JP2002117135A - Web site security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a web site security system, with which write-in or the like is analyzed corresponding to the contents or the like of a web site, only proper write-in is displayed and so on and publishing of inproper write-in can be excluded. SOLUTION: In this security system, the contents of various kinds of write-in are analyzed by high-level language analyzing processing 35 based on word analysis and phrase analysis or the like and inproper contents and a user unqualified to the purpose of the site or the like are excluded so that the healthy operation of the Web site can be performed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to, for example, analyzing writing and the like corresponding to the contents of a web site, displaying only proper ones, etc., and excluding or processing improper ones. A website security system that can be rendered harmless.

[0002]

2. Description of the Related Art Conventionally, websites placed on the Internet (hereinafter referred to as "websites") have been proposed.
(Referred to as a site), a user who opens the page (a general user and a registered member depending on the site) can perform various types of writing. For example, the form may be "bulletin board" or "forum", or "chat" or "e-mail".

[0003] However, under the present circumstances, mischief or harassment in which sexual terms, filthy words, abusive words, and the like are written in these entry fields frequently occurs.

[0004] In addition to the above, there are also ones that develop out-of-place business activities that do not conform to the purpose of operating the site and that use the benefits for the benefit of individuals or specific groups (for example, searching for people, recruiting to religions, etc.). . Also, there is a case where a DM in an e-mail format commonly called a spam mail is sent. In addition, there are cases where victims suffer from a site cracker act commonly called an email bomb (sending a large amount of emails and aiming to paralyze the operation of the site).

[0005] These cause discomfort and fear to the site user, and also cause a decrease in popularity due to the deterioration of the image of the site, which often directly leads to economic loss such as a decrease in advertising revenue. It can cause tremendous damage in many ways, including loss of credibility of site operators and stakeholders (eg, site sponsors and advertising providers).

[0006] Further, if the site has a function generally called a community site and has a function of promoting encounters through the site, a situation such as stalking at a site away from the site may occur. .
Unexpectedly, they can provide a good opportunity for these anti-social actions.

Conventionally, for example, when posting on an electronic bulletin board or the like, a means for checking forbidden terms and not posting when a message is ineligible is carried out by a site administrator by manned surveillance. Inspection of writing prevents troubles and the like.

However, the nature of the Internet is that, since writing can always be performed instantaneously from a remote place, keeping track of this kind of writing requires a great deal of effort, and it is almost practically impossible depending on the size of the site. Often.

Conventionally, in electronic bulletin boards, it is considered that it is inappropriate to post on the electronic bulletin board, and it is necessary to pay attention to a banned glossary in which a term selected in advance is put into a database and a reaction of society. A terminology requiring caution is compiled into a database of terms selected in the above, and among the information entered on the message registration screen, a message desired to be posted on an electronic bulletin board is inspected against the terminology that is prohibited from posting and the terminology requiring caution. , If the message you want to publish contains the terms of concentration of sensitive words,
Notifying the administrator of the electronic bulletin board system of the event of posting a message containing the sensitive word on the electronic bulletin board system, while not including the banned term concentration term in the desired message There is a proposal of an electronic bulletin board system for posting the message on an electronic bulletin board (see Japanese Patent No. 2951307).

[0010] However, the above proposal has the following problems.

In the above proposal, the linguistic analysis is "only the term selected in advance (a banned glossary, a glossary requiring caution)" and the system is limited to this glossary.
If words or symbols that have no relation to each other (for example, ○, ×, 1, 2, 3,..., A, B, C, etc.) are inserted between the terms, language analysis cannot be performed. It may be posted as it is. In addition, even if it corresponds to the glossary, it only notifies that it can not be posted or notifies the administrator that it has been rejected, and uses the analysis data for user management,
It lacks a mechanism to prevent malicious users from entering again. Therefore, there is a problem in that there is a security hole that gives a malicious user a chance of trial and error to pierce the glossary.

The present invention has been made to solve these problems of the prior art. Not only electronic bulletin boards, but also posting and posting of forums, chats, mails, ICQs, messaging software, web TVs, web TV telephones, etc. A language analysis process such as advanced term or sentence phrase analysis and a user management system, mischief or harassment to write terms with malicious content, words with filthyness, or abusive words, etc., out of place that does not conform to the purpose of the site To provide a website security system that excludes those that conduct business or use it for the benefit of individuals or specific groups.

[0013]

Means for Solving the Problems To solve the above problems, a first invention of a website security system of the present invention includes a user terminal and a server system which can communicate with each other through a network, and transmits the data to the server system. Information analyzing means for analyzing the written contents of the written original, and managing means for managing the analysis results in accordance with the analyzed information contents. In some cases, the processing is executed as it is, while when the written contents of the original are inappropriate or inappropriate,
It is characterized in that the posting process is stopped or the contents described are processed.

A second invention is characterized in that, in the first invention, the information analysis means analyzes a profile or the like of a sender.

According to a third invention, in the first invention, the information analysis means is connected to a website without passing through a network.

In a fourth aspect based on the first aspect, the information analysis means is connected to a website via a network.

In a fifth aspect based on the first aspect, the management means is connected to a website without passing through a network.

In a sixth aspect based on the first aspect, the management means is connected to a website via a network.

According to a seventh invention, in the first invention, the writing target of the writing manuscript is an electronic bulletin board, a forum, a chat, a mail, an ICQ, a messaging software, a web TV, a web TV telephone, or the like. Features.

In an eighth aspect based on the seventh aspect, the writing target of the writing original is a web-based mail.

According to a ninth aspect, in the eighth aspect, a mail sending means is provided in the information analyzing means.

A tenth invention is characterized in that, in the first invention, the information analysis means performs analysis by character string analysis.

According to an eleventh aspect, in the tenth aspect,
The character string analysis is a use prohibited character string analysis.

According to a twelfth aspect, in the tenth aspect,
The character string analysis is a cautionary character string analysis.

A thirteenth invention is characterized in that, in the first invention, the information analysis means analyzes by phrase analysis.

According to a fourteenth aspect, in the thirteenth aspect,
It is characterized in that the phrase analysis is a use prohibited phrase analysis.

According to a fifteenth aspect, in the thirteenth aspect,
It is characterized in that the phrase analysis is a cautionary phrase analysis.

In a sixteenth aspect based on the first aspect, the information analyzing means is characterized in that the information analyzing means includes a character string analysis, a use prohibited character string analysis,
It is characterized in that the analysis is a combination of at least two or more selected from a cautionary character string analysis, a phrase analysis, a use prohibition phrase analysis, or a cautionary phrase analysis.

In a seventeenth aspect based on the first aspect, the processing is performed such that the use-prohibited character string, use-prohibited phrase, caution-required character string, caution-required phrase is replaced by a blank or symbol It is characterized in that

According to an eighteenth aspect based on the first aspect, the information analyzing means includes a mail address, an ID code, and an IP address.
The user profile is specified by at least one of an address, a HOST name, and information on a browser or a combination of two or more of them.

In a nineteenth aspect, in the first aspect, if the content of the description or the sender is inappropriate or inappropriate,
A feature of displaying, on the screen of the server system, that the posting process is stopped or processed.

According to a twentieth aspect, in the first aspect, if the content of the description or the sender is appropriate or appropriate, the posting process is continued, and the mail address, ID code, IP
The content of the posting process is displayed on the screen of the server system together with at least one of the address, the HOST name, the information on the browser, or a combination of two or more of them.

According to a twenty-first aspect, in the twentieth aspect,
When the content of the written original is in a mail format, the written content is transmitted together with at least one of a mail address, an ID code, an IP address, a HOST name, information on a browser, or a combination of two or more of these. It is characterized by doing.

According to a twenty-second aspect, in the first aspect, when the description content or the sender is inappropriate or inappropriate,
The posting process is stopped, and the contents are stored as information.

According to a twenty-third aspect, in the twenty-second aspect,
The stored contents can be viewed only by a person having the reading right.

According to a twenty-fourth invention, in the twenty-second invention,
It is characterized in that the content accumulated only by the person having the reading right is processed or analyzed.

A twenty-fifth aspect of the present invention is the device according to the first aspect, wherein the description content or the sender is inappropriate or inappropriate.
The posting process is stopped and the administrator is notified.

According to a twenty-sixth aspect, in the first aspect, when the description content or the sender is inappropriate or inappropriate,
The posting process is stopped and the administrator is notified.

The twenty-seventh invention is based on the first, twenty-second, twenty-fifth, twenty-six,
The present invention is characterized in that suspending the posting process includes suspension, and there is a case where the posting process is resumed.

