JP2015187779A - Information processing system, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the accuracy of evaluating the reliability of a site selling commercial products and the like.SOLUTION: A Web browser 14 or a mailer 15 of a fake site detector 1 obtains first data provided to a user at a sale of a commercial product or service through a site and second data provided to the user at the sale. An extraction processing unit 111 extracts first sale related information representing information related to the sale from the obtained first data and extracts second sale related information representing information related to the sale from the obtained second data. A comparison processing unit 114 compares the extracted first sale related information with the extracted second sales related information, and outputs comparison results as information indicating the reliability of the site.

Description

  The present invention relates to a technique for evaluating the reliability of a site that sells products and the like.

  Conventionally, there is a site called a “fake site” that presents a branded product or the like at a super-discount price while pretending to be a legitimate Web site and does not ship the product after payment of money. Conventionally, a black list method is known as a method for detecting this fake site. According to this blacklist system, a blacklist of fake sites is created based on damage reports sent to police stations, consumer life centers, customs, etc. Access is blocked. However, this blacklist method has a problem in that it cannot detect fake sites that are not listed in the blacklist.

  Therefore, a heuristic method has been proposed (see, for example, Patent Document 1). For example, according to the heuristic method described in Patent Document 1, it is checked whether or not information related to a Web site requested by a user corresponds to a predetermined check item, the result is scored, and the score is predetermined. It is determined whether the Web site is genuine or counterfeit by comparing with the numerical value.

JP 2007-233904 A

  However, in the case of the method described in Patent Document 1, since each Web page requested by the user is checked against a check item, the Web page is a copy of a Web page of a legitimate site, or its configuration However, there is a problem that the web page cannot be determined to be forged.

  The present invention has been made in view of such circumstances, and an object of the present invention is to improve the accuracy of evaluation of the reliability of a site that sells products and the like.

  In order to solve the above problems, the present invention provides a first acquisition unit that acquires first data provided to a user when selling a product or service through a site, and the first acquisition unit acquires the first data. A first extraction unit that extracts first sales related information, which is information related to the one sale, and second data provided to the user at the time of the one sale are obtained from the first data A second acquisition unit that extracts second sales related information that is information related to the one sale from the second data acquired by the second acquisition unit; A comparison unit that compares the first sales-related information extracted by the first extraction unit with the second sales-related information extracted by the second extraction unit; and a comparison result by the comparison unit. , Output to output as information indicating the reliability of the site An information processing system including and.

  In the information processing system, the first acquisition unit is a function provided by a first application that is executed by a user to view the first data, and the second acquisition unit includes: It may be a function provided by a second application that is executed by a user to view the second data and is different from the first application.

  The information processing system includes a first information processing device, a second information processing device different from the first information processing device, and a server, and the first information processing device includes the first information processing device. Acquisition unit, the first extraction unit, and a transmission unit that transmits the first sales-related information extracted by the first extraction unit to the server, the server transmitting by the transmission unit A storage unit for storing the first sales-related information, and the second information processing apparatus includes the second acquisition unit, the second extraction unit, the comparison unit, and the output unit. A receiving unit that receives first sales related information stored in the storage unit from the server, and the comparing unit receives the first sales related information received by the receiving unit; The second sales related information extracted by the extraction unit may be compared.

  Further, the present invention is an information processing method executed by the information processing system, the first acquisition step of acquiring first data provided to the user when selling one of the goods or services through the site; A first extraction step of extracting first sales-related information, which is information related to the one sale, from the first data acquired by the first acquisition step; and providing the user with the one sale Second acquisition step for acquiring the second data to be performed, and second sales related information that is information related to the one sale is extracted from the second data acquired by the second acquisition step Comparing the second extraction step to the first sales related information extracted by the first extraction step and the second sales related information extracted by the second extraction step And step, the result of comparison by the comparing step, an information processing method and an output step of outputting as information indicating the reliability of the site.

In addition, the present invention provides a first acquisition step of acquiring first data provided to a user when a product or service is sold through a site on a computer, and the first acquisition step acquired by the first acquisition step. A first extraction step of extracting first sales related information, which is information related to the one sale, from a first data; and a second step of acquiring second data provided to the user at the time of the first sale. A second extraction step of extracting second sales related information, which is information related to the one sale, from the second data acquired by the second acquisition step, and the first A comparison step of comparing the first sales related information extracted by the extraction step and the second sales related information extracted by the second extraction step;
There is provided a program for executing an output step of outputting a result of comparison in the comparison step as information indicating the reliability of the site.

  ADVANTAGE OF THE INVENTION According to this invention, the precision of evaluation of the reliability of the site which sells goods etc. can be improved.

It is a figure which shows the structure of the fake site detection apparatus. It is a figure which shows an example of scenario DB121. It is a figure which shows an example of keyword variation DB122. It is a figure which shows an example of related extraction item DB123. It is a figure which shows an example of domain information DB124. It is a figure which shows an example of extraction information DB125. It is a figure which shows an example of danger score DB126. It is a flowchart which shows an example of a fake site detection operation | movement. It is a flowchart which shows an example of a fake site detection operation | movