then obtains domain name, the address IP according to the path URL, and based on described
IP address, inquiry whether there is the address IP or same network segment IP address, and looking into according to IP address in first database
It askes result and exports the first weight factor relevant to IP；
Step b) is based on domain name, whois inquiry is carried out in the second database, and defeated according to whois query result
The second weight factor relevant to domain name out；
Step c) obtains the image file of multiple frame pictures in video, and extracts directly in the compression domain of image file
Flow coefficient, so as to image file carry out part decompression after identify described image file, and according to identification image file result
Export third weight factor；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the video whether
Belong to harmful video to be identified.
In addition, the disclosure further discloses a kind of system for identifying harmful video, comprising:
First weight factor generation module, is used for: obtain the path URL of video, and then according to the path URL obtain domain name,
IP address, and it is based on the IP address, it is inquired with the presence or absence of the IP address or same network segment IP in first database
Location, and the first weight factor relevant to IP is exported according to the query result of IP address；
Second weight factor generation module, is used for: it is based on domain name, whois inquiry is carried out in the second database, and
The second weight factor relevant to domain name is exported according to whois query result；
Third weight factor generation module, is used for: obtaining the image file of multiple frame pictures in video, and in image text
Extract DC coefficient in the compression domain of part, so as to image file carry out part decompression after identify described image file, and according to
Identify that the result of image file exports third weight factor；
Identification module, for integrating the first weight factor and the second weight factor and third weight factor, to the view
Whether frequency, which belongs to harmful video, is identified.
By the method and its system, the disclosure can be in conjunction with the database that big data is made, use figure few as far as possible
As processing means, a kind of more efficient scheme for identifying harmful video is provided.
Detailed description of the invention
Fig. 1 is the schematic diagram of one embodiment the method in the disclosure；
Fig. 2 is the schematic diagram of system described in one embodiment in the disclosure.
Specific embodiment
In order to make those skilled in the art understand that technical solution disclosed by the disclosure, below in conjunction with embodiment and related
The technical solution of each embodiment is described in attached drawing, and described embodiment is a part of this disclosure embodiment, without
It is whole embodiments.Term " first " used by the disclosure, " second " etc. rather than are used for for distinguishing different objects
Particular order is described.In addition, " comprising " and " having " and their any deformation, it is intended that covering and non-exclusive packet
Contain.Such as contain the process of a series of steps or units or method or system or product or equipment are not limited to arrange
Out the step of or unit, but optionally further include the steps that not listing or unit, or further includes optionally for these mistakes
Other intrinsic step or units of journey, method, system, product or equipment.
Referenced herein " embodiment " is it is meant that a particular feature, structure, or characteristic described can wrap in conjunction with the embodiments
It is contained at least one embodiment of the disclosure.Each position in the description occur the phrase might not each mean it is identical
Embodiment, nor the independent or alternative embodiment with other embodiments mutual exclusion.It will be appreciated by those skilled in the art that
, embodiment described herein can combine with other embodiments.
It is a kind of process signal of the method for identification nocuousness video that one embodiment provides in the disclosure referring to Fig. 1, Fig. 1
Figure.As shown in the figure, which comprises
Step S100 obtains the path URL of video, and then obtains domain name, IP address according to the path URL, and be based on institute
IP address is stated, inquiry whether there is the IP address or same network segment IP address in first database, and according to IP address
Query result exports the first weight factor relevant to IP；
It is understood that first database maintenance is known, issued the IP address inventory of harmful video.
For example, in the case of IP address is 192.168.10.3:
If recording the IP address in first database, the first weight factor property of can be exemplified is 1.0；
If the IP address recorded in database only has 192.168.10.4,192.168.10.3 then to be cherished by moderate
Standby address suspected of the video affiliated web site or the address replaced recently, the first weight factor property of can be exemplified are 0.6；
If the IP address recorded in database has 192.168.10.4 and 192.168.10.5, or even describes
192.168.10.X all IP address of network segment, then 192.168.10.3 is then the video affiliated web site by strong suspicion
Standby address or the address replaced recently, the first weight factor property of can be exemplified are 0.9；
If including multiple 192.168.X.X network segments in the IP address recorded in database, without 192.168.10.X
Network segment, then 192.168.10.3 is then the address of harmful video affiliated web site by careful suspection, the first weight factor can be shown
Example property is 0.4.
Step S200 is based on domain name, whois inquiry is carried out in the second database, and according to whois query result
Export the second weight factor relevant to domain name；
It is understood that the second database maintenance is known, issued the domain name inventory of harmful video.
Whois inquiry is to investigate domain name registration people with nocuousness video and be associated with situation.Second database can be safeguarded
Following information: largely issued in domain name, internet the domain name registration people of harmful video information and corresponding harmful video
Mark.
For example, in the case of domain name is www.a.com:
If recording the mark and its whois information of the domain name addresses, corresponding harmful video in the second database, that
The second weight factor property of can be exemplified is 1.0；
If not recording the mark of any harmful video of above-mentioned domain name www.a.com in the second database, but energy
Enough inquire the domain name of other websites of the domain name registration people of the domain name and the domain name registration people registration of the domain name, and second
Database includes the mark that harmful video is largely issued in other described websites on the internet；Even when not having in the second database
The mark of any harmful video of above-mentioned domain name www.a.com on the books, the corresponding website of the www.a.com domain name are still high
Degree suspection is the source of harmful video, and the second weight factor property of can be exemplified is 0.9；
If not recording the mark of any harmful video of above-mentioned domain name www.a.com in the second database, but energy
The domain name for other websites that the domain name registration people of the domain name registration people and the domain name that enough inquire the domain name register, however the
Two databases do not include any mark about other website orientation nocuousness videos, and second weight factor can be shown
Example property is 0；
It is readily appreciated that, if not recording the mark of any harmful video of above-mentioned domain name www.a.com in the second database
Know, the domain name of other websites of the domain name registration people registration less than the domain name is also inquired, then second weight factor can also
With it is exemplary be 0.
Step S300, obtains the image file of multiple frame pictures in video, and extracts in the compression domain of image file
DC coefficient, so as to image file carry out part decompression after identify described image file, and according to identification image file knot
Fruit exports third weight factor；
Step S300 is image file to be obtained based on video, and export third by the recognition result of image file
Weight factor.If detecting conventional harmful video or other decadent contents etc., third weight factor can be embodied.Energy
It is enough to understand, when the number that conventional nocuousness video or other decadent contents occur meets corresponding threshold condition, third weight because
Son may be 1.0, it is also possible to 0.8 or 0.4, depending on specific threshold condition.
In addition, it is necessary to, it is emphasized that for computing resource and time cost needed for reducing the present embodiment, to image file
It is first to extract DC coefficient from the compression domain of image file when being identified, is to carry out part decompression to image file
It can be used for image recognition.Since inventor utilizes: image information is largely focused on DC coefficient and its neighbouring low frequency frequency
This characteristic is composed, so by DC coefficient part decompression can be carried out to image file, utilizes the image information of part decompression
Image recognition is carried out, without using all information in complete image file, to reduce workload.Typically, it accords with
The image file for closing JPEG coding standard can be handled in this way.
It is understood that disclosure institute can be used for the technological means of the harmful information identification of image file in this field
The image file in video file stated.The step S300 can both carry out the processing of image in conjunction with traditional method, can also
To use the processing for combining deep learning model to carry out image, and then harmful video is identified.
More particularly, in one case, to described in identification after image file progress part decompression in the step S300
Image file specifically includes:, will be in described image file and third party's image data base after carrying out part decompression to image file
Maintenance, known harmful image file carries out feature comparison, to identify described image file.It, will when being identified as nocuousness
Described image file is updated to third party's image data base.Wherein, by creeping in third party's image data base
Know the image file of harmful sites and pre-establishes.