The twenty-eighth invention of the website security method includes a user terminal and a server system that can communicate with each other through a network, analyzes the contents of the written original sent to the server system, and analyzes the contents. The analysis result is managed according to the information content, and if the described content or the sender is appropriate or qualified according to the above content analysis, the posting process etc. is executed as it is, while the described content or the sender is The computer is controlled so as to stop or process the posting process when the information is inappropriate or inappropriate.

According to a twenty-ninth aspect of the present invention, there is provided a recording medium including a user terminal and a server system capable of communicating with each other through a network. Management means for managing the analysis result according to the information content that has been provided, and in accordance with the content analysis, if the written content or the sender is appropriate or qualified, the posting process or the like is executed as it is,
When the content of the description or the sender is inappropriate or inappropriate, a program for controlling a computer to stop or process the posting process is stored.

[0042]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below, but the present invention is not limited to these embodiments.

The website security system of the present invention analyzes the contents of various types of writing by advanced linguistic analysis, for example, by analyzing a character string of a term and analyzing a phrase, and does not consider the contents to be inappropriate and the purpose of the site. Eligible users are eliminated, and a healthy website is operated.

1 to 7 illustrate the gist of the present invention. FIGS. 8 to 18 exemplify system configuration diagrams when specifically constructing a system based on such a framework. 1 and 2 are schematic diagrams of a network connection diagram. As shown in FIGS. 1 and 2, the network connection system according to the present embodiment is connected to a web (hereinafter, referred to as “NET: Internet network”) 11 such as Internet communication. W
eb) A state in which the site 2000 is connected to the user terminal 001 and the website security system 1000.

The user terminal 001 and the like are used when a general user connects to the Internet.
For example, it refers to a personal computer (personal computer) and a portable information terminal (PDA, mobile phone, etc.). The website 2000 is a server (or a group of servers) that provides a web service, and the type and number thereof are not limited.

The user terminal 001 is connected to the Internet via a telephone line or the like.
An access request 21 to the P.0 and a data transmission 22 from the website 2000 are performed.

The server (or group of servers) of the website security system 1000 according to the present invention is connected to the Internet 11 by a telephone line or a dedicated line.

The form of service of the website security system 1000 according to the present invention is “user”,
Depending on the arrangement of the "website" and "this system", it can be broadly classified into the following two forms. The first mode is a user terminal 001, a website 2000, a website security system 1000
Are monitoring systems that are connected to each other via the Internet network 11 (this is called an “external monitoring system”), and an analysis request 23 and an analysis result transmission 24 are made via the Internet network 11 (FIG. 1). In the second mode, the user terminal 001 and the website 2000 are connected via the Internet network 11, but the website 2000 and the website security system 1000 are connected to a local LA other than the Internet.
N, a monitoring system that is directly connected by a dedicated line or the like (this is referred to as an “internal monitoring system”), in which an analysis request 23 and an analysis result transmission 24 are made via an intermediary means other than the Internet network. (See FIG. 2).

Further, the two types of monitoring systems may have two more modes depending on where the terminal 100 of the administrator of the website 2000 is located. The form is shown in FIG. 3 and FIG.

The mode shown in FIG. 3 is a mode in which the administrator terminal 100 is connected to the website security system 1000 via the Internet 11, and the analysis request 28 is made via the Internet 11. The result is sent to the analysis result 29 via the Internet network 11.
Is done.

In the mode shown in FIG. 4, the administrator terminal 100 communicates with the website security system 1000 and the local LAN.
The analysis request 28 is made via the Internet 11, and the result is analyzed without passing through the Internet 11. The result is sent 29.

Incidentally, the four combinations shown in FIG. 1 or FIG. 2, FIG. 3 or FIG. 4 can be practically divided into more modes.

First, there are two types of cases where the website 2000 and the website security system 1000 have different (legal) personalities and the same (legal) personality. In addition, the administrator terminal 100 changes the website 2000
, Or belonging to the website security system 1000, or neither of them. All of these combination patterns are all encompassed by the present invention.

FIG. 6 simply illustrates the flow of information processing in the present invention. All of the above-described patterns are illustrated in this way if all of the types of the line route are ignored and the data conversion required when straddling between the types is ignored.

As shown in FIG. 6, an access request 21 is made from the user terminal 001 to the website 2000,
The analysis request 23 is made from the website 2000 to the website security system 1000 for the written information there.

This website security system 10
In 00 (within the dashed line in FIG. 6), an analysis process is performed based on user information, language analysis, address information, and the like.
If not, it is identified and determined, and the result is sent to the website 2000 as a result 24.

The result transmission 24 in the website security system 1000 is roughly classified into two of “permission of use” and “rejection of use”, both of which are received 25 by the website 2000. Then, in the website 2000, corresponding various service processes 26 are performed on the website 2000 according to the received contents. The result on the website 2000 is sent out 22 to the user terminal 001, and the process ends.

When the subject of the analysis processing is a mail,
In the case of use permission, send mail from this system as it is 2
7 is made. However, if the website 2000 has a mail server, the website 200
A mail may be sent from 0.

Further, in the website security system 1000, the result information of the process is stored as the first record 31 to the third record 33 for each process.

FIG. 7 is an enlarged view of the system area of the website security system 1000 of FIG. As shown in FIGS. 6 and 7, when there is the inquiry access 23, analysis processing of user information, language analysis, address information, etc. is started 34, and analysis processing of user information, language analysis, address information, etc. 35 It is determined whether there is a forced exclusion target. When it is determined by the analysis process 35 that the user falls under the target of the forced exclusion,
The use refusal and various service stop instructions 36 are issued. On the other hand, when it does not correspond to the compulsory exclusion target, the use continuation and various service continuation instructions 37 are issued. At this time, in each process, the judgment information / history information is stored as a first record 31 to a third record 33.

Here, the first record 31 is a record of various access histories, and all the history information is recorded.

In the second record 32, the user information which has been rejected by the analysis process 35 is stored. This data is basic data for determining what is called a blacklist registration target person, and includes much information that may be fed back to the analysis processing 35.

The third record 33 is information of a user whose use is permitted by the analysis processing 35. In some cases, the third record 33 includes a malicious write or the like that cannot be analyzed by the mechanical analysis in the analysis process 35. Therefore, it is preferable to record the third record 33 for use at a later date.

Of the records 31 to 33, the second record 32 whose use has been refused is not necessarily required only for linguistic analysis (to be described later), like the other records. When adopting, it is necessary to leave it.
On the other hand, it is preferable that the first record 31 or the third record 33 is stored because these records are stored and referred to at a later date because the reliability of the analysis is improved.

Hereinafter, the contents of the processing will be specifically described.

FIG. 8 shows an outline of a network connection diagram (when passing through the Internet), and FIG. 9 shows an outline of a network connection diagram (when not passing through the Internet). 8, reference numerals 001, 002, 003,...
Are various terminal groups (PCs, portable information terminals,...) Used when general users connect to the Internet.
..., 1000, 1001, ... are the system server (s) of the website security system according to the present invention, 20
00 is a website that receives security services provided by this system.

The network connection diagram of FIG. 8 (when passing through the Internet network 11) corresponds to the embodiment of FIG. 1, and is connected to the website security system 1000 server according to the present invention via the Internet network 11. , And a website 2000 to receive the service. The user terminals 001 are connected to the Internet 11 via a telephone line 201 or the like. Website 2000 and server group 1 of this system
000 is the Internet network 11 via the dedicated line 202 or the like.
Connected to Thus, the three parties are connected via the Internet network 11.

The network connection diagram of FIG. 9 (when not passing through the Internet network) corresponds to the embodiment of FIG. 2, and the website 2000 and the website security system 1000 are connected to the Internet network via the same dedicated line 202 or the like. 11 are connected to each other by a private line (connection means other than the Internet) 203 such as a private LAN.

This is the case where the site operator and the system operator are the same, and the case where the site operator is a different (legal) personality but physically located at the same place, as is typical for a hosting service. There are two main types. In FIG. 9, the information that once enters the website 2000 in the drawing looks as if the information is subsequently transmitted to the website security system 1000 server. Since the processes are synchronized, the processes follow the priority of the process (described later) regardless of the physical connection order.

In the following description, the drawings will be described based on the pattern of FIG. This is also to clarify the flow of the discussion, but rather because the form of FIG. 8 is of a nature that subsumes the form of FIG. In the following figures, only the changes in the form of FIG. 9 (both of which are private) are the Internet network 11 and the data conversion process therefor interposed between the website and the system, and these are deleted. Only.

