JP2009230663A - Apparatus for detecting abnormal condition in web page, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an apparatus for detecting an abnormal condition in a web page, a program, and a recording medium for reducing burdens on monitoring the web page. <P>SOLUTION: A link information extraction part 11d extracts link information indicating a link to other web pages from web page information stored in a web page information storage part 12. A web page information acquisition part 11a accesses a web server indicated by the link information to acquire the web page information. A track back spam determination part 11f calculates feature quantity of the web page on the basis of the web page information acquired by the web page information acquisition part 11a, and detects whether the web page is in an abnormal condition or not on the basis of the feature quantity. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a web page abnormality detection device that detects a web page abnormality. The present invention also relates to a program for causing a computer to function as a web page abnormality detection device, and a recording medium on which the program is recorded.

  A function that allows readers to add a URL (Uniform Resource Locator) of a blog related to the blog to a diary published on the Web (hereinafter referred to as a blog) (hereinafter referred to as a trackback) or comment There is a function to add. In recent years, attacks by trackback spam that adds annoying URLs unrelated to articles and comment spam that adds annoying comments to blogs have become problems.

The following five methods are generally used as a method for protecting track back spam and comment spam.
(1) Reject trackbacks and comments consisting of only single-byte alphanumeric characters, assuming an attack from overseas (see Non-Patent Document 1).
(2) Reject the trackback if the trackback source blog (blog linked to the trackback and the blog linked in one direction) does not have a link to the trackback destination blog (trackback added blog) ( Non-patent document 1).
(3) Assuming an attack by a tool that automatically posts a comment, pictogram authentication is performed when a comment is posted (see Non-Patent Document 1).
(4) Reject trackbacks and comments from prohibited IP addresses and prohibited URLs (see Non-Patent Document 1, Patent Documents 1 and 2).
(5) Reject trackbacks and comments that contain prohibited keywords (see Non-Patent Document 1, Patent Documents 1 and 2).
“Au one net Internet Guide”, [online], [Search March 12, 2008], Internet <URL: http://www.auone-net.jp/netguide/feature/020/0200208.html> JP 2007-265368 A JP 2007-115173 A

  However, in general, management of a blog is left to an individual user, and trackback spam and comment spam are not traced on a page of a user who does not perform the above setting. In particular, there are few users who set the pictogram authentication of (3) above. Further, when an attack is performed using various PCs as a stepping stone, there is a problem that the attack does not correspond to the prohibited IP or the prohibited URL described in (4) above. There is also a problem that trackback spam and comment spam due to terms that do not correspond to the prohibited keyword (5) cannot be prevented. Further, in the investigation by the present inventor, there is an attacker who describes a link to a blog of a trackback destination in a spam page, and there is also a trackback spam that bypasses the above (6).

  It is necessary to detect the attack as soon as possible, assuming that such spam cannot be completely prevented. Companies that provide blog services are forced to detect whether trackback spam or comment spam is generated by human eyes, and there is a problem that the monitoring operation requires enormous costs.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a web page abnormality detection device, a program, and a recording medium that can reduce the burden on web page monitoring. .

  The present invention has been made to solve the above-described problems, and includes information storage means for storing web page information (corresponding to the web page information storage unit 12 in FIG. 1), and the web stored by the information storage means. Link information extracting means (corresponding to the link information extracting unit 11d in FIG. 1) for extracting link information indicating a link to another web page from the page information, and a web server indicated by the link information are connected to the web page information. Based on the information acquisition unit (corresponding to the communication unit 10 and the web page information acquisition unit 11a in FIG. 1) and the web page information acquired by the information acquisition unit. Calculation means (corresponding to the trackback spam determination unit 11f in FIG. 1) and presence / absence of abnormality of the web page based on the feature amount calculated by the feature amount calculation means Detecting an abnormal detection means is abnormal detection apparatus of a web page, characterized in that a (corresponding to the trackback spam determination unit 11f of Fig. 1).