Step S400, comprehensive first weight factor and the second weight factor and third weight factor are to the video
It is no to belong to harmful video and identified.
Illustratively, if the first weight factor is x, the second weight factor is y, and third weight factor is z, wherein 0≤x≤
1,0≤y≤1,0≤z≤1, can according to the following formula in summary weight factor calculate video harmful coefficient W:
W=a × x+b × y+c × z, wherein a+b+c=1, a, b, c then respectively indicate the weight of each weight factor.
For example, a=b=c=1/3；
It, specifically can be according to each weight factor and the actual conditions of identification harmful content more for example, a, b, c are unequal
And it adjusts.
It is understood that W is closer to 1, the probability that associated video belongs to harmful video is bigger.
The above formula for calculating W belongs to linear formula, however when practical application, it is also possible to use non-linear formula.
Further, either linear formula or non-linear formula, it is contemplated that being determined by training or be fitted
Correlation formula and its parameter.
To sum up, for above-described embodiment, only step S300 has carried out image procossing, and remaining step is then separately to ward off footpath
Diameter is utilized relevant inquiring, obtains relevant weight factor.Then comprehensive (alternatively referred to as merging) the multiple weight factors of step S400
Carry out the identification of harmful video.Those skilled in the art know, are handled for each frame image of video, identify right and wrong
Normal elapsed time cost, and inquire and then in contrast more save time cost.It is clear that above-described embodiment proposes one
The rich efficient method for identifying harmful video of kind.In addition, above-described embodiment obviously can be further combined with big data and/or people
Work is intelligently established, updates the first database, the second database and other databases.
In another embodiment, second database is third party database.
For example, in terms of the list of websites of harmful video of numerous websites and third party's maintenance of progress whois inquiry
Database.
In another embodiment, for being determined as harmful video after identification, for network address (such as the forum in its source
Or webpage), it collects the IP address information of the publisher for the harmful video recorded in the network address and updates first database.
This is because harmful video generally will form some sticky users, these users some can participate in propagating harmful video and
Most IP address can be relatively fixed, if address correlation itself describes the IP address letter of the publisher of harmful video
Breath, the disclosure then update aforementioned first database by collecting its IP address information.
In another embodiment, step S200 further include:
Further, the safety of domain name is inquired in third party's domain name safe list so as to the output safety factor,
And second weight factor relevant to domain name is modified by the factor of safety.
Such as virustotal.com this third party's domain name safe screen looks into website.It is understood that if third party's information
In think associated dns name include virus or wooden horse, then should improve the second weight factor, it is uneasy to have its source in related web site
Entirely.
It is understood that the embodiment is laid particular emphasis on from the second weight factor of network security angle modification, prevent user from meeting with
By unknown losses.This is because privacy and proprietary of the network security concerning user, if the related web site of harmful video exists
Network Security Vulnerabilities, then also bringing the harm of privacy leakage or property loss to user other than the harm of harmful video.
In another embodiment, the image file for obtaining multiple frame pictures in video in step S300, is to pass through
What random fashion obtained.
For the embodiment, it means that randomly selecting the picture in video, such as before video when 1/3 broadcasting
Between section choose the image file of a frame or multiframe picture, from intermediate 1/3 play time section and 1/3 play time section of end
The image file of a frame or multiframe picture is chosen respectively.Under normal conditions, identification video is all based on key-frame extraction to do,
The relatively random mode time-consuming of key-frame extraction is some, therefore the embodiment chooses a frame or multiframe by random fashion, especially
It is multiframe picture, the time can be saved significantly on.Random fashion obtains the image file of multiframe picture, not only saves significantly on the time,
And it ensure that the result of processing is relatively credible to a certain degree.
In another embodiment, in step S300 obtain video in multiple frame pictures image file, further include
It is as follows:
Step c1): extract the audio in video；
Step c2): it whether include harmful content in identification audio, if so, then obtaining institute according to the beginning and ending time of audio
State the image file of multiple frame pictures in the beginning and ending time.
For the embodiment, if recognizing in audio includes harmful content, its time is positioned, from audio
Only the time is foundation, obtains the image file of multiple frame pictures in the beginning and ending time.Correlation can be more targetedly found in this way
Harmful picture.
As it was noted above, if in conjunction with big data technology, the disclosure being capable of the multiple dimensions of fruitful combination, Duo Zhongmo
Formula quickly identifies harmful video in conjunction with IP information, domain-name information, image information, audio-frequency information.
Further, above-described embodiment can be implemented in router side or network provider side, filter in advance
Associated video.
Corresponding with method, referring to fig. 2, the disclosure discloses in another embodiment a kind of identifies harmful video
System, comprising:
First weight factor generation module, is used for: obtain the path URL of video, and then according to the path URL obtain domain name,
IP address, and it is based on the IP address, it is inquired with the presence or absence of the IP address or same network segment IP in first database
Location, and the first weight factor relevant to IP is exported according to the query result of IP address；
Second weight factor generation module, is used for: it is based on domain name, whois inquiry is carried out in the second database, and
The second weight factor relevant to domain name is exported according to whois query result；
Third weight factor generation module, is used for: obtaining the image file of multiple frame pictures in video, and in image text
Extract DC coefficient in the compression domain of part, so as to image file carry out part decompression after identify described image file, and according to
Identify that the result of image file exports third weight factor；
Identification module, for integrating the first weight factor and the second weight factor and third weight factor, to the view
Whether frequency, which belongs to harmful video, is identified.
It is similar with the embodiment of each method above,
Preferably, second database is third party database.
It is furthermore preferred that the second weight factor generation module further include:
Amending unit is used for: it is further, inquired in third party's domain name safe list the safety of domain name so as to
The output safety factor, and second weight factor relevant to domain name is modified by the factor of safety.
It is furthermore preferred that the image of multiple frame pictures in acquisition video described in the third weight factor generation module
File is obtained by random fashion.
It is furthermore preferred that also being realized by such as lower unit in the third weight factor generation module multiple in acquisition video
The image file of frame picture:
Audio extraction unit, for extracting the audio in video；
Audio identification unit, for identification in audio whether include harmful content, if so, then according to the start-stop of audio when
Between obtain the image files of multiple frame pictures in the beginning and ending time.
The disclosure discloses a kind of system for identifying harmful video in another embodiment, comprising:
Processor and memory, are stored with executable instruction in the memory, the processor execute these instructions with
Execute following operation:
Step a) obtains the path URL of video, and then obtains domain name, the address IP according to the path URL, and based on described
IP address, inquiry whether there is the address IP or same network segment IP address, and looking into according to IP address in first database
It askes result and exports the first weight factor relevant to IP；
Step b) is based on domain name, whois inquiry is carried out in the second database, and defeated according to whois query result
The second weight factor relevant to domain name out；
Step c) obtains the image file of multiple frame pictures in video, and extracts directly in the compression domain of image file
Flow coefficient, so as to image file carry out part decompression after identify described image file, and according to identification image file result
Export third weight factor；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the video whether
Belong to harmful video to be identified.
The disclosure further discloses a kind of computer storage medium in another embodiment, is stored with executable instruction, institute
Instruction is stated for executing the following method for identifying harmful video:
Step a) obtains the path URL of video, and then obtains domain name, the address IP according to the path URL, and based on described
IP address, inquiry whether there is the address IP or same network segment IP address, and looking into according to IP address in first database
It askes result and exports the first weight factor relevant to IP；
Step b) is based on domain name, whois inquiry is carried out in the second database, and defeated according to whois query result
The second weight factor relevant to domain name out；
Step c) obtains the image file of multiple frame pictures in video, and extracts directly in the compression domain of image file
Flow coefficient, so as to image file carry out part decompression after identify described image file, and according to identification image file result
Export third weight factor；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the video whether
Belong to harmful video to be identified.
It may include: at least one processor (such as CPU) for above system, at least one sensor (such as plus
Speedometer, gyroscope, GPS module or other locating modules), at least one processor, at least one communication bus, wherein logical
Believe bus for realizing the connection communication between various components.The equipment can also include at least one receiver, at least one
A transmitter, wherein receiver and transmitter can be wired sending port, be also possible to wireless device (for example including antenna
Device), for carrying out the transmission of signaling or data with other node devices.The memory can be high speed RAM memory,
It can be non-labile memory (Non-volatile memory), for example, at least a magnetic disk storage.Memory is optional
Can be at least one storage device for being located remotely from aforementioned processor.Batch processing code is stored in memory, and described
Processor can call the code stored in memory to execute relevant function by communication bus.
Embodiment of the disclosure also provides a kind of computer storage medium, wherein the computer storage medium can store journey
Sequence, the program include the part or complete for any method for identifying harmful video recorded in above method embodiment when executing
Portion's step.
Step in embodiment of the disclosure method can be sequentially adjusted, merged and deleted according to actual needs.
Module and unit in embodiment of the disclosure system can be combined, divided and deleted according to actual needs.
It should be noted that for the various method embodiments described above, for simple description, therefore, it is stated as a series of action groups
It closes, but those skilled in the art should understand that, the present invention is not limited by the sequence of acts described, because according to this hair
Bright, some steps may be performed in other sequences or simultaneously.Secondly, those skilled in the art should also know that, specification
Described in embodiment belong to preferred embodiment, related movement, module, unit not necessarily present invention institute are necessary
's.
In the above-described embodiments, it all emphasizes particularly on different fields to the description of each embodiment, there is no the portion being described in detail in some embodiment
Point, reference can be made to the related descriptions of other embodiments.
In several embodiments provided by the disclosure, it should be understood that disclosed system, it can be by another way
It realizes.For example, embodiments described above is only illustrative, such as the division of the unit, only a kind of logic function
It can divide, there may be another division manner in actual implementation, such as multiple units or components can be combined or be can integrate
To another system, or some features can be ignored or not executed.Another point, each unit or the mutual coupling of component or
Direct-coupling or communication connection can be through some interfaces, and the indirect coupling or communication connection of device or unit can be electricity
Property or other form.
The unit as illustrated by the separation member may or may not be physically separated, and can both be located at
One place, or may be distributed over multiple network units.Can select according to the actual needs part therein or
Whole units achieve the purpose of the solution of this embodiment.
It, can also be in addition, each functional unit in each embodiment of the disclosure can integrate in one processing unit
It is each unit individualism, can also be integrated in one unit with two or more units.Above-mentioned integrated unit was both
It can take the form of hardware realization, can also realize in the form of software functional units.
If the integrated unit is realized in the form of SFU software functional unit and sells or use as independent product
When, it can store in a computer readable storage medium.Based on this understanding, the technical solution of the disclosure is substantially
The all or part of the part that contributes to existing technology or the technical solution can be in the form of software products in other words
It embodies, which is stored in a storage medium, including some instructions are used so that a computer
Equipment (can be smart phone, personal digital assistant, wearable device, laptop, tablet computer) executes each of the disclosure
The all or part of the steps of a embodiment the method.And storage medium above-mentioned include: USB flash disk, read-only memory (ROM,
Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or
The various media that can store program code such as CD.
The above, above embodiments are only to illustrate the technical solution of the disclosure, rather than its limitations；Although referring to before
Embodiment is stated the disclosure is described in detail, it should be understood by those skilled in the art that: it still can be to aforementioned each reality
Technical solution documented by example is applied to modify or equivalent replacement of some of the technical features；And these modification or
Person's replacement, the range for the presently disclosed embodiments technical solution that it does not separate the essence of the corresponding technical solution.