FIG. 10 shows a data flow of this processing.
In the case where the system of the present invention is employed, as shown in FIG.
0, an analysis request 23 is made, and after the analysis processing of the website security system 1000 is performed, the analysis processing result 24 is sent to the website 2000, and the data (for example, a homepage or the like) is sent 22 to the user. Take.

The analysis request 23 and the processing result transmission 24
Is performed via the Internet (in the case of FIG. 8) via the Internet, and via a dedicated line such as a private LAN (in the case of FIG. 9), for example, via a dedicated line.

On the other hand, the flow of data of a general web site is such that the web site 2000 simply sends out the home page 22 in response to an access request 21 from the user terminal 001 via the Internet network 11. Yes, no language analysis processing or the like has been performed.

When the website 2000 executes the analysis request 23 to the website security system 1000, the system 1000 executes a series of analysis processing (for example, language analysis, user management, address management, and the like). The result is sent 24 to the web server 2000 as an information service site.

When the content of the access request 21 from the user is the use of a so-called “web mail (described later)” provided on the website 2000, the analysis is performed by the system 1000 and the transmission is disabled. Except in cases where a judgment is made, through the Internet network 11 directly
The data converted by the mail in the Internet mail server system 1000C can be sent to the designated mail destination 27.

FIG. 10 shows that a website 2000 provides various services such as a general web service, bulletin board, chat, mail, and the like.

An area surrounded by a broken line in FIG. 10 indicates a server (group) which is an area of the website security system 1000, and includes a web server 1000A and various analysis systems 1000B. A mail server 1000C is also included.

Here, in the web server 1000A of the system 1000, the following two data format conversions are performed as necessary. When the request of the analysis request 23 is received, the data is converted into a data type used in the analysis system 1000B. At the time of processing result transmission 24, the Internet network 11
Convert to the data type used in.

In various analysis systems 1000B,
Performs a series of analysis processes (language analysis, user management, address management).

Internet Mail Server System 10
00C converts the mail information analyzed by the various analysis systems 1000B into Internet e-mail and sends it to the mail 27.

FIG. 11 to FIG.
The flow of data processing through the system is shown for each type of service provided to the user above.

FIG. 11 shows a data processing process when the website security system 1000 analyzes write data to the “bulletin board” on the website 2000. The website 2000 inquires of this system about the "written contents" and "analysis data of a path and the like (described later)" of the user, and "mail address" if possible. At this time, the website security system 1000 attaches an ID code (site ID) 51 for managing the site of the inquiry request source to the processing target data (inquiry data) 52. This site ID
51, each website 2000,
Processing according to individual requests (described later) of 2001, 2002...

The present website security system 10
The data that has been subjected to the analysis processing by the analysis processing system 1000B of No. 00 and determined to have no problem (good) 55 in the pass / fail judgment 54 is registered on the website 2000, subjected to bulletin board processing 56, and displayed publicly. On the other hand, pass / fail judgment 54
In the above, the data determined to be problematic (bad) is recorded in the system record 57, and the write data is left blank, erased, processed, etc.
8 and the registration for writing to the website 2000 is rejected.

At this time, it is also possible to display a message set in advance according to the request of each site to the writing user. At this time, on the screen, for example, if there is no problem (good), it is "Registered correctly", and if there is a problem (bad), it is displayed as "Inappropriate expression in the sentence. Yes, you can not write. Please review the contents once again. " In addition to characters, images (moving images or still images) and voices (words, sounds, music, etc.)
Can be used to convey a similar message.
In addition, regarding data that is permitted to be written and registered, data containing a cautionary expression (described later) is recorded or saved, etc.
It is also possible to set up a system that allows the administrator 100 of each website (see FIGS. 3 and 4) to check the registration of the data by browsing the records and the like.

FIG. 12 shows an outline of the processing for mail. However, this is an e-mail transmission service using e-mail called web-based e-mail (hereinafter referred to as "web e-mail"), which is different from Internet e-mail in general. Unlike the general e-mail, the above-mentioned web mail does not write the mail by the user's mail client software, but the data written directly on the screen of the website is converted into the mail format and transmitted, and it is sent. It can be read by the destination mail client software or read on another web screen.

In principle, this web mail is targeted, and not a general electronic mail, because it is impossible to analyze the latter written data by the technique according to the present invention. However, even for general e-mail, it is only possible to analyze the route using header information, etc., and it is possible to bring a certain level of security effect by comparing it with malicious user registration information. Can be subject to system analysis.

The data processing steps follow almost the same steps as those in FIG. 11, except for the steps after the transmission of the analysis results. If the problem is bad, the writing to the web mail operated by the site is rejected through almost the same process as the process in FIG. 11, and as a result, the mail is not transmitted. If there is no problem, the data is converted into mail format by the Internet mail server system in this system and sent. At this time, on the screen, for example, if there is no problem (good), the message is "Registered correctly and will be sent." There is inappropriate language and we can not send it. Please review the contents once again. " It is also possible to convey similar messages using not only characters but also images (moving images or still images) and voices (words or sounds or music). Regarding the data permitted to be transmitted, the data containing the expression requiring caution (described later) is recorded or saved, and the administrator 100 of each website (see FIGS. 3 and 4) records the recorded data. By browsing, it is also possible to set up a system that can check whether the registration of the data is appropriate or whether the user who wrote the data is appropriate to continue using the data.

FIG. 13 is an outline of the processing in the case of chat. The data processing process follows substantially the same process as in the case of FIG. 11, and the acceptability is determined by the pass / fail judgment 54. If there is no problem (good), the comment data is returned 6 as it is.
3 and the write process is continued, while if there is a problem (bad) improper or ineligible system record 57
The message data is blanked, erased, processed, etc. 64, and writing registration to the website 2000 is rejected. At this time, on the screen, for example, if there is no problem (good), it is "Registered correctly", and if there is a problem (bad), it is displayed as "Inappropriate expression in the sentence. Yes, can not be written. Please review the contents once again. " Also, not only by characters, but also by images (moving images or still images)
It is also possible to convey the same message by using voice or voice (words, sounds, music, etc.). Also, with regard to the data that is allowed to be written in the chat, the data including the cautionary expression (described later) is recorded or saved, and the administrator 100 of each website (see FIGS. 3 and 4) records the data. By browsing to see if the data is properly registered,
Alternatively, it is also possible to set up a system capable of checking whether the continuation of use of the user who wrote the data is appropriate. If inappropriate, the user is forcibly removed from the electronic space where the chat is being performed (generally called a chat room) (that is, entry refusal and exit). It is also possible.

A bulletin board with a slight time lag before another user sees it. In a chat that is displayed in real time, even if it takes only a few seconds to a few minutes, if a malicious write is made, another message will be displayed. It can be seen by the user, causing damage. In reality,
There are a number of malicious users, commonly referred to as chat storms, that use language in chat rooms to hinder their operation. In chats where even spoken expressions are exchanged, it is difficult to adopt language analysis that is too strict because there is a risk of losing the vitality of the conversation, and it analyzes in real time slander and slander by antonym terminology such as home killing It is almost impossible to do that.

Therefore, the most effective means of preventing such chat storm damage is to refuse entry based on user management. If the user is currently in use, it is possible to forcibly leave the room, or to specify a user registered in the blacklist by route analysis or the like, and reject the user.

FIG. 14 is a detailed diagram of various data analysis processing steps which are the backbone of the website security system. Here, a series of principles after receiving the site ID 51 and the inquiry request data 52 sent from the website (not shown) will be described. The input control device 71
Judges the "bad signal identification" of the data sent from the website and other unauthorized intrusions, and protects this system from server trouble. It is also this part that the site administrator performs identity verification when accessing via the Internet network 11.

Next, the web server 1000A inputs the data that has passed through the input control device 71, and converts the data from an Internet type data format to a data format that can be processed by the database system as necessary.

Various analysis systems 100 for performing data processing
0B stores roughly three types of inquiry data groups, as described below, and performs an inquiry with these three data groups to analyze data security. In addition, analysis processing data can be further stored as needed.

Here, the content identification processing means 72A shown in FIG. 14 performs linguistic analysis data processing (see FIG. 15), and the user inquiry means 72B performs processing for managing user information (see FIG. 16). The address identifying means 72C performs data processing of the user's mail address (see FIG. 17) (the details will be described later).

Among the data subjected to the above-described analysis processing, the data transmitted to the web site is the web server 100
The "processing result data" is converted from the format for the database to the format for the Internet by 0A, and transmitted as output B.