  Further, in the web page abnormality detection device of the present invention, the feature amount calculation means is based on the web page information acquired by the information acquisition means on the basis of a plurality of conditions indicating the characteristics of the web page. The feature amount is calculated.

  In the web page abnormality detection apparatus according to the present invention, the feature amount calculating means calculates the feature amount by weighting a plurality of conditions indicating features of the web page.

  Further, the present invention provides a first information storage unit (corresponding to the web page information storage unit 12 in FIG. 1) for storing web page information and a past information from the web page information stored in the first information storage unit. The information extraction means (corresponding to the link information extraction unit 11d and the comment extraction unit 11e in FIG. 1) for extracting the additional information added to the URL is associated with the time information indicating the update time of the web page information. Based on the second information storage means (corresponding to the link information storage section 13 and the comment storage section 14 in FIG. 1) and the additional information and the time information stored in the second storage means. Histogram generating means (corresponding to the trackback spam determining unit 11f and the comment spam determining unit 11g in FIG. 1) for generating a histogram indicating the appearance frequency of the additional information for each, An abnormality detection device for a web page, comprising an abnormality detection means (corresponding to the trackback spam determination unit 11f and the comment spam determination unit 11g in FIG. 1) that detects whether there is an abnormality in the web page based on the program. is there.

  In the web page abnormality detection device of the present invention, the information extraction unit (corresponding to the link information extraction unit 11d in FIG. 1) is configured to use the additional information from the web page information stored in the first information storage unit. As described above, link information indicating a link to another web page is extracted.

  In the web page abnormality detection device of the present invention, the information extraction unit (corresponding to the comment extraction unit 11e in FIG. 1) is used as the additional information from the web page information stored in the first information storage unit. A comment added to a web page is extracted.

  Further, the present invention provides an information storage means for storing web page information (corresponding to the web page information storage section 12 in FIG. 1) and a comment added to the web page from the web page information stored in the information storage means. A comment extraction means (corresponding to the comment extraction unit 11e in FIG. 1), a word included in the comment extracted by the comment extraction means, and a word included in a portion other than the comment displayed on the web page Comparing means (corresponding to the comment spam judging unit 11g in FIG. 1) and an abnormality detecting means (corresponding to the comment spam judging unit 11g in FIG. 1) for detecting the presence / absence of an abnormality of the web page based on the comparison result by the comparing means And a web page abnormality detection device.

  The present invention is also a program for causing a computer to function as the above-described web page abnormality detection device.

  The present invention is a computer-readable recording medium on which the above program is recorded.

  In the above description, the description in parentheses is for the purpose of associating the embodiment of the present invention described later with the components of the present invention for convenience, and the contents of the present invention are not limited by this description. Absent.

  According to the present invention, a word included in a comment added to a web page based on a feature amount of the web page, a histogram indicating the appearance frequency of additional information for each time, or a portion other than the comment Since it is not necessary to monitor the web page by human eyes by detecting the presence or absence of the web page based on the result of determining whether or not the word included in the word matches, it is necessary to monitor the web page The effect that a burden can be reduced is acquired.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of a web monitoring device (corresponding to the web page abnormality detection device of the present invention) according to an embodiment of the present invention. In FIG. 1, a web monitoring device 1 is connected to a web server 2 that manages a web page of a blog via a network 3.

  In the web monitoring device 1, the communication unit 10 communicates with the web server 2 via the network 3. The monitoring processing unit 11 periodically acquires web page information from the web server 2 and executes a monitoring process for detecting a web page abnormality. The web page information is information included in various files necessary to display the web page. In the present embodiment, the text base having extensions such as “.html”, “.htm”, and “.txt” is used. It is assumed that the information is included in the file. Specifically, the web page information is a tag of a web page description language (HTML or the like) or various information (text, URL or the like) included in the tag.

  The web page information storage unit 12 stores web page information acquired from the web server 2. The web page information storage unit 12 also stores difference information indicating a difference between two web page information acquired at two different times. The link information storage unit 13 stores link information indicating a link to the trackback source web page and time information indicating the update date and time of the trackback destination web page in association with each other. The comment storage unit 14 stores a comment added to the web page and time information indicating the update date and time of the web page in association with each other. The coefficient storage unit 15 stores coefficients used for weighting processing described later.

  In the monitoring processing unit 11, the web page information acquisition unit 11 a executes, for example, processing by a get command, accesses the web server 2 through communication processing by the communication unit 10, and acquires web page information from the web server 2. The page change detection unit 11b detects whether there is a change in the web page information acquired by the web page information acquisition unit 11a. A change in web page information is detected by detecting a change in the hash value of the web page information.

  The difference extraction unit 11c extracts difference information from the web page information before and after the change when the change in the web page information is detected by the page change detection unit 11b. The extracted information is stored in the web page information storage unit 12 as difference information. The link information extraction unit 11d extracts link information indicating a link to the trackback source web page from the difference information. The comment extraction unit 11e extracts comments displayed on the web page from the difference information.

  The trackback spam determination unit 11f determines whether or not the trackback added to the web page is due to trackback spam. The comment spam determination unit 11g determines whether or not the comment added to the web page is due to comment spam. The alarm processing unit 11h generates alarm information (e-mail or the like for notifying a warning) for issuing an alarm to the administrator of the web server 2 to call attention when trackback spam or comment spam is detected. To do.

  Next, the operation of the web monitoring device 1 according to the present embodiment will be described. FIG. 2 shows an operation flow of the web monitoring apparatus 1. After starting the process, the web page information acquisition unit 11a accesses the web server 2 through the communication process by the communication unit 10 and acquires a file including the web page information in order to acquire the web page information from the monitored blog. To do. The web page information acquisition unit 11a stores the acquired web page information in the web page information storage unit 12 (step S100).

  Subsequently, the web page information acquisition unit 11a determines whether the web purge information acquired in step S100 is the web page information acquired for the first time (step S101). If web page information related to the same web page has never been acquired, the process ends. If web page information related to the same web page has been acquired in the past, the process proceeds to step S102.

  When web page information related to the same web page has been acquired in the past, the page change detection unit 11b reads web page information acquired in the past corresponding to the newly acquired web page information from the web page information storage unit 12. The hash value of each web page information is calculated (step S102). The page change detection unit 11b compares the hash value of the newly acquired web page information with the hash value of the web page information acquired in the past (step S103), and based on the comparison result, the change of the web page information. The presence or absence is detected (step S104). In the above, the calculated hash value may be stored in any storage unit and used for the next comparison between hash values.

  As a result of comparing the hash values, if the two hash values are the same, the web page information has not changed. In this case, the process ends. When the two hash values are different, the web page information has changed. In this case, the difference extraction unit 11c extracts difference information that is a difference between the web page information acquired last time and the web page information acquired this time, and stores the difference information in the web page information storage unit 12 (step S105).

  The extraction of difference information is performed by executing a diff command. The diff command is a command for executing processing for comparing texts of two files and extracting portions of different texts. The text portion before and after the change is extracted by the diff command. In this embodiment, the text portion after the change is stored in the web page information storage unit 12 as difference information.

  Following step S105, the link information extraction unit 11d reads the difference information from the web page information storage unit 12, and extracts the link information from the difference information. Specifically, the link information extraction unit 11d extracts a predetermined tag for trackback from tags of a web page description language (HTML or the like) included in the difference information, and further extracts a URL included in the tag. The URL is used as link information (step S106).

  Subsequently, the link information extraction unit 11d determines whether new link information has been added to the web page information (step S107). In step S106, if link information can be extracted from the difference information, new link information is added to the web page information. In this case, the process proceeds to step S108. In step S106, if link information cannot be extracted from the difference information, new link information is not added to the web page information. In this case, the process proceeds to step S109.

  When it is determined that new link information has been added to the web page information, the trackback spam determination unit 11f determines whether or not the trackback added to the webpage is due to trackback spam (step S108). Details of step S108 will be described later. Subsequently, the comment extraction unit 11e reads the difference information from the web page information storage unit 12, and extracts a comment from the difference information. Specifically, the comment extraction unit 11e extracts a predetermined tag for comment from the tags included in the difference information, further extracts text included in the tag, and sets the text as a comment (step S109). ).

  Subsequently, the comment extraction unit 11e determines whether a new comment has been added to the web page information (step S110). In step S109, if a comment can be extracted from the difference information, a new comment is added to the web page information. In this case, the process proceeds to step S111. In step S109, when a comment cannot be extracted from the difference information, a new comment is not added to the web page information. In this case, the process ends.

  If it is determined that a new comment has been added to the web page information, the comment spam determination unit 11g determines whether or not the comment added to the web page is due to comment spam (step S111). Details of step S111 will be described later. Subsequently, the alarm processing unit 11 h generates alarm information and outputs it to the communication unit 10. The communication unit 10 transmits alarm information to the web server 2 via the network 3 (step S112).

  The blog web page is monitored by periodically repeating the above process. At this time, a web page of a blog composed of a large number of pages is obtained by repeatedly extracting links to other web pages on the same blog from the web page information and acquiring the linked web page information. It is possible to inspect all of the above, and it is possible to prevent omission of detection of abnormalities. Further, by automatically repeating the above processing, it becomes possible to monitor for 24 hours 365 days.

  Next, details of the trackback spam determination in step S108 will be described. First, a first operation example will be described. In an attack that uses a server infected with a computer virus called a bot as a stepping stone, the bot can be used only for a short period of time on the web pages of multiple blogs managed by the web server. Often the same content is written at the same time. In the first operation example, using this property, when the same trackback is added to a plurality of web pages at the same time, it is determined that the trackback is caused by trackback spam.

  The trackback spam determination unit 11f extracts time information from the web page information acquired in step S100, and stores it in the link information storage unit 13 in association with the link information extracted in step S106. In the present embodiment, the time when the web page is updated (last update time) is regarded as the time when the trackback is added to the web page.

  FIG. 3A shows the contents of link information and time information stored in the link information storage unit 13. As shown in FIG. 3A, time information is associated with each URL indicated by the link information. By executing the process shown in FIG. 2 for each blog for a plurality of blogs, the same trackback source URL may be detected from the plurality of blogs. For this reason, when the process shown in FIG. 2 is repeatedly executed, URLs associated with a plurality of pieces of time information appear.

  Subsequently, the trackback spam determination unit 11f reads the link information and time information from the link information storage unit 13, and generates a histogram indicating the appearance frequency of the same link for each time. FIG. 3B shows an example of a histogram. This histogram shows when and how many trackbacks with the same URL as the trackback source URL are detected.

  As described above, when a trackback is added to a blog due to trackback spam, since the same trackback is added to a plurality of blogs at the same time, the frequency of the histogram increases. The trackback spam determination unit 11f sets a predetermined section 300, and compares a value obtained by summing the frequencies of histograms in the section 300 with a predetermined threshold. If the total value of the frequencies is equal to or greater than the threshold, the trackback spam determination unit 11f determines that additional trackback due to trackback spam has occurred. If the total frequency is less than the threshold value, the trackback spam determination unit 11f determines that no additional trackback has occurred due to trackback spam.

  The trackback spam determination unit 11f repeatedly executes the above processing while shifting the section 300 in the time direction. As a result, if there is at least one section 300 in which it is determined that additional trackback due to trackback spam has occurred, an abnormality in the web page of the trackback destination due to trackback spam has been detected. In addition, when there is no section 300 that is determined to have added trackback due to trackback spam, the regular trackback is added.

  Next, a second operation example relating to trackback spam determination will be described. When a regular trackback is added, the trackback source web page is often a blog web page. However, when a trackback is added due to trackback spam, most of the trackback source web pages are commercial web pages that are unrelated to the blog, and the track back destination web page and the track back source web page And the page structure is different. In the second operation example, this feature is used to detect the characteristics of the web page of the track back source, and when a characteristic different from the web page of the blog is detected, it is determined that the track back is caused by the track back spam. The

The features of the blog web page are described below.
(A) There are few images displayed on the web page (there are few links to image files).
(B) In many Japanese blog web pages, the language encoding is often Japanese. Further, the language encoding of the trackback destination web page and the trackback source web page is often the same.
(C) Dates are often displayed on web pages.
(D) Keywords such as “blog”, “trackback”, and “comment” are often displayed on web pages.

From the above characteristics, the following characteristics can be cited as the characteristics of the web page of the track back source due to the malicious track back.
(A) N (N: integer greater than or equal to 1) images are displayed on the web page.
(B) The language encoding is a language other than Japanese.
(C) The date / time is not displayed on the web page.
(D) Keywords such as “Diary (blog)”, “Trackback”, “Comment” are not displayed on the web page.

  In the second operation example, the trackback source web page information is newly acquired. Specifically, the web page information acquisition unit 11a accesses the web server indicated by the link information extracted in step S106 via a communication process by the communication unit 10, and includes a file containing the track back source web page information. To get. The web page information acquisition unit 11 a stores the acquired web page information in the web page information storage unit 12.

The trackback spam determination unit 11f reads the webpage information of the trackback source from the web page information storage unit 12, and uses the following formulas (1) based on the above conditions (A) to (D) as a feature of the web page. Is calculated. In the formula (1), the subscript i corresponds to the above conditions (A) to (D), i = 0 corresponds to the condition (A), and i = 1 corresponds to the condition (B). , I = 2 corresponds to the condition (C), and i = 3 corresponds to the condition (D). C _i is a value corresponding to the presence / absence of characteristics of each condition, and C _i = 1 when the web page satisfies each condition, and C _i = 0 when the web page does not satisfy each condition. k _i is a coefficient indicating the degree of weighting to C _i . The value of k _i is stored in the coefficient storage unit 15.

For the condition (A), trackback spam determination unit 11f, from the web page information, extracts information showing the link to the image file, to determine the value of C _i, based on the number of links indicated by the information. If the number of links is N or more, C _i = 1, and if the number of links is less than N, C _i = 0. For the condition (B), trackback spam determination unit 11f determines the value of C _i on the basis of a result of determining whether it contains a tag "charset = euc-jp" to the web page information. If this tag is not included, C _i = 1, and if this tag is included, C _i = 0.

For the condition (C), trackback spam determination unit 11f determines the value of C _i on the basis of a result of determining whether contains a tag relating to the display of the date and time on the web page information. If this tag is not included, C _i = 1, and if this tag is included, C _i = 0. For the condition (D), trackback spam determination unit 11f determines the value of C _i on the basis of a result of determining whether it contains text that indicates a specific keyword on the web page information. If this text is not included, C _i = 1, and if this text is included, C _i = 0.

The value of the coefficient k _i is calculated in advance as follows. Regarding condition (A), whether the web page is a legitimate web page or a malicious web page for web pages including links to N or more image files among the track back source web pages by track back. And count the number of occurrences of legitimate and malicious web pages. Based on this investigation result, the value of the coefficient k _i is calculated according to the following equation (2).

Regarding the condition (B), whether or not the trackback source webpage by trackback is a legitimate webpage targeting a webpage that does not include the tag “charset = euc-jp”, or a malicious webpage. And count the number of occurrences of legitimate web pages and malicious web pages. Based on this investigation result, the value of the coefficient k _i is calculated according to the above equation (2).