Claims (10)
1. a kind of method for identifying harmful video, comprising:
Step a) obtains the path URL of video, and then obtains domain name, IP address according to the path URL, and based on the IP
Location, inquiry whether there is the IP address or same network segment IP address in first database, and according to the inquiry knot of IP address
Fruit exports the first weight factor relevant to IP；
Step b), be based on domain name, in the second database carry out whois inquiry, and according to whois query result output with
Relevant second weight factor of domain name；
Step c) obtains the image file of multiple frame pictures in video, and direct current system is extracted in the compression domain of image file
Number, so as to image file carry out part decompression after identify described image file, and according to identification image file result export
Third weight factor；
Whether step d), comprehensive first weight factor and the second weight factor and third weight factor, belong to the video
Harmful video is identified.
2. according to the method described in claim 1, wherein, it is preferred that second database is third party database.
3. according to the method described in claim 1, wherein, step b) further include:
Further, the safety of domain name is inquired in third party's domain name safe list so as to the output safety factor, and led to
The factor of safety is crossed to be modified second weight factor relevant to domain name.
4. according to the method described in claim 1, wherein, the image for obtaining multiple frame pictures in video in step c) is literary
Part is obtained by random fashion.
5. according to the method described in claim 1, wherein, the image for obtaining multiple frame pictures in video in step c) is literary
Part further includes as follows:
Step c1): extract the audio in video；
Step c2): it whether include harmful content in identification audio, if so, then obtaining described rise according to the beginning and ending time of audio
The only image file of multiple frame pictures in the time.
6. a kind of system for identifying harmful video, comprising:
First weight factor generation module, is used for: obtaining the path URL of video, and then with obtaining domain name, IP according to the path URL
Location, and it is based on the IP address, inquiry whether there is the IP address or same network segment IP address in first database, and
The first weight factor relevant to IP is exported according to the query result of IP address；
Second weight factor generation module, is used for: it is based on domain name, the progress whois inquiry in the second database, and according to
Whois query result exports the second weight factor relevant to domain name；
Third weight factor generation module, is used for: obtaining the image file of multiple frame pictures in video, and in image file
DC coefficient is extracted in compression domain, to identify described image file after carrying out part decompression to image file, and according to identification
The result of image file exports third weight factor；
Identification module is to the video for integrating the first weight factor and the second weight factor and third weight factor
It is no to belong to harmful video and identified.
7. system according to claim 6, wherein preferred, second database is third party database.
8. system according to claim 6, wherein the second weight factor generation module further include:
Amending unit is used for: it is further, the safety of domain name is inquired in third party's domain name safe list to export
Factor of safety, and second weight factor relevant to domain name is modified by the factor of safety.
9. system according to claim 6, wherein in acquisition video described in the third weight factor generation module
Multiple frame pictures image file, be to be obtained by random fashion.
10. system according to claim 6, wherein also by such as lower unit in the third weight factor generation module
Realize the image file for obtaining multiple frame pictures in video:
Audio extraction unit, for extracting the audio in video；
Whether audio identification unit includes for identification harmful content in audio, if so, then being obtained according to the beginning and ending time of audio
Take the image file of multiple frame pictures in the beginning and ending time.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711499942.9A CN110019946A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful video |
| PCT/CN2018/072224 WO2019127651A1 (en) | 2017-12-30 | 2018-01-11 | Method and system thereof for identifying malicious video |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711499942.9A CN110019946A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful video |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110019946A true CN110019946A (en) | 2019-07-16 |
Family
ID=67062929
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711499942.9A Pending CN110019946A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful video |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN110019946A (en) |
| WO (1) | WO2019127651A1 (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112989950A (en) * | 2021-02-11 | 2021-06-18 | 温州大学 | Violent video recognition system oriented to multi-mode feature semantic correlation features |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104615760A (en) * | 2015-02-13 | 2015-05-13 | 北京瑞星信息技术有限公司 | Phishing website recognizing method and phishing website recognizing system |
| CN106055574A (en) * | 2016-05-19 | 2016-10-26 | 微梦创科网络科技（中国）有限公司 | Method and device for recognizing illegal URL |
| CN106101740A (en) * | 2016-07-13 | 2016-11-09 | 百度在线网络技术（北京）有限公司 | A kind of video content recognition method and apparatus |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6751348B2 (en) * | 2001-03-29 | 2004-06-15 | Fotonation Holdings, Llc | Automated detection of pornographic images |
| CN100362805C (en) * | 2005-11-18 | 2008-01-16 | 郑州金惠计算机系统工程有限公司 | Multifunctional management system for detecting erotic images and unhealthy information in network |
| CN100490532C (en) * | 2006-04-30 | 2009-05-20 | 华为技术有限公司 | Video code stream filtering method and filtering node |
| CN101751782A (en) * | 2009-12-30 | 2010-06-23 | 北京大学深圳研究生院 | Crossroad traffic event automatic detection system based on multi-source information fusion |
| CN102208992B (en) * | 2010-06-13 | 2015-09-02 | 天津海量信息技术有限公司 | The malicious information filtering system of Internet and method thereof |
-
2017
- 2017-12-30 CN CN201711499942.9A patent/CN110019946A/en active Pending
-
2018
- 2018-01-11 WO PCT/CN2018/072224 patent/WO2019127651A1/en active Application Filing
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104615760A (en) * | 2015-02-13 | 2015-05-13 | 北京瑞星信息技术有限公司 | Phishing website recognizing method and phishing website recognizing system |
| CN106055574A (en) * | 2016-05-19 | 2016-10-26 | 微梦创科网络科技（中国）有限公司 | Method and device for recognizing illegal URL |
| CN106101740A (en) * | 2016-07-13 | 2016-11-09 | 百度在线网络技术（北京）有限公司 | A kind of video content recognition method and apparatus |
Non-Patent Citations (1)
| Title |
|---|
| 杨辉 等: "压缩域DCT系数对图像视频检索影响的研究", 《南京邮电学院学报》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2019127651A1 (en) | 2019-07-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111461089B (en) | Face detection method, and training method and device of face detection model | |
| CN105095721A (en) | Fingerprint authentication display device and method | |
| CN107341399A (en) | Assess the method and device of code file security | |
| CN110929203B (en) | Abnormal user identification method, device, equipment and storage medium | |
| Liu et al. | An efficient multistage phishing website detection model based on the CASE feature framework: Aiming at the real web environment | |
| Chen et al. | Ai@ ntiphish—machine learning mechanisms for cyber-phishing attack | |
| CN111654504B (en) | DGA domain name detection method and device | |
| CN113221032A (en) | Link risk detection method, device and storage medium | |
| CN115757991A (en) | Webpage identification method and device, electronic equipment and storage medium | |
| CN110020161B (en) | Data processing method, log processing method and terminal | |
| CN110019892A (en) | A kind of method and its system identifying harmful picture based on User ID | |
| CN110020256A (en) | The method and system of the harmful video of identification based on User ID and trailer content | |
| CN110019946A (en) | A kind of method and its system identifying harmful video | |
| CN109993036A (en) | A kind of method and its system identifying harmful video based on User ID | |
| CN110020252A (en) | The method and its system of the harmful video of identification based on trailer content | |
| CN110020254A (en) | The method and system of the harmful video of identification based on User IP and video copy | |
| CN205427857U (en) | Identity identification system based on many biological characteristics combine equipment fingerprint | |
| CN109271706A (en) | Hair style generation method and device | |
| CN110020255A (en) | A kind of method and its system identifying harmful video based on User IP | |
| CN110109952A (en) | A kind of method and its system identifying harmful picture | |
| CN110020253A (en) | The method and its system of the harmful video of the identification of video copy based on content | |
| CN106937176A (en) | Method for processing video frequency, device and video interactive method and device | |
| CN110020257A (en) | The method and system of the harmful video of identification based on User ID and video copy | |
| CN110020259A (en) | A kind of method and its system identifying harmful picture based on User IP | |
| KR102510777B1 (en) | System and method for detecting counterfeit and falsification based on Artificial Intelligence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |