CN110020259A - A kind of method and its system identifying harmful picture based on User IP - Google Patents
A kind of method and its system identifying harmful picture based on User IP Download PDFInfo
- Publication number
- CN110020259A CN110020259A CN201711500075.6A CN201711500075A CN110020259A CN 110020259 A CN110020259 A CN 110020259A CN 201711500075 A CN201711500075 A CN 201711500075A CN 110020259 A CN110020259 A CN 110020259A
- Authority
- CN
- China
- Prior art keywords
- picture
- address
- weight factor
- url
- harmful
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
- 238000000034 method Methods 0.000 title claims abstract description 31
- 230000006837 decompression Effects 0.000 claims abstract description 17
- 230000006835 compression Effects 0.000 claims abstract description 9
- 238000007906 compression Methods 0.000 claims abstract description 9
- 239000000284 extract Substances 0.000 claims abstract description 9
- 238000012545 processing Methods 0.000 abstract description 6
- 238000004891 communication Methods 0.000 description 5
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000013473 artificial intelligence Methods 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000013135 deep learning Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000013527 convolutional neural network Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000005611 electricity Effects 0.000 description 1
- 230000007717 exclusion Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 230000001902 propagating effect Effects 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 230000011664 signaling Effects 0.000 description 1
- 238000001228 spectrum Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/50—Information retrieval; Database structures therefor; File system structures therefor of still image data
- G06F16/51—Indexing; Data structures therefor; Storage structures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/50—Information retrieval; Database structures therefor; File system structures therefor of still image data
- G06F16/53—Querying
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/50—Information retrieval; Database structures therefor; File system structures therefor of still image data
- G06F16/58—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T7/00—Image analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/45—Network directories; Name-to-address mapping
- H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
- H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Library & Information Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
A kind of method and system identifying harmful picture, method includes: when the page elements for judging webpage include the path URL of picture, identify the IP address or IP address section of the user recorded in the Webpage content, the IP address that the path URL according to picture obtains the domain name for including in the URL or the URL is directed toward, and the first weight factor, the second weight factor are exported based on the relevant inquiring of the IP address and domain name；And the picture is further obtained, and extract DC coefficient in the compression domain of picture, to identify the picture after carrying out part decompression to picture, and third weight factor is exported according to the result of identification picture；Comprehensive first weight factor and the second weight factor and third weight factor, identify to whether the picture belongs to harmful picture.The disclosure can provide a kind of scheme for identifying harmful picture using various modes in conjunction with the database that big data is made, use image processing means few as far as possible.
Description
Technical field
The disclosure belongs to information security field, such as is related to a kind of method and its system for identifying harmful picture.
Background technique
In information-intensive society, it is full of information flow, including but not limited to text, video, audio, picture etc. everywhere.Wherein, with view
Frequency is compared, and it is again relatively low to memory space and bandwidth requirement that picture file had not only included certain visual information, with it is mobile mutually
Networking it is universal, a large amount of harmful image contents are full of on network, the features such as due to vision intuitive, impact, harmfulness is more
Add more than harmful text and harmful audio etc., therefore these harmful pictures is identified, and then be filtered, delete, eliminate
Harm, is very necessary.
Identification for network nocuousness picture, present technology mainly have and can be divided into two major classes, one is conventional method,
Mainly pass through various classifiers.Another kind is the application of the method for deep learning, especially convolutional neural networks.However above two
Class method is all insufficient on recognition efficiency.
In the case of big data and Artificial Intelligence Development, how harmful picture is efficiently identified, just become a needs
Consider the problems of.
Summary of the invention
Present disclose provides a kind of methods for identifying harmful picture, comprising:
Step a), when the page elements for judging webpage include the path URL of picture, in the page that identifies the webpage
The IP address or IP address section of the user recorded in appearance, inquiry whether there is the IP address or same net in first database
Section IP address, and the first weight factor relevant to IP is exported according to the query result of IP address；
Step b), the IP address that the path URL according to picture obtains the domain name for including in the URL or the URL is directed toward,
Based on the domain name for including in the URL, whois inquiry, and/or the IP being directed toward based on the URL are carried out in the second database
Address is inquired in the second database with the presence or absence of the IP address or same network segment IP address for including in the URL, and according to
The query result of whois query result and/or IP address exports the second weight factor relevant to the path URL of picture；
Step c) obtains the picture according to the path URL of the picture, and extracts direct current system in the compression domain of picture
Number to identify the picture after carrying out part decompression to picture, and exports third weight factor according to the result of identification picture；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the picture whether
Belong to harmful picture to be identified.