Regarding the condition (C), we investigate whether the web page is the regular web page or the malicious web page for the web page that does not display the date / time among the track back source web pages. Count the number of occurrences of web pages and malicious web pages. Based on this investigation result, the value of the coefficient k _i is calculated according to the above equation (2).

Regarding the condition (D), it is investigated whether the web page from which the specific keyword is not displayed is the legitimate web page or the malicious web page among the track back source web pages by the track back. , Count the number of appearances of legitimate web pages and malicious web pages. Based on this investigation result, the value of the coefficient k _i is calculated according to the above equation (2).

  Conditions other than the above conditions (A) to (D) may be used. For example, as described above, an attack by trackback spam has the property that the same trackback is added to a plurality of web pages at the same time. This property may be used on condition that the same URL is added to N or more web pages by track back.

When using this condition, trackback spam determination section 11f determines the value of C _i on the basis of the result of generating a histogram as described above, was compared with the total value with a predetermined threshold the frequency of the histogram in a predetermined section To do. C _i = 1 if the total value of the frequencies is equal to or greater than the threshold value, and C _i = 0 if the total value of the frequencies is less than the threshold value.

The value of the coefficient k _i is a regular web page for track back source web pages added to N or more web pages at the same time among track back source web pages by track back. Whether it is a malicious web page or a malicious web page, and counts the number of regular and malicious web pages. Based on this investigation result, the value of the coefficient k _i is calculated according to the above equation (2).

  As described above, the feature amount of the equation (1) is calculated. The trackback spam determination unit 11f compares this feature amount with a predetermined threshold value. If the feature amount is greater than or equal to the threshold value, the trackback spam determination unit 11f determines that additional trackback due to trackback spam has occurred. If the feature amount is less than the threshold value, the trackback spam determination unit 11f determines that no additional trackback due to trackback spam has occurred.

  The determination result may be reflected in the existing prohibited URL list. That is, the URL added by the trackback determined to be due to the trackback spam may be added to the prohibited URL list. This makes it possible to keep the latest prohibited URL.

  Next, details of the comment spam determination in step S111 will be described. First, a first operation example will be described. As mentioned above, attacks that take place using a server infected with a bot as a stepping stone can be used for multiple blog web pages managed by a web server at the same time, assuming that the bot can only be used for a short time. Often the same content is written. In the first operation example, using this property, when the same comment is added to a plurality of web pages at the same time, it is determined that the comment is due to comment spam.

  The process flow in the first operation example is the same as the process flow in the first operation example of the trackback spam determination described above. The trackback spam determination unit 11f extracts time information from the web page information acquired in step S100, and stores the time information in the comment storage unit 14 in association with the comment extracted in step S109. Subsequently, the trackback spam determination unit 11f reads the comment information and the time information from the comment storage unit 14, and generates a histogram indicating the appearance frequency of the same comment for each time. The subsequent processing is as described above.

  Next, a second operation example in comment spam determination will be described. When a regular comment is added, the purpose of the content described in the blog is related to the purpose of the comment. However, when comments are added due to comment spam, comments that are not related to the contents described in the blog are often added. Therefore, in the second operation example, based on the result of comparing the word included in the comment with the word included in the part other than the comment displayed on the blog, it is determined whether or not the comment is due to comment spam. Determined.

  Specifically, the comment spam determination unit 11g reads the web page information acquired in step S100 from the web page information storage unit 12, and extracts text other than comments from the text displayed on the web page. Subsequently, the comment spam determination unit 11g compares the word included in the comment extracted in step S109 with the word included in the text other than the comment. In this comparison, only words that are keywords registered in a word dictionary prepared in advance may be compared.

  As a result of the comparison, when the word included in the comment does not match any word included in the text other than the comment, the comment spam determination unit 11g determines that a comment has been added due to comment spam. Further, when the word included in the comment matches any word included in the text other than the comment, the comment spam determination unit 11g determines that no additional comment is generated due to comment spam.

  Alternatively, when the number of matches between the word included in the comment and the word included in the text other than the comment is less than a predetermined threshold, it is determined that the comment is added due to comment spam, and the word included in the comment When the number of matches with words included in text other than comments is equal to or greater than a threshold value, it may be determined that comments are not added due to comment spam.

  In addition to the above two operation examples, by using the feature of comment spam that URL is described in the comment, it is determined whether or not the URL is included in the comment. It may be determined whether or not.

  As described above, according to the present embodiment, it is not necessary to monitor the web page by human eyes by automatically detecting the abnormality of the web page, so that the burden on the monitoring of the web page can be reduced. it can. Therefore, it is possible to reduce labor costs for detecting anomalies that have been manually performed for a company that manages a web server for a blog.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. . For example, a program for realizing the operation and function of the web monitoring device described above may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by the computer.

  Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of the web monitoring apparatus by one Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the web monitoring apparatus by one Embodiment of this invention. It is a reference figure for demonstrating the track back determination method in one Embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Web monitoring apparatus, 2 ... Web server, 3 ... Network, 10 ... Communication part, 11 ... Monitoring process part, 11a ... Web page information acquisition part, 11b ... Page change detection unit, 11c ... difference extraction unit, 11d ... link information extraction unit, 11e ... comment extraction unit, 11f ... trackback spam determination unit, 11g ... comment spam determination unit, 11h ..Alarm processing unit, 12 ... Web page information storage unit, 13 ... Link information storage unit, 14 ... Comment storage unit, 15 ... Coefficient storage unit

Claims (9)

Information storage means for storing web page information;
Link information extraction means for extracting link information indicating a link to another web page from the web page information stored in the information storage means;
Information acquisition means for connecting to a web server indicated by the link information and acquiring web page information;
Based on the web page information acquired by the information acquisition unit, a feature amount calculation unit that calculates a feature amount of a web page;
An abnormality detecting means for detecting presence / absence of an abnormality of a web page based on the feature quantity calculated by the feature quantity calculating means;
An apparatus for detecting an abnormality of a web page, comprising:   2. The feature amount calculation unit calculates a feature amount of a web page based on a plurality of conditions indicating the feature of the web page based on the web page information acquired by the information acquisition unit. An abnormality detection device for a web page as described in 1.   3. The web page abnormality detection device according to claim 2, wherein the feature amount calculation unit calculates the feature amount by weighting a plurality of conditions indicating features of the web page. First information storage means for storing web page information;
Information extraction means for extracting additional information added in the past from the web page information stored in the first information storage means;
Second information storage means for storing the additional information in association with time information indicating the update time of the web page information;
Histogram generation means for generating a histogram indicating the appearance frequency of the additional information for each time based on the additional information and the time information stored in the second storage means;
An anomaly detecting means for detecting the presence or absence of an anomaly of the web page based on the histogram;
An apparatus for detecting an abnormality of a web page, comprising:   5. The information extracting unit extracts link information indicating a link to another web page as the additional information from the web page information stored in the first information storage unit. The web page abnormality detection device described.   5. The web page according to claim 4, wherein the information extraction unit extracts a comment added to the web page as the additional information from the web page information stored in the first information storage unit. Anomaly detection device. Information storage means for storing web page information;
Comment extracting means for extracting a comment added to a web page from the web page information stored in the information storage means;
Comparison means for comparing the word included in the comment extracted by the comment extraction means with the word included in a portion other than the comment displayed on the web page;
An abnormality detection means for detecting the presence or absence of an abnormality of the web page based on the result of the comparison by the comparison means;
An apparatus for detecting an abnormality of a web page, comprising:   The program for functioning a computer as an abnormality detection apparatus of the web page in any one of Claims 1-7.   A computer-readable recording medium on which the program according to claim 8 is recorded.

Images