In the case of data to be mail,
After processing, if it is determined that there is no problem, it is converted to a mail format (see FIG. 18), and the Internet mail server 1
The data is converted into an electronic mail format by 000C and transmitted to a destination via the Internet network 11.

FIGS. 15, 16 and 17 show different analysis steps.

In this system, any one of the above-mentioned analyzes, two or all of them can be used. Also, when using multiple analysis processes,
In order to determine the processing order, electronic processing is performed simultaneously and in parallel, and in any analysis, data subjected to forced exclusion is subjected to exclusion processing without waiting for other processes. It is also possible.

FIG. 15 shows an outline of the language analysis data processing. Here, the analysis of the "written contents (in some cases, a pen name called a handle name or other registration information, which can be used because a malicious vocabulary is used for them)" is analyzed. To determine whether the writing is appropriate.

The data processing system 1000B includes a use prohibited character string analysis 82A and a use prohibited phrase analysis 82
B, which consists of four major analysis means, a cautionary character string analysis 82C and a cautionary phrase analysis 82D. The data file is queried for the data, and slander words, obscene expressions, or expressions that are not desirable for the site. This is to analyze the presence or absence.

Here, the use prohibition character string analysis 82A is to analyze at a term level using a glossary or the like. The use prohibition phrase analysis 82B analyzes at a word correlation level, and analyzes the presence or absence of a word group having a certain correlation. The cautionary character string analysis 82C is for analyzing a term level, a glossary, and the like, and may be provided as necessary. The phrase requiring caution is analyzed at a word correlation level, and is used to analyze the presence or absence of a word group having a certain correlation, and may be provided as necessary.

The above analysis processing 82A to 82A
D can be customized according to the circumstances of the site, and it is possible to customize the ID of the target site attached to the registered contents of each data file and the site ID attached to the data to be processed. This is made possible by collation. With this function, it is possible to analyze according to the characteristics and operation policy of the site.

The use prohibition character string analysis 82A and the use prohibition phrase analysis 82B are data of terms or expressions that are the reason for forced exclusion. In the light of the rules of each site, expressions that are determined not to allow writing etc. are collected.

The cautionary character string analysis 82C and the cautionary phrase analysis 82D are a collection of terms / expressions that are difficult to make a definitive characterization just because of exclusion. In addition, these may be provided as needed together,
By adding these, more advanced language processing can be performed. For example, "congratulations" is a word that has a positive meaning in nature, but in an antonymous usage such as "you are a congratulations person", it is converted into an abuse expression. Conversely, the expression "idiot" is also used in situations where the expression of friendliness or the derogation of oneself is light. Passing these terms through without any scrutiny, or contradicting them, has the potential to adversely affect site operations.

For this reason, it is necessary to provide an inquiry process, and to set up a system for storing the information so that the site operator or the administrator can make a final decision on the expression corresponding to the inquiry process so that the information can be browsed. Is valid.
In this way, by providing the information that has been subjected to the mechanical primary analysis processing to the administrator, it is possible to perform complex processing efficiently and without omission, thereby enabling more detailed security management and site management.

The analysis processing result of
As a result, the processing becomes continuation or forced exclusion 84. , Are analyzed, the presence or absence 85 is determined, and the processing continues 80 regardless of the presence or absence.

Of the data determined to be continued,
Data having a content that conflicts with
If not rejected in the process of FIG. 17, the data is discharged to the site or transmitted as an e-mail. At that time, a record of the process is stored in a form that allows the administrator to view the process. 86 (see FIG. 15).

Thus, it is possible to entrust the administrator who browsed the saved content 86 later to determine whether or not the content can be posted.

That is, with respect to the written contents including the expression requiring caution, the posting may be temporarily suspended, and the posting or refusal of the posting may be made after confirmation of the manager. In addition, it is also possible to classify the two and to combine them according to the degree and nature of the expression requiring caution. For example, a post containing a certain cautionary expression is first posted and then re-checked, whereas a post containing another kind of cautionary expression is first suspended and then decided to be allowed or not. Is also good.

The record left in the storage 86 is referred to the judge of the manager if necessary. FIG. 15 shows the flow of the restoration process. As shown in FIG. 15, a case where the administrator accesses and browses the stored data and a predetermined reference (as needed, per time, per stored data amount, etc.)
Is performed by automatically transmitting the data, and according to the judgment 77 of the administrator, “applicable” or “not applicable”
Is performed, and in the case of “not applicable”, the restoration process 7
By 8, the processing is continued 80.

On the other hand, if the content does not conform to the purpose of the operation even by the judgment 77 of the manager, it is judged that “correspondence exists” and the forced exclusion 79 is performed. At this time, a record of the processing is stored 86 in a form that allows the administrator to view the record again.

Further, by notifying the user of the forced exclusion, the user may recognize that the processing has been stopped. Note that this notification is made by any means such as characters, images, or sounds.

Further, in the method of suspension, it is also possible to use only the relevant part in blanking. For example, if there is a cautionary expression “XYZ”, the writing “I am XYZ today” is partially written as “I am today (leave blank).” Or “I am today.
○○. ", And it may be determined whether the original expression is returned at the discretion of the administrator, left blank or symbolized, or the entire entry is deleted. .

The details of the "word (term) collation processing" will be described below.

(I) Word (term) collation processing is a process in which “combined words (including character strings and symbols)” are regarded as “one data” and “collation comparison” is performed from the message text. Show. For example, when processing data such as "Let's act as a secret to your wife", in word matching processing, you need to register "Wife", "Secret", "Secret", "Action", etc. in advance There is. When each "pre-registered word (term)" matches, it indicates that the data is processed.

In the (II) system, “deletion target = existence of word (including character string and symbol)”. Therefore, as long as a word (term) exists, an equality expression is established, and the data is subject to disposal. However, in practice, any of the above words (terms) is a commonly used word (term). Therefore, it is not preferable to register these words (terms) in the “word (term) collection”.

(III) Next, the following writing example will be analyzed. I want to exchange emails with XYZ fans (assuming XYZ is a specific popular group name). In this case, assuming that the adult term is XY, if "XY" is registered in the glossary, and if the written content contains XY, it is processed as a deletion target. For this reason, there is a drawback that the presence of the corresponding word is regarded as a “target” and processed. The biggest drawback of the glossary reference system can be summarized as follows. The term dictionary (vocabulary) becomes very large The verification process takes a very long time Many mistakes This many mistakes means that you cannot check dangerous content composed of secure vocabulary, Is included, a sentence not originally targeted for exclusion is excluded.

Thus, phrase analysis is important. Hereinafter, “phrase (connection) matching processing” will be described. In the present invention, the phrase indicates "correlation between character strings of simultaneous words (terms)" and the like, and processing is performed from the connection of the words. (1) For example, consider the case of data processing of “let's act as a secret to your wife”.

The above sentence is decomposed as follows. 1) "Wife" 2) "Secret" 3) "Secret" 4) Decomposed into "act", of which "" Wife "~" Secret ""
Is analyzed. In the system, the equation "deletion target = 1) +3)" is made, and when the equality expression holds, a computer processing (prohibition) instruction is issued. At least, the phrase "secret to his wife" can be said to be infinitely suspicious. Therefore, in the phrase matching process, this data can be processed (prohibited).

(2) Further, in the phrase collation processing, the ending of a word (term) can be analyzed. For example, if the adult term “XY” is used, “XY” is not targeted, but “XY”, “XY”, “XY”, “XY”
"XY", "XY", "XY", "XY", "XY"
Only cases involving particles, auxiliary verbs, conjunctions, punctuation, symbols, etc., such as "XY.", "XY.", "XY,"... In fact, almost all sentences that speak “XY” are used in such a combination.

(3) For example, in the case of the above-mentioned character string “I want to exchange mails with XYZ fans happily”, 1) XY + inflation data (ha, ga, ga, ni, ga,
Since the above example is not collated with the inflection data, it is system-processed as “deletion target = (1) + inflection data”. In the above example, the equal sign does not hold, so the phrase collation processing Now, this data is processed (prohibited)
It cannot be targeted. Since only the term (word) includes the adult term “XY”, the above example is processed as a deletion target.

(4) It is also possible to increase the number of dictionaries (vocabularies) as a “glossary” or the like so as not to make the above-mentioned deletion targets. It is necessary to "register" and the data capacity becomes extremely large. The number of data in the case of phrase matching is “XY + ending data”. That is, the data capacity to be collated is dramatically reduced, and the collation processing is inevitably faster. In addition, as the processing speed is improved, there is room to include more subtle expressions or expressions that are rarely used in the target range, and the accuracy of processing can be dramatically improved. As for the number of data in the case of term collation, since it is necessary to register all inflections in the example of XY, the data capacity becomes extremely large. That is, the processing becomes slow.

(5) For example, if it is assumed that there is a four-character dangerous vocabulary of "ABCD", it is called "Hiragana".
2 × 2 × 2 only with the possibility of being written in a mixture of “Katakana”
× 2 = 8 patterns. If it becomes possible to intersperse symbols (standard 18 types) in a character string of 25 characters, (25-4) x (25-4) x symbol (18 types) 2
It becomes a tremendous number of 1 square. The number of processings (steps) of the computer collation is also ∞ processing. Therefore, in such a case, the dictionary data (glossary) has a huge capacity,
The processing speed is almost impossible, rather than very slow.

On the other hand, if the number of these characters is reduced to a range that can be processed, the above-mentioned malicious user is easily passed.

Furthermore, if the character string is still 10 characters, for example, (10−4) × (10−4) × 18 to the sixth power = 816,293,37
That's a tremendous number of six. If this is applied to all prohibited words, it is impossible to realize an environment in which a computer operates in a realistic manner.

(6) An example of phrase processing of the language analysis system according to the present invention will be described below. It is assumed that a dangerous vocabulary as a term (word) is a vocabulary having a character configuration of “XY”, “ABCD”, and “αβγ”. “A… B ☆……… ☆ C… D =… ○ X… ＠ ☆… Y… ☆ *… Z… △ α… □… β ☆……… γ Become like 1) A 6) X 10) α 2) B 7) Y 11) β 3) C 8) Z 12) γ 4) D system processing (1) + (2) + (3) + (4) = “ABCD” (6) + (7) + (8) = “XYZ” (10) + (11) + (12) = “αβγ”

Since “ABC”, “XYZ”, and “αβγ” are defined as “forced exclusion targets” in this system,
Processed correctly as a cancellation target.

Since the number of computer processing is very small, the processing is very fast. In addition, it is also possible to comprehensively capture a clever trick such as putting a hidden character between the faces (for example, "Ss"). So, technically there is a clear difference,
It can be said that it is dramatically superior.

As the contents of the text, "A" and "*"
For example, a message having an extremely small number of characters (or symbols), such as a message, has no content as a message, so that writing with a certain number of characters or less can be excluded or need attention. Similarly, writing exceeding a certain number of characters can be excluded or subject to caution.

[0130] For a "random character string" which has no meaning and is displayed when a random input is performed using an input means such as a keyboard, for example,
This may not be regarded as legitimate writing, but may be excluded or require caution. For example, for a data group in which a certain number of terms that are generally considered to be frequently used and do not violate the purpose of operating a website are inquired about the written contents, It is also possible to analyze the ratio of the corresponding characters and determine a character string having a certain ratio or less as "random writing" or "abnormal writing".

However, in the analysis of only the description contents, it is possible for a dangerous user to “repeatedly access”, and it is inevitable that a “security hole” will be pierced by a gap in a banned glossary. A user management system described later fills this security hole and realizes more luminous safety. As a result, more advanced management can be performed. Hereinafter, the contents of the user management system will be described with reference to the drawings.

FIG. 16 shows an outline of the user management data processing. As shown in FIG. 16, a malicious user is specified based on header information etc. (IP address, browser version, model information, host name, PROXY, etc.) 87 attached to the user data, and the information is identified. The stored data file is provided, and the information of the user is referred to the user management data reference 88 to identify whether or not the service is stopped. When the forced exclusion applies, the forced exclusion (exclusion) 89 is performed, and all services are stopped immediately. Also, a "notification of unauthorized use" can be displayed to the user as necessary. There are roughly two types of exclusion methods. One is a method of inquiring the electronic information (described above) attached to the data with the contents of the database. The other method is to record identifiers such as cookies on the terminal of the malicious user, and encourage the user to stop using it next time. Either method can be fine-tuned, such as determining the expiration date of the exclusion. In addition, all user information, whether malicious or not, can be recorded here. Thereby, it is possible to grasp the trend of each user.

A sample management data of user information is shown in FIG.

[Explanation of Terms] The mail address refers to an e-mail address. The IP address is 123.123.1
This is a terminal number on the Internet consisting of "4 segments of hexadecimal number (maximum of 3 digits separated by dots)" such as 2.123. The above three segments are allocated to “service site origin” such as a provider, and a fourth segment described later becomes a user number, and is allocated each time a line is connected. This means that "provider"
, The top three segments are always the same
This means that “provider analysis” in the user management system of the present invention is referred to. The personal computer identifier includes a browser name, an OS name, a personal computer name, and the like. Generally, the mozilla code is used by a Web server to determine this, select appropriate HTML data in response to a user's access (screen display request), and compose a screen. It is one of the information.

In this system, such information is used for user management inquiry processing. For example, in the case of a telephone connection place (dial-up provider) installed in a certain area of a certain municipality, the assigned IP address is determined as, for example, 210,234.152.1-1210.234.152.255. Can be determined. If a dangerous user accesses from this area, the user can be specified by matching the top three segments of the IP address number with the terminal information (described above). In the same region, different users have the exact same PC model, browser version, mozzy code, and provider "exact match"
There is very little to do. Combination of upper 3 segments of IP address = 255 x 255 x 255 = 16,581,375 ... (A) OS and hardware type (current 16 or more) x browser version (current 15 or more) x mozilla code (current 12 or more) x provider (Currently 8 or more, such as providers that distribute and provide browsers) = 23,040 or more (B) Therefore, A x B = 382,034,880,000 or more.

That is, the possibility of coincidence is 382,034,
There is a ridiculously small probability of 1 in 880,000.
Of course, in reality, there is a problem of the share of the browser and the OS, etc., and the probability is higher than this. However, even in consideration of the above, the above method which does not come out of the estimation range in principle However, it can be said that there is no danger that an innocent user who has practically the same specific ability as confirmation and does not recognize himself will be unable to use a malicious user with the involvement of a malicious user.

Further, since these data are described in “censorship data” which is read by an administrator who has been given the authority to read through appropriate authentication, the staff reads the data visually and makes a final decision. After that, a mechanism for registering in the user management data (black list) can be easily taken.

It is easy to perform various analyzes on the censored data, such as word order, time order, and registered content order (in the case of a registration-type site, various attributes included in the site), thereby making it possible to inadvertently mistake Can be used to determine whether a person has entered a dangerous word or a malicious person.

[0139] Since the system can realize the use restriction from the route information and the like, it goes beyond mere language analysis.
Higher security is ensured.

[0140] Spam refers to a user or an organization that sends mail to an unspecified number of people regardless of the intention of the recipient. There are two main methods of spam activity on websites. Interception of personal e-mail addresses posted on electronic bulletin boards. In this way, the addresses to send e-mails are collected. The act of infiltrating or using a mail server as a stepping stone to transmit e-mails and send out large amounts of e-mails as if they had been sent by the site owner. This is an activity that uses non-discriminatory mass sending of mail, the core of spam, using other sites while keeping the sender's source confidential. In particular, in a bulletin board system that is not closed to an email address, it is a good victim of spam.

As described above, the prior art has not proposed means for effectively preventing such antisocial activities.

As a practical problem, there is a case where a user is identified by laying out a membership registration system. However, this method eliminates users who dislike registration and narrows the frontage of the user. There are disadvantages in operation, and even if fake information such as name or e-mail address is registered, there is no way to judge it, so it is easy to go through a security hole.

In this system, information can be obtained in advance from the spam alert information source (Spam Cop) or the like, so that damage can be suppressed before it occurs, and user management by the above-described electronic processing (unmanned) can be performed. By registering the address and the like of a new intruder after early detection, it is possible to eliminate automatically and efficiently. Since member registration is not required, there is no adverse effect of narrowing the user's frontage.

FIG. 17 shows an outline of the mail address data processing. As shown in FIG. 17, by a prior registration system, etc.
If the address is known and the processing data also has the address information, this processing can be used. Unlike the processing steps of FIGS. 15 and 16 described above, this processing is not always possible for all information. By referring to the e-mail address, identification judgment is performed from the past history as shown in the figure.

Although the mail address data processing is separated from the user management data processing in order to promote the understanding of the system, these may be integrated. It is possible to protect the site beforehand by entering a malicious user email address into this data using a list of malicious users, etc., based on past cases, information on preliminary investigations, etc. in advance.

FIG. 18 shows an outline of data formation into a mail format.

FIG. 18 is an enlarged view for explaining the process of data conversion to the mail format and its transmission in FIGS. 10, 12 and 14. Input text data (mail text data) 95 and accompanying data (access analysis signal from a web server or the like) 87 that have passed the above-described analysis processing are converted 96 into an e-mail format and sent 97
Is done. At this time, the following processing can be added in order to enhance the security function of the site that has become the window for sending the mail.

The header information (IP address, browser version, model information, host name, PROXY, etc.) 87 accompanying the user data described with reference to FIG. 16 is synthesized by the mail text data 95 and the data synthesis processing 98. You can also. By performing the data synthesizing process 98, the receiver can also use the information in the event of any damage by the sender (for example, when the sender is slandered by a delicate expression that is difficult to analyze). This has the effect of identifying the other party and becoming a valuable information source for taking measures to prevent the spread of damage. This is particularly effective for a mail containing a cautionary expression (in the explanation of FIG. 15). FIG. 19 shows an example of the mail thus synthesized. At the time of sending the e-mail, the sender's e-mail address is inserted using CC (carbon copy) or BCC (blind carbon copy) during destination processing so that the sender can confirm the contents. It is possible to

FIG. 20 is a diagram of the user management data.
FIG. 17 is a sample display of examples of data used and formed in the process of performing the user management data processing of FIG. 16 and the result. “ID” in the drawing is an identification code assigned in a data unit unit in the data processing process. The “site ID” is, as described above, an identification code of an inquiry requesting site. As a result, the content of the analysis process can be customized, and the administrator of each site can access only the user information of the own site in the system. The “prohibited words”, “prohibited phrases”, “words requiring caution”, and “phrases requiring caution” indicate expressions that have been queried and matched in the explanation of FIG.

FIG. 21 shows an example of a censored data list. 9 is a list of censored data used by a site administrator to confirm writing that has been excluded or requires caution. Various methods such as time order, handle name order, and route information order are possible for display, and the administrator can devise and examine the display method to show signs of potential dangerous users and unique characteristics of malicious users. It becomes easier to find information that helps to realize higher security by finding phrases and the like.

FIGS. 22 to 26 show examples of screens used when the manager manages site users in the manager terminal 100 shown in FIG. FIG. 22 shows a login screen of the administrator. FIG. 23 is a screen of an example of a censorship check. 24 to 26 show list screens for content analysis.
The display target is changed according to the genre in the site and the level of the analysis level, and the display order is further rearranged according to the content order, the registered attribute (name, region, gender, etc.), the browser order, the IP address order, and the like. However, the present invention is not limited to these drawings. This facilitates analysis and analysis for the administrator deletion process in FIG.

As described above, according to the present invention, the data to be analyzed sent from the user to the website is once transferred to another site, analyzed there, and then sent back to the site. According to the purpose, the data content can be analyzed and the result can be notified to the site.
In this way, for example, by creating a site specialized in censorship of malicious writing and connecting it to each site, the writing at each site is immediately transferred to the site, and after an instant censorship operation by computer, Only those posts that have passed that censorship can be returned to the original site. In this case, the writing determined to be malicious is deleted according to its degree, or stored in a form that allows the site administrator to browse. In the latter case, it is up to each site operator to determine whether it is within the allowable range.However, since the site has already undergone general censorship and has been marked, The operation effort of the company is significantly improved.

The analysis (censorship) is performed not only by the written contents but also by analyzing the address of the transmission source, so that even if the address is on the blacklist, it can be deleted or warned. it can. As a result, a malicious user impersonating a general user can be eliminated.

In addition, when judging whether writing is appropriate or not, not only general criteria but also individual taboo vocabulary and the like can be registered in the site, and censorship can be performed for each site according to individual circumstances.

Further, by creating a database of objects to be deleted or warned, a database of black information in units of addresses or various access signals is constructed.
Will be available.

For the site, the advantage can be enjoyed by outsourcing the analysis (censorship) work in this way. First, the management work becomes easier, which leads to a reduction in labor. Second, since it is not necessary to build know-how such as black information on its own, labor and investment can be reduced accordingly. Third, it is possible to prevent the loss of credit and the decline in popularity due to malicious writing and the like, which can be expected in the trial and error period before constructing the censorship know-how, and minimize the economic loss and the like associated with it. Fourth, the sharing of black information by outsourcing makes the database enormous and sophisticated,
The know-how that cannot be obtained by building alone is formed, and it can be used. Fifth, as a side effect of the fourth merit, anti-social activists can contribute to the elimination of acts of vandalizing various sites throughout the Internet society. This is an advantage that cannot be gained by securing only a single site, and the benefits can be enjoyed by the entire Internet society.

In the system of the present invention, only information written by a user in a bulletin board on the website 2000, a service such as a chat, a forum, or a web mail is sent to the system of the present invention and subjected to an analysis process. The result is sent to the web page, but since the series of processing steps is performed instantaneously, the eyes of the user are not given any real feeling other than using the web site. As shown in Fig. 1, even in the case of once undergoing the process of transfer, analysis, and return via the Internet, it can be used by ordinary users without any real feeling that such a process has been performed. It is. From the point of view of the website management side, it is possible to provide safety with little effort without making the general user feel uncomfortable at all.

As shown in FIGS. 5B and 5C,
It is also possible to adopt a mode in which only the writing screen is distributed from the system of the present invention. In this case, the screen transmitted from the system of the present invention fits into the frame of the screen provided by each site, so to speak,
Actually, what is entered in the entry field according to the system according to the present invention is transmitted as a result to the screen transmitted by the website through the series of processing steps described above. Even in such a case, the general user has no real feeling that such a processing procedure has been performed, and does not feel uncomfortable.

This method is superior to the data distribution method shown in FIG. 1 in that the consumption of the line capacity that occurs when the pattern shown in FIG. 1 is employed can be suppressed. FIG. 5A shows the method shown in FIG. 1. In this method, the data of the write access 21A sent from the user terminal 001 to the website 2000 is transferred to the security system 1000, where the analysis is performed. Then, the analysis result 21 is returned to the website 2000. Therefore, the load on the dedicated line connecting the website 2000 and the net 11 is tripled by simple calculation.

On the other hand, in the method shown in FIGS. 5B and 5C, the general browsing screen is distributed from the web site 2000, so that the web site 2000 is accessed only at the time of browsing access 21:00. is there. Since only the writing screen (the entire page or a part thereof) is distributed from the website security system 1000, the flow of the writing data is in the order of the user terminal 001 → the website security system 1000 → the web site 2000. The above line is subjected to only the same load as when direct writing is performed from the user terminal 001.
This feature is a great advantage when the line capacity is limited or when access is concentrated. In addition, the processing contents of the server become easier. Therefore, a security system based on language analysis can be introduced even at the same processing speed as in the past, and there is no burden on capital investment of the server.

The service can be performed not only as an outsourcing service but also within the same site or the same corporation. Also, physically, as a part of the hosting service provided by the hosting company, it is also possible to perform the service in the same server device group. In the prior art, only checking was performed by matching words with a glossary, but in the present invention, in addition to this, management by phrase analysis is performed. This makes it possible to censor unfavorable expressions.

Here, in the case of a character string such as the above-mentioned prohibited vocabulary, term, etc., it can be processed. This processing means that in a prohibited word (phrase) or a word requiring attention (phrase), only the character string is left blank or symbolized (xx, etc.) so as not to cause discomfort in the content expression. That is. This allows
Since the description does not include a character string that causes discomfort, the description may be in accordance with the purpose of the site.

In this case, the writing is not an object of deletion or the like, but troubles can be avoided because only expressions having a dangerous meaning are deleted and displayed. For example, if there is a statement saying "Konju, I will kill you if you say that,"
", Say that," or "○○○○,
If you say such a thing, only ○ is displayed. This is thought to be particularly effective in chatting.

Also, if this method is adopted, even if the originally safe content is abandoned and determined to be excluded, only the relevant word (or phrase) is subject to deletion or encoding, so that the general intention is eliminated. Communication can continue. Therefore, inconvenience that a well-meaning user may suffer can be minimized.

[0165] In addition, in the case of performing processing such as conversion into a hidden character, a warning to the user in advance such as "Because a prohibited word is included, the word is blanked out (coded)." Can also be used to encourage retraction or rewriting.

Further, since the present invention has a concept of user management, not only individual written contents but also users who transmit the written contents can be managed, thereby further improving the security level dramatically. Can be. As a part of user management, it is a system that can identify malicious writers by path analysis. Therefore, by registering these malicious users in a blacklist, higher security can be secured. In turn, this can contribute to ensuring the security of the entire Internet society.

In addition, conventional techniques (for example, Japanese Patent No. 29513)
In this method, the manager is notified by e-mail or screen display every time there is one malicious or cautionary note. However, this method uses the continuity and regularity of malicious writing. There is a problem that the writing user's personality, such as inadvertently writing or light mischief, or paranoid or habitual harassment, is difficult to read. On the other hand, according to the present invention, a management method in which malicious or cautionary writing is displayed in a lump is adopted, and these are variously sorted in order of time, gender, region, IP address, handle name, and the like. Since the data can be recalculated and displayed, subtle regularities and the like can be read from the data, and information useful for subsequent management can be easily obtained.

In the present invention, the mail address, the IP
Addresses, PC identifiers (terminal information), host names, route information, etc. can be used to reject dangerous users the next time they access the system before invading the system, as well as identify the data requester (user). It is possible to provide a system that makes it easy to identify a culprit even when it occurs.

Further, by registering in advance “host information” and “IP address” disclosed by Spamcop, etc., it is possible to prevent spammers from entering the system. This leads to prevention of e-mail address interception of users posted on the posted data (bulletin board), refusal of spam users to use the system, and recording of information (terminal information) analysis of spam origin users, and further security. Contributions are expected.

According to the present invention, the administrator checks the written contents by browsing without giving a warning by the notification method. The advantage will be described below.

A. Here, the difference between notification and browsing will be described. In the case shown in FIG. 3, information is transmitted from the security system 1000 to the terminal 100 of the manager, and the manager receives the notification. In contrast, browsing accesses information stored in the security system 1000 from the terminal 100 of the administrator who has been given the authority to view the information through an appropriate procedure. , To browse the contents. Although the two are common in disclosing data, there are distinct differences in the way data is stored, where it is stored, and other aspects of the customer in obtaining information.

B. The disadvantages of the notification will be described below. (1) In the case of the notification, there remains a problem that it is difficult to confirm whether the notification has been sent from the website security system 1000 to the administrator. Particularly in the case of e-mail, the evil is significant. In contrast, in the case of browsing, the website security system 1000 can clearly confirm by analyzing the access log. Therefore, it is possible to prevent a dispute between the security system side and the manager side over "damage caused by the fact that the information to be originally disclosed was not disclosed to the manager".

(2) In the case of notification, it is difficult for a manager to independently process and analyze information. The notified data is
Since screening must be performed already at that point, even if they are stocked and analyzed, they are only analyzed for secondary information, so to say, the same as analysis that collects only statistical analysis results, so to speak, accuracy Analysis cannot be performed, and the value of the obtained information is low. In this regard, in the form of browsing by access from the manager, since all information related to the website is always open in the security system 1000 in principle, the “history”,
"Ip address", "date", "time", "model name",
"Browser version", "Host name", "By term category", "E-mail address", "Link source information",
By sorting and rearranging various information such as “transmission data amount” as classification items and analysis targets, it is possible to extract various analysis data obtained only from raw primary information.

[0174] The selection of the notification contents can be performed by
The most familiar with or should be familiar with 00 and its user characteristics is its manager, who should present an environment where they can freely analyze and process information based on their own know-how. Is desirable.
Depending on the characteristics of the site and the specific circumstances at that time, what information should be extracted changes, so there is an opportunity to freely access as much information as possible and without discretion by a third party. Is considered to be extremely important to publishers and administrators. For example, when it is desired to grasp the trends of malicious users who have entered using subtle expressions, it is necessary to analyze the behavior before and after (it is not always the case that only malicious writing is performed). There is also a trend that these "normal" data will be exposed for the first time by being analyzed in the same row as malicious writing, so a system that provides only data that lacks them will require a site management skill. This is because there is a fear that it will hinder its performance.

(3) In the case of notification, there is a problem in terms of security. The notification takes a form in which data is temporarily stored in the server and read out from the administrator terminal, except in a special method using the private LAN. Therefore, when the server has a public character such as a provider, data is easily intercepted. The longer the time it has been stored by an unrelated third party, it means that it is relatively vulnerable during that time. All notifications made during the absence of the administrator, such as late nights and holidays, are asleep on the server. Also, in the case of notification by e-mail, in particular, since all copies are transferred to the relaying server and the copy remains, there are many problems from the viewpoint of security.

The contents of the notification (= part of know-how) are the security systems that are required to deal with malicious users who are familiar with electronic technology commonly called site crackers.
Needless to say, it is necessary to avoid the risk of leakage.

In this respect, in the case where the administrator browses the database of the security system as needed, the administrator terminal and the security system are directly connected only at the time of the browsing. Not stored. This is similar to the case where data stored in the security system is stored on the server of the provider, but the situation is similar, but the information is leaked only because it is managed centrally. However, there is a merit that it is easy to identify the source and pursue responsibility.
Also, due to the nature of the security system, a system for strictly recording access histories, etc. has been established, so even in the event of illegal information acquisition, it is much easier to track down the culprit than in other cases. . Using the user management know-how, it is also possible to tighten the authentication of the manager.

(4) When the notification amount is enormous, various problems occur. When a malicious user writes maliciously in succession using an auto-complete function (for example, a function that automatically writes the part of a sentence and writes the rest automatically), or multiple users write maliciously at the same time (This is a phenomenon that is common during times of heavy use of the Internet.) In the notification method, these are reported each time, but this increases the damage in the following manner. Risk

The line and the processing capacity are punctured. There is a danger that the business will be aborted due to exceeding the processing capacity of the line and the security system. At least, increased line consumption is the decisive disadvantage that leads to delays in the operation of the security system, and providing extra line capacity in preparation for sudden large-volume data transmission leads to extremely high costs. . On the other hand, distributing and leveling the notification amount in order to narrow down the line capacity impedes flexible management work, and denies the reason for the existence of the security system itself.

There is a risk of exceeding the capacity of the recipient's server, which can have a destructive effect similar to a substantial mail bomb. A large amount of electronic information such as notification mail is sent to the administrator terminal, but if the number or capacity is too large, there is a risk that the information will be rejected by the recipient server. Even if not rejected, if hundreds or thousands of pieces of information come in at once, the same operational paralysis as that caused by the mail bomb will be caused. Essentially, notices that should help the operation have the opposite effect of paralyzing the operation.

Important information is buried. If the amount of information sent is too large, the effort required to analyze it and use it for operations will be enormous. For example, if one malicious user continuously makes a huge amount of malicious writing, during which a beginner inadvertently uses malicious expressions by mistake, or once the next malicious addict reserve army visits the site once Information such as only maliciously written information can be useful as valuable information for the operation of the site,
A problem may occur that the information is buried in a huge mountain of information and leaks from the analysis target as a practical problem.

There is a risk that the notification system itself may be targeted as a security hole as a target of a site cracking action. Problems such as these should be referred to as security holes that directly lead to operational paralysis, rather than malicious writing itself.
There is a problem that malicious criminals aiming at such a paralysis of the operation are targeted.

These problems are caused by the browsing system.
It does not exist in the first place or can be easily dealt with. In the cases described above and above, the amount of line usage depends on the number of administrators who have come to browse, so if the line width is set accordingly, such a puncture will not occur, and the administrator terminal or There is no puncture on that line. In the cases described above and above, since the line usage depends on the number of managers who have come to browse, if a line width corresponding to that is secured, such a puncture state does not occur and the manager terminal And the line doesn't go flat.

In the cases described above, since only the analysis command and the result are transmitted and received, the exchanged data is extremely small. For example, only the variables that fit into the equations and their solutions are sent and received, and the amount of line usage is very limited, making the line much more efficient than just transferring the relevant data. And a situation such as a line puncture can be avoided. Of course, there is no puncture of the administrator terminal.

In the case of (1), the user can be specified by the written contents, the IP address, the host name, the browser information, the cookie, etc., so that the batch processing is possible. It is easy to observe information without omission. In the case of the above, there is no occurrence of the problem itself for the above-mentioned reason, so that it cannot be targeted for cracking.

The above problem can be easily solved by using the user management technique. By specifying the user and making it the exclusion target, the same person can be prevented from continuously performing malicious writing, so that the amount of writing to be viewed or notified in the first place does not increase extremely. Therefore, the phenomenon that the line is clogged,
A phenomenon in which the data becomes enormous and analysis becomes difficult can be prevented beforehand. Of course, it is logically possible for a number of malicious users to perform malicious writing in large numbers, but in reality it is extremely rare, and if it is excluded as a black target after only a few writings Even if 100 people succeed in three times of malicious writing at the same time, only 300 are written. Moreover, since they are denied any writing afterwards, malicious users dominate the world,
It is considered that the above-mentioned problem does not occur unless a specific attack on a specific site occurs. On the other hand, in a system without user management, even a single person can perform tens of thousands of writes in a short time, and the above problem occurs.

(5) It is difficult to rotate a plurality of administrators. In the case of the notification, only a registered party can be notified, so it is difficult to change suddenly. In addition, in the case of notification, for example, in the case of a five-person shift system, if all members are notified, the number of omissions is small, but at the same time there are many duplications,
There are many problems. In addition, the line and server processing capacity are also consumed five times. To avoid this, it is possible to set the replacement timing in advance in the security system, but in this case, it becomes impossible to analyze the tendency of actions performed over the turning point. In addition, there is a drawback that operations are easily disrupted by unscheduled actions between managers.

In the case of browsing, it is easy to respond to sudden changes on the administrator's side, and if a security system is provided with a mechanism for displaying the browsing history, business takeover can be performed very efficiently and without omission. be able to. When browsing,
Even when a plurality of managers operate and manage the same site by time of day, by day, etc., it is easy to take over the business. Responses to sudden changes and transfers are smooth.

As described above, the browsing system is much better than the notification system, and the security system having this browsing system is more efficient.

[0190]

As described above, according to the present invention, not only electronic bulletin boards but also forums, chats, mails, I
CQ, messaging software, web TV, web TV
By writing websites such as phone calls, etc., using sophisticated terms or website phrase analysis such as sentence phrase analysis, etc., mischievous or harassing writing malicious terms, dirty words, abusive words, etc., in line with the purpose of the site management It is possible to provide a website security system capable of developing an out-of-place business activity or eliminating those that use the benefits of individuals or specific groups.

[Brief description of the drawings]

FIG. 1 is a schematic diagram of a network connection diagram of the present invention.

FIG. 2 is a schematic diagram of a network connection diagram of the present invention.

FIG. 3 is a diagram showing a form in which an administrator terminal is connected to a website security system via an Internet network.

FIG. 4 is a view showing a form in which an administrator terminal is directly connected to a website security system via a private LAN or the like.

FIG. 5 is a schematic diagram of a network connection diagram of the present invention.

FIG. 6 is a flowchart of information processing according to the present invention.

FIG. 7 is an enlarged view of a system area in FIG. 6;

FIG. 8 shows a schematic diagram of a network connection diagram.

FIG. 9 shows a schematic diagram of a network connection diagram.

FIG. 10 is a data flow diagram of the present process.

FIG. 11 is a diagram showing a data processing process of write data to a “bulletin board” on a website.

FIG. 12 is a data processing diagram of write data for “mail” on a website.

FIG. 13 is a diagram showing a data processing process of write data for “chat” on a website.

FIG. 14 is a detailed diagram of various data analysis processing steps which are the backbone of the website security system.

FIG. 15 is a schematic diagram of language analysis data processing.

FIG. 16 is a schematic diagram of a user management data process.

FIG. 17 is a schematic diagram of mail address data processing.

FIG. 18 is a schematic diagram of forming data into a mail format.

FIG. 19 is a diagram illustrating an example of a synthesized mail.

FIG. 20 is a diagram illustrating an example of user management data.

FIG. 21 is a diagram showing an example of a censored data list.

FIG. 22 is a diagram showing an example of a screen used when managing site users.

FIG. 23 is a case diagram of a screen used when managing site users.

FIG. 24 is an example of a screen used when managing site users.

FIG. 25 is a diagram illustrating an example of a screen used when managing site users.

FIG. 26 is a diagram showing an example of a screen used when managing site users.

[Explanation of symbols]

 11 Communication network such as Internet communication 2000 Web site 001 User terminal 1000 Website security system

Claims (29)

[Claims] 1. An information analyzing means including a user terminal and a server system capable of communicating with each other through a network, analyzing information described in a written original sent to the server system, and Management means for managing the analysis result; if the written content of the written original is appropriate according to the content analysis, the process is executed as it is; on the other hand, the written content of the written original is ineligible or invalid A website security system wherein, if appropriate, the posting process is stopped or the content of the description is processed. 2. The website security system according to claim 1, wherein the information analysis means analyzes a sender profile and the like. 3. The website security system according to claim 1, wherein said information analysis means is connected to a website without passing through a network. 4. The website security system according to claim 1, wherein said information analysis means is connected to a website via a network. 5. The website security system according to claim 1, wherein said management means is connected to a website without passing through a network. 6. The website security system according to claim 1, wherein said management means is connected to a website via a network. 7. The method according to claim 1, wherein the writing target of the writing original is an electronic bulletin board, a forum,
A website security system characterized by chat, mail, ICQ, messaging software, web TV, web TV phone, and the like. 8. The website security system according to claim 7, wherein a writing target of the writing original is a web-based mail. 9. The website security system according to claim 8, wherein a mail sending unit is provided in the information analyzing unit. 10. The website security system according to claim 1, wherein the information analyzing means analyzes the information by character string analysis. 11. The website security system according to claim 10, wherein the character string analysis is a prohibited character string analysis. 12. The website security system according to claim 10, wherein the character string analysis is a cautionary character string analysis. 13. The website security system according to claim 1, wherein said information analysis means analyzes by phrase analysis. 14. The website security system according to claim 13, wherein the phrase analysis is a prohibited phrase analysis. 15. The website security system according to claim 13, wherein the phrase analysis is a cautionary phrase analysis. 16. The information analysis means according to claim 1, wherein said information analysis means comprises at least two or more combinations selected from use-inhibited character string analysis, cautionary-character string analysis, use-inhibited phrase analysis, and cautionary-phrase analysis. Website security system characterized by analysis. 17. The method according to claim 1, wherein the processing is performed using a prohibited character string, a prohibited phrase,
A website security system characterized in that a sensitive string and a sensitive phrase are left blank or symbolized only in the character string or phrase. 18. The information processing apparatus according to claim 1, wherein the information analyzing means includes a mail address, an ID code,
A website security system characterized in that a user profile is specified by at least one of a P address, a HOST name, and information on a browser or a combination of two or more of them. 19. The server system according to claim 1, wherein when the content of the description or the sender is inappropriate or inappropriate, a message to stop or process the posting process is displayed on a screen of the server system. Website security system. 20. In claim 1, if the content or the sender is appropriate or qualified, the posting process is continued, and the mail address, ID code,
A website security system characterized in that at least one of a P address, a HOST name, and information on a browser or a combination of two or more of them is displayed on a screen of a server system, together with information on a posting process. 21. The method according to claim 20, wherein when the written content of the written original is in a mail format, a mail address, an ID code, an IP address, a HOST name,
At least one or two of the information about the browser
A website security system for transmitting written contents together with at least one kind of combined information. 22. The website security according to claim 1, wherein if the content or the sender is inappropriate or inappropriate, the posting process is stopped and the content is stored as information. system. 23. The website security system according to claim 22, wherein the stored content can be viewed only by a person having a viewing right. 24. The website security system according to claim 22, wherein the content stored only by a person having the reading right is processed or analyzed. 25. In claim 1, in the case where the content of the description or the sender is inappropriate or improper, the posting process is stopped or processed, and the notification is made by either text, image, or sound. A unique website security system. 26. The website security system according to claim 1, wherein when the description content or the sender is inappropriate or inappropriate, the posting process is stopped and the administrator is notified. 27. The website security system according to claim 1, 22, 25, or 26, wherein the suspension of the posting process includes suspension, and may be restored again. 28. A system including a user terminal and a server system capable of communicating with each other through a network, analyzing contents described in a written original sent to the server system, and managing an analysis result according to the analyzed information contents. However, if the described content or the sender is appropriate or qualified according to the above content analysis, the posting process etc. is executed as it is, while if the described content or the sender is inappropriate or inappropriate, Is a method of controlling a computer to stop or process the posting process. 29. An information analyzing means including a user terminal and a server system capable of communicating with each other through a network, analyzing information described in a written original sent to the server system, and A management means for managing the analysis result is provided, and if the written content or the sender is appropriate or qualified in accordance with the content analysis, the posting process is executed as it is, while the written content or the sender is invalid. A recording medium storing a program for controlling a computer so as to stop or process the posting process if the job is appropriate or inappropriate.