In addition, the disclosure further discloses a kind of system for identifying harmful picture, comprising:
First weight factor generation module, is used for: when the page elements for judging webpage include the path URL for obtaining picture
When, identify the address IP or the IP address section of the user recorded in the content of pages of the webpage, inquiring in first database is
It is no there are the IP address or same network segment IP address, and according to the query result of IP address output relevant to IP first
Weight factor；
Second weight factor generation module, is used for: according to picture the path URL obtain the domain name for including in the URL or
The IP address that the URL is directed toward carries out whois inquiry based on the domain name for including in the URL in the second database, and/or
Based on the IP address that the URL is directed toward, inquiry is with the presence or absence of the IP address or same for including in the URL in the second database
Network segment IP address, and according to whois query result and/or the query result of IP address, it exports relevant to the path URL of picture
Second weight factor；
Third weight factor generation module, is used for: obtaining the picture according to the path URL of the picture, and in picture
Compression domain in extract DC coefficient, to identify the picture after carrying out part decompression to picture, and according to identification picture
As a result third weight factor is exported；
Identification module, for integrating the first weight factor and the second weight factor and third weight factor, to the figure
Whether piece, which belongs to harmful picture, is identified.
By the method and its system, the disclosure can be in conjunction with the database that big data is made, use figure few as far as possible
As processing means, a kind of more efficient scheme for identifying harmful picture is provided.
Detailed description of the invention
Fig. 1 is the schematic diagram of one embodiment the method in the disclosure；
Fig. 2 is the schematic diagram of system described in one embodiment in the disclosure.
Specific embodiment
In order to make those skilled in the art understand that technical solution disclosed by the disclosure, below in conjunction with embodiment and related
The technical solution of each embodiment is described in attached drawing, and described embodiment is a part of this disclosure embodiment, without
It is whole embodiments.Term " first " used by the disclosure, " second " etc. rather than are used for for distinguishing different objects
Particular order is described.In addition, " comprising " and " having " and their any deformation, it is intended that covering and non-exclusive packet
Contain.Such as contain the process of a series of steps or units or method or system or product or equipment are not limited to arrange
Out the step of or unit, but optionally further include the steps that not listing or unit, or further includes optionally for these mistakes
Other intrinsic step or units of journey, method, system, product or equipment.
Referenced herein " embodiment " is it is meant that a particular feature, structure, or characteristic described can wrap in conjunction with the embodiments
It is contained at least one embodiment of the disclosure.Each position in the description occur the phrase might not each mean it is identical
Embodiment, nor the independent or alternative embodiment with other embodiments mutual exclusion.It will be appreciated by those skilled in the art that
, embodiment described herein can combine with other embodiments.
It is a kind of process signal of the method for identification nocuousness picture that one embodiment provides in the disclosure referring to Fig. 1, Fig. 1
Figure.As shown in the figure, which comprises
Step S100 identifies the page of the webpage when the page elements for judging webpage include the path URL of picture
The IP address or IP address section of the user recorded in content, inquiry whether there is the IP address or same in first database
Network segment IP address, and the first weight factor relevant to IP is exported according to the query result of IP address；
It is understood that with once issuing the IP of the user of harmful picture known to first database maintenance, in webpage
Location or IP address section inventory.
For example, in the case of the IP address for identifying the user recorded in Webpage content is 192.168.10.3:
If recording the IP address in first database, the first weight factor property of can be exemplified is 1.0；
If the IP address recorded in database only has 192.168.10.4,192.168.10.3 then to be cherished by moderate
Standby address suspected of the user for once issuing harmful picture or the address replaced recently, the first weight factor property of can be exemplified
It is 0.6；
If the IP address recorded in database has 192.168.10.4 and 192.168.10.5, or even describes
192.168.10.X all IP address of network segment, then 192.168.10.3 is then once to issue harmful picture by strong suspicion
The standby address of user or the address replaced recently, the first weight factor property of can be exemplified are 0.9；
If including multiple 192.168.X.X network segments in the IP address recorded in database, without 192.168.10.X
Network segment, then 192.168.10.3 is then by the careful address for suspecting the user for the harmful picture of once publication, the first weight factor
The property of can be exemplified is 0.4.
Step S200, the path URL according to picture is with obtaining the IP of the domain name for including in the URL or URL direction
Location carries out whois inquiry based on the domain name for including in the URL in the second database, and/or be directed toward based on the URL
IP address is inquired in the second database with the presence or absence of the IP address or same network segment IP address for including in the URL, and according to
The query result of whois query result and/or IP address exports the second weight factor relevant to the path URL of picture；
It is understood that the second database maintenance is known, issued harmful picture domain name inventory and/or known publication
The IP address of the website of harmful picture, IP address section inventory.
Whois inquiry is to investigate domain name registration people with nocuousness picture and be associated with situation.Second database can be safeguarded
Following information: the information and corresponding nocuousness that the domain name registration people of harmful picture is largely issued in domain name, internet are schemed
The mark of piece.
For example, in the case of domain name is www.a.com:
If recording the mark and its whois information of the domain name addresses, corresponding harmful picture in the second database, that
The second weight factor property of can be exemplified is 1.0；
If not recording the mark of any harmful picture of above-mentioned domain name www.a.com in the second database, but energy
Enough inquire the domain name of other websites of the domain name registration people of the domain name and the domain name registration people registration of the domain name, and second
Database includes the mark that harmful picture is largely issued in other described websites on the internet, even when not having in the second database
The mark of any harmful picture of above-mentioned domain name www.a.com on the books, the corresponding website of the www.a.com domain name are still high
Degree suspection is the source of harmful picture, and the second weight factor property of can be exemplified is 0.9；
If not recording the mark of any harmful picture of above-mentioned domain name www.a.com in the second database, but energy
The domain name for other websites that the domain name registration people of the domain name registration people and the domain name that enough inquire the domain name register, however the
Two databases do not include any mark about other website orientation nocuousness pictures, and second weight factor can be shown
Example property is 0；
It is readily appreciated that, if not recording the mark of any harmful picture of above-mentioned domain name www.a.com in the second database
Know, the domain name of other websites of the domain name registration people registration less than the domain name is also inquired, then second weight factor can also
With it is exemplary be 0.
Illustratively, the address IP that the URL is directed toward can also be obtained according to the path URL of picture, carry out IP address/
IP address section inquiry, to export the second weight factor,
For example, in the case of web IP address is 192.168.20.3:
If recording the IP address in the second database, the second weight factor property of can be exemplified is 1.0；
If the IP address recorded in the second database only has 192.168.20.4,192.168.20.3 is then by
Degree suspects the address for being the standby address of the picture affiliated web site or replacing recently, and the second weight factor property of can be exemplified is
0.6；
If the IP address recorded in the second database has 192.168.20.4 and 192.168.20.5, or even describes
192.168.20.X all IP address of network segment, then 192.168.20.3 is then the picture affiliated web site by strong suspicion
Standby address or the address replaced recently, the second weight factor property of can be exemplified are 0.9；
If including multiple 192.168.X.X network segments in the IP address recorded in database, without 192.168.20.X
Network segment, then 192.168.20.3 is then the address of harmful picture affiliated web site by careful suspection, the second weight factor can be shown
Example property is 0.4.
Particularly, there is also the situations for comprehensively considering IP inventory and domain name inventory for above-mentioned steps, that is, pass through the IP of picture URL
Inquiry and domain name whois inquire the situation to determine the second weight factor jointly.
Assuming that the IP inquiry factor of picture URL is i, it is j that domain name whois, which inquires the factor, and the second weight factor is y, wherein 0
≤ i≤1,0≤j≤1,0≤y≤1 can determine according to the following formula the second weight factor:
Y=m × i+n × j, wherein m+n=1, m, n then respectively indicate the IP inquiry factor and domain name whois inquires the factor
Weight.
For example, m=n=1/2；
More for example, m, n are unequal, specifically according to each weight for inquiring the factor and the second weight factor can be determined
Actual conditions and adjust.
It is understood that y is heavier closer to 1, second weight factor, the probability that picture concerned belongs to harmful picture is bigger.
The above formula for calculating y belongs to linear formula, however when practical application, it is also possible to use non-linear formula.
Further, either linear formula or non-linear formula, it is contemplated that being determined by training or be fitted
Correlation formula and its parameter.
Step S300 obtains the picture according to the path URL of the picture, and extracts direct current in the compression domain of picture
Coefficient, to identify the picture after carrying out part decompression to picture, and according to the result output third weight of identification picture because
Son；
Step S300 is that third weight factor is exported by the recognition result of picture.If detect harmful picture or
Other decadent contents etc., then third weight factor can be embodied.It is understood that harmful picture or other decadent contents etc.
When the number of appearance meets corresponding threshold condition, third weight factor may be 1.0, it is also possible to 0.8 or 0.4, depending on specific
Depending on threshold condition.
In addition, it is necessary to, it is emphasized that be carried out for computing resource and time cost needed for reducing the present embodiment to picture
It is first to extract DC coefficient from the compression domain of picture when identification, can be used to image knowledge to carry out part decompression to picture
Not.Since inventor utilizes: image information is largely focused on DC coefficient and its neighbouring low-frequency spectra this characteristic, institute
By DC coefficient part decompression can be carried out to picture, image recognition is carried out using the image information of part decompression, and
Unfavorable all information in complete picture, to reduce workload.Typically, meet the picture text of JPEG coding standard
Part can be handled in this way.
It is understood that can be used for described in the disclosure in this field the technological means that the harmful information of picture identifies
Picture.The step S300 can both carry out the processing of image in conjunction with traditional method, also can be used in conjunction with deep learning mould
Type carries out the processing of image, and then identifies to harmful picture.
More particularly, in one case, the picture is identified after carrying out part decompression to picture in the step S300,
It specifically includes:
It, will be being safeguarded in the picture and third party's image data base, known harmful after carrying out part decompression to picture
Picture carries out feature comparison, to identify the picture, and when being identified as nocuousness, further updates the picture to described
Third party's image data base；Wherein, preparatory by the picture for known harmful sites of creeping in third party's image data base
It establishes.
Step S400, comprehensive first weight factor and the second weight factor and third weight factor are to the picture
It is no to belong to harmful picture and identified.
Illustratively, if the first weight factor is x, the second weight factor is y, and third weight factor is z, wherein 0≤x≤
1,0≤y≤1,0≤z≤1, can according to the following formula in summary weight factor calculate picture harmful coefficient W:
W=a × x+b × y+c × z, wherein a+b+c=1, a, b, c then respectively indicate the weight of each weight factor.
For example, a=b=c=1/3；
It, specifically can be according to each weight factor and the actual conditions of identification harmful content more for example, a, b, c are unequal
And it adjusts.
It is understood that W is closer to 1, the probability that picture concerned belongs to harmful picture is bigger.
The above formula for calculating W belongs to linear formula, however when practical application, it is also possible to use non-linear formula.
Further, either linear formula or non-linear formula, it is contemplated that being determined by training or be fitted
Correlation formula and its parameter.
To sum up, for above-described embodiment, only step S300 has carried out image procossing, and remaining step is then separately to ward off footpath
Diameter is utilized relevant inquiring, obtains relevant weight factor.Then comprehensive (alternatively referred to as merging) the multiple weights of step S400 because
Son carries out the identification of harmful picture.Those skilled in the art know, specific image procossing, the identification relative consumption time at
This, and inquire and then in contrast more save time cost.It is clear that above-described embodiment proposes a kind of efficient knowledge of richness
The method of unharmful picture.In addition, above-described embodiment obviously can be established further combined with big data and/or artificial intelligence,
Update the first database, the second database and other databases.
In another embodiment, second database is third party database.
For example, the number in terms of harmful picture list of websites that numerous websites of progress whois inquiry and third party safeguard
According to the database in terms of the IP address of library or the website for having recorded harmful picture, IP address field list.
In another embodiment, for being identified as the network address (such as forum or webpage) of harmful picture, the net is collected
The IP address information of the publisher for the harmful picture recorded on location simultaneously updates first database.This is because harmful picture
It generally will form some sticky users, these users some can participate in propagating harmful picture and most IP address being phase
To fixation, if address correlation itself describes the IP address information of the publisher of harmful picture, disclosure if, passes through receipts
Collect its IP address information to update aforementioned first database.
In another embodiment, step S200 further include:
Further, the safety of domain name is inquired in third party's domain name safe list so as to the output safety factor,
And second weight factor relevant to domain name is modified by the factor of safety.
Such as virustotal.com this third party's domain name safe screen looks into website.It is understood that if third party's information
In think associated dns name include virus or wooden horse, then should improve the second weight factor, it is uneasy to have its source in related web site
Entirely.
It is understood that the embodiment is laid particular emphasis on from the second weight factor of network security angle modification, prevent user from meeting with
By unknown losses.This is because privacy and proprietary of the network security concerning user, if the related web site of harmful picture exists
Network Security Vulnerabilities, then also bringing the harm of privacy leakage or property loss to user other than the harm of harmful picture.
In another embodiment, step S300 further includes as follows:
Step c1): audio of creeping in the webpage；
Step c2): it whether include harmful content in identification audio, if so, then correcting third weight factor.
For the embodiment, if recognizing in audio includes harmful content described in the disclosure, this illustrates correlation
Website has menace, then corrects third weight factor, such as increase third weight factor.
As it was noted above, if in conjunction with big data technology, the disclosure being capable of the multiple dimensions of fruitful combination, Duo Zhongmo
Formula quickly identifies harmful picture in conjunction with IP information, domain-name information, image information, audio-frequency information.
Further, above-described embodiment can be implemented in router side or network provider side, filter in advance
Picture concerned.
Corresponding with method, referring to fig. 2, the disclosure discloses in another embodiment a kind of identifies harmful picture
System, comprising:
First weight factor generation module, is used for: when the page elements for judging webpage include the path URL for obtaining picture
When, identify the address IP or the IP address section of the user recorded in the content of pages of the webpage, inquiring in first database is
It is no there are the IP address or same network segment IP address, and according to the query result of IP address output relevant to IP first
Weight factor；
Second weight factor generation module, is used for: according to picture the path URL obtain the domain name for including in the URL or
The IP address that the URL is directed toward carries out whois inquiry based on the domain name for including in the URL in the second database, and/or
Based on the IP address that the URL is directed toward, inquiry is with the presence or absence of the IP address or same for including in the URL in the second database
Network segment IP address, and according to whois query result and/or the query result of IP address, it exports relevant to the path URL of picture
Second weight factor；
Third weight factor generation module, is used for: obtaining the picture according to the path URL of the picture, and in picture
Compression domain in extract DC coefficient, to identify the picture after carrying out part decompression to picture, and according to identification picture
As a result third weight factor is exported；
Identification module, for integrating the first weight factor and the second weight factor and third weight factor, to the figure
Whether piece, which belongs to harmful picture, is identified.
It is similar with the embodiment of each method above,
Preferably, second database is third party database.
It is furthermore preferred that the second weight factor generation module further include:
Amending unit is used for: it is further, inquired in third party's domain name safe list the safety of domain name so as to
The output safety factor, and second weight factor is modified by the factor of safety.
It is furthermore preferred that the third weight factor generation module, is also used to:, will be described after carrying out part decompression to picture
Picture is compared with harmful picture safeguard in third party's image data base, known carries out feature, to identify the picture, and
When being identified as nocuousness, further the picture is updated to third party's image data base；Wherein, third party's image
It is pre-established in database by the picture for known harmful sites of creeping.
It is furthermore preferred that also correcting third weight factor by such as lower unit in the third weight factor generation module:
Audio is creeped unit, for audio of creeping in the webpage；
Audio identification unit, for identification in audio whether include harmful content, if so, then correct third weight because
Son.
The disclosure discloses a kind of system for identifying harmful picture in another embodiment, comprising:
Processor and memory, are stored with executable instruction in the memory, the processor execute these instructions with
Execute following operation:
Step a), when the page elements for judging webpage include the path URL of picture, in the page that identifies the webpage
The IP address or IP address section of the user recorded in appearance, inquiry whether there is the IP address or same net in first database
Section IP address, and the first weight factor relevant to IP is exported according to the query result of IP address；
Step b), the IP address that the path URL according to picture obtains the domain name for including in the URL or the URL is directed toward,
Based on the domain name for including in the URL, whois inquiry, and/or the IP being directed toward based on the URL are carried out in the second database
Address is inquired in the second database with the presence or absence of the IP address or same network segment IP address for including in the URL, and according to
The query result of whois query result and/or IP address exports the second weight factor relevant to the path URL of picture；
Step c) obtains the picture according to the path URL of the picture, and extracts direct current system in the compression domain of picture
Number to identify the picture after carrying out part decompression to picture, and exports third weight factor according to the result of identification picture；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the picture whether
Belong to harmful picture to be identified.
The disclosure further discloses a kind of computer storage medium in another embodiment, is stored with executable instruction, institute
Instruction is stated for executing the following method for identifying harmful picture:
Step a), when the page elements for judging webpage include the path URL of picture, in the page that identifies the webpage
The IP address or IP address section of the user recorded in appearance, inquiry whether there is the IP address or same net in first database
Section IP address, and the first weight factor relevant to IP is exported according to the query result of IP address；
Step b), the IP address that the path URL according to picture obtains the domain name for including in the URL or the URL is directed toward,
Based on the domain name for including in the URL, whois inquiry, and/or the IP being directed toward based on the URL are carried out in the second database
Address is inquired in the second database with the presence or absence of the IP address or same network segment IP address for including in the URL, and according to
The query result of whois query result and/or IP address exports the second weight factor relevant to the path URL of picture；
Step c) obtains the picture according to the path URL of the picture, and extracts direct current system in the compression domain of picture
Number to identify the picture after carrying out part decompression to picture, and exports third weight factor according to the result of identification picture；
Step d), comprehensive first weight factor and the second weight factor and third weight factor, to the picture whether
Belong to harmful picture to be identified.
It may include: at least one processor (such as CPU) for above system, at least one sensor (such as plus
Speedometer, gyroscope, GPS module or other locating modules), at least one processor, at least one communication bus, wherein logical
Believe bus for realizing the connection communication between various components.The equipment can also include at least one receiver, at least one
A transmitter, wherein receiver and transmitter can be wired sending port, be also possible to wireless device (for example including antenna
Device), for carrying out the transmission of signaling or data with other node devices.The memory can be high speed RAM memory,
It can be non-labile memory (Non-volatile memory), for example, at least a magnetic disk storage.Memory is optional
Can be at least one storage device for being located remotely from aforementioned processor.Batch processing code is stored in memory, and described
Processor can call the code stored in memory to execute relevant function by communication bus.
Embodiment of the disclosure also provides a kind of computer storage medium, wherein the computer storage medium can store journey
Sequence, the program include the part or complete for any method for identifying harmful picture recorded in above method embodiment when executing
Portion's step.
Step in embodiment of the disclosure method can be sequentially adjusted, merged and deleted according to actual needs.
Module and unit in embodiment of the disclosure system can be combined, divided and deleted according to actual needs.
It should be noted that for the various method embodiments described above, for simple description, therefore, it is stated as a series of action groups
It closes, but those skilled in the art should understand that, the present invention is not limited by the sequence of acts described, because according to this hair
Bright, some steps may be performed in other sequences or simultaneously.Secondly, those skilled in the art should also know that, specification
Described in embodiment belong to preferred embodiment, related movement, module, unit not necessarily present invention institute are necessary
's.
In the above-described embodiments, it all emphasizes particularly on different fields to the description of each embodiment, there is no the portion being described in detail in some embodiment
Point, reference can be made to the related descriptions of other embodiments.
In several embodiments provided by the disclosure, it should be understood that disclosed system, it can be by another way
It realizes.For example, embodiments described above is only illustrative, such as the division of the unit, only a kind of logic function
It can divide, there may be another division manner in actual implementation, such as multiple units or components can be combined or be can integrate
To another system, or some features can be ignored or not executed.Another point, each unit or the mutual coupling of component or
Direct-coupling or communication connection can be through some interfaces, and the indirect coupling or communication connection of device or unit can be electricity
Property or other form.
The unit as illustrated by the separation member may or may not be physically separated, and can both be located at
One place, or may be distributed over multiple network units.Can select according to the actual needs part therein or
Whole units achieve the purpose of the solution of this embodiment.
It, can also be in addition, each functional unit in each embodiment of the disclosure can integrate in one processing unit
It is each unit individualism, can also be integrated in one unit with two or more units.Above-mentioned integrated unit was both
It can take the form of hardware realization, can also realize in the form of software functional units.
If the integrated unit is realized in the form of SFU software functional unit and sells or use as independent product
When, it can store in a computer readable storage medium.Based on this understanding, the technical solution of the disclosure is substantially
The all or part of the part that contributes to existing technology or the technical solution can be in the form of software products in other words
It embodies, which is stored in a storage medium, including some instructions are used so that a computer
Equipment (can be smart phone, personal digital assistant, wearable device, laptop, tablet computer) executes each of the disclosure
The all or part of the steps of a embodiment the method.And storage medium above-mentioned include: USB flash disk, read-only memory (R0M,
Read-0nly Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or
The various media that can store program code such as CD.
The above, above embodiments are only to illustrate the technical solution of the disclosure, rather than its limitations；Although referring to before
Embodiment is stated the disclosure is described in detail, it should be understood by those skilled in the art that: it still can be to aforementioned each reality
Technical solution documented by example is applied to modify or equivalent replacement of some of the technical features；And these modification or
Person's replacement, the range for the presently disclosed embodiments technical solution that it does not separate the essence of the corresponding technical solution.
Claims (10)
1. a kind of method for identifying harmful picture, comprising:
Step a), when the page elements for judging webpage include the path URL of picture, in the content of pages that identifies the webpage
The IP address or IP address section of the user of record, inquiry whether there is the IP address or same network segment IP in first database
Address, and the first weight factor relevant to IP is exported according to the query result of IP address；
Step b), the IP address that the path URL according to picture obtains the domain name for including in the URL or the URL is directed toward, is based on
The domain name for including in the URL carries out whois inquiry, and/or the IP address being directed toward based on the URL in the second database,
Inquiry is with the presence or absence of the IP address or same network segment IP address for including in the URL in the second database, and is looked into according to whois
The query result of result and/or IP address is ask, the second weight factor relevant to the path URL of picture is exported；
Step c) obtains the picture according to the path URL of the picture, and extracts DC coefficient in the compression domain of picture,
To identify the picture after carrying out part decompression to picture, and third weight factor is exported according to the result of identification picture；
Whether step d), comprehensive first weight factor and the second weight factor and third weight factor, belong to the picture
Harmful picture is identified.
2. according to the method described in claim 1, wherein, it is preferred that second database is third party database.
3. according to the method described in claim 1, wherein, step b) further include:
Further, the safety of domain name is inquired in third party's domain name safe list so as to the output safety factor, and led to
The factor of safety is crossed to be modified second weight factor.
4. the picture is identified after carrying out part decompression to picture in step c) according to the method described in claim 1, wherein,
It specifically includes:
After carrying out part decompression to picture, by harmful picture safeguarded in the picture and third party's image data base, known
Feature comparison is carried out, to identify the picture, and when being identified as nocuousness, is further updated the picture to the third
Square image data base；Wherein, it is pre-established in third party's image data base by the picture for known harmful sites of creeping.
5. according to the method described in claim 1, wherein, step c) further includes as follows:
Step c1): audio of creeping in the webpage；
Step c2): it whether include harmful content in identification audio, if so, then correcting third weight factor.
6. a kind of system for identifying harmful picture, comprising:
First weight factor generation module, is used for: when the page elements for judging webpage include obtaining the path URL of picture,
Whether the IP address or IP address section for identifying the user recorded in the content of pages of the webpage, inquire in first database and deposit
The first weight relevant to IP is exported in the IP address or same network segment IP address, and according to the query result of IP address
The factor；
Second weight factor generation module, is used for: the path URL according to picture obtains the domain name for including in the URL or described
The IP address that URL is directed toward carries out whois inquiry, and/or be based on based on the domain name for including in the URL in the second database
The IP address that the URL is directed toward, inquiry is with the presence or absence of the IP address or same network segment for including in the URL in the second database
IP address, and according to whois query result and/or the query result of IP address, it exports and the path URL relevant second of picture
Weight factor；
Third weight factor generation module, is used for: obtaining the picture according to the path URL of the picture, and in the pressure of picture
Contracting extracts DC coefficient in domain, to identify the picture after carrying out part decompression to picture, and according to the result of identification picture
Export third weight factor；
Identification module is to the picture for integrating the first weight factor and the second weight factor and third weight factor
It is no to belong to harmful picture and identified.
7. system according to claim 6, wherein preferred, second database is third party database.
8. system according to claim 6, wherein the second weight factor generation module further include:
Amending unit is used for: it is further, the safety of domain name is inquired in third party's domain name safe list to export
Factor of safety, and second weight factor is modified by the factor of safety.
9. system according to claim 6, wherein the third weight factor generation module is also used to: being carried out to picture
After part decompresses, by the picture compared with harmful picture safeguard in third party's image data base, known carries out feature, with
Just it identifies the picture, and when being identified as nocuousness, further updates the picture to third party's image data base；Its
In, it is pre-established in third party's image data base by the picture for known harmful sites of creeping.
10. system according to claim 6, wherein also by such as lower unit in the third weight factor generation module
Correct third weight factor:
Audio is creeped unit, for audio of creeping in the webpage；
Whether audio identification unit includes for identification harmful content in audio, if so, then correcting third weight factor.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711500075.6A CN110020259A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful picture based on User IP |
| PCT/CN2018/072246 WO2019127662A1 (en) | 2017-12-30 | 2018-01-11 | Method and system for identifying harmful picture on basis of user ip |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711500075.6A CN110020259A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful picture based on User IP |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110020259A true CN110020259A (en) | 2019-07-16 |
Family
ID=67064477
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711500075.6A Withdrawn CN110020259A (en) | 2017-12-30 | 2017-12-30 | A kind of method and its system identifying harmful picture based on User IP |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN110020259A (en) |
| WO (1) | WO2019127662A1 (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104268284A (en) * | 2014-10-21 | 2015-01-07 | 合肥星服信息科技有限责任公司 | Web browse filtering softdog device special for juveniles |
| CN104615760A (en) * | 2015-02-13 | 2015-05-13 | 北京瑞星信息技术有限公司 | Phishing website recognizing method and phishing website recognizing system |
| CN106055574A (en) * | 2016-05-19 | 2016-10-26 | 微梦创科网络科技（中国）有限公司 | Method and device for recognizing illegal URL |
| CN106354800A (en) * | 2016-08-26 | 2017-01-25 | 中国互联网络信息中心 | Undesirable website detection method based on multi-dimensional feature |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6751348B2 (en) * | 2001-03-29 | 2004-06-15 | Fotonation Holdings, Llc | Automated detection of pornographic images |
| CN100361450C (en) * | 2005-11-18 | 2008-01-09 | 郑州金惠计算机系统工程有限公司 | System for blocking off erotic images and unhealthy information in internet |
| CN102880613A (en) * | 2011-07-14 | 2013-01-16 | 腾讯科技（深圳）有限公司 | Identification method of porno pictures and equipment thereof |
| CN102833262B (en) * | 2012-09-04 | 2015-07-01 | 珠海市君天电子科技有限公司 | Phishing website collection and identification method and system based on whois information |
-
2017
- 2017-12-30 CN CN201711500075.6A patent/CN110020259A/en not_active Withdrawn
-
2018
- 2018-01-11 WO PCT/CN2018/072246 patent/WO2019127662A1/en active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104268284A (en) * | 2014-10-21 | 2015-01-07 | 合肥星服信息科技有限责任公司 | Web browse filtering softdog device special for juveniles |
| CN104615760A (en) * | 2015-02-13 | 2015-05-13 | 北京瑞星信息技术有限公司 | Phishing website recognizing method and phishing website recognizing system |
| CN106055574A (en) * | 2016-05-19 | 2016-10-26 | 微梦创科网络科技（中国）有限公司 | Method and device for recognizing illegal URL |
| CN106354800A (en) * | 2016-08-26 | 2017-01-25 | 中国互联网络信息中心 | Undesirable website detection method based on multi-dimensional feature |
Non-Patent Citations (1)
| Title |
|---|
| 杨辉 等: "压缩域DCT系数对图像视频检索影响的研究", 《南京邮电学院学报》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2019127662A1 (en) | 2019-07-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10778702B1 (en) | Predictive modeling of domain names using web-linking characteristics | |
| Naeem et al. | Malware detection in industrial internet of things based on hybrid image visualization and deep learning model | |
| CN110177114B (en) | Network security threat indicator identification method, equipment, device and computer readable storage medium | |
| CN104699737A (en) | Method and system for managing a search | |
| CN103888480B (en) | Network information security authentication method and cloud device based on cloud monitoring | |
| CN103973635B (en) | Page access control method and relevant apparatus and system | |
| Chen et al. | Ai@ ntiphish—machine learning mechanisms for cyber-phishing attack | |
| CN110019892A (en) | A kind of method and its system identifying harmful picture based on User ID | |
| CN108664808B (en) | A kind of user's sensitivity theme guard method and system towards books search service | |
| CN107665229B (en) | Information searching method, device and equipment | |
| CN110020256A (en) | The method and system of the harmful video of identification based on User ID and trailer content | |
| CN110363023B (en) | Anonymous network tracing method based on PHMM | |
| CN106209748A (en) | The means of defence of internet interface and device | |
| CN117221135A (en) | Data analysis method, device, equipment and computer readable storage medium | |
| CN110020259A (en) | A kind of method and its system identifying harmful picture based on User IP | |
| CN109993036A (en) | A kind of method and its system identifying harmful video based on User ID | |
| CN110019946A (en) | A kind of method and its system identifying harmful video | |
| CN110109952A (en) | A kind of method and its system identifying harmful picture | |
| Almousa et al. | A URL-based social semantic attacks detection with character-aware language model | |
| Aleksic et al. | State of the art in privacy preservation in video data | |
| CN110020251A (en) | The method and system of the harmful video of identification based on User IP and trailer content | |
| CN110020252B (en) | Method and system for identifying harmful video based on trailer content | |
| CN110020254A (en) | The method and system of the harmful video of identification based on User IP and video copy | |
| TW201626279A (en) | Protection method and computer system thereof | |
| CN110020258A (en) | A kind of method and system of the URL Path Recognition nocuousness picture based on approximate diagram |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20190716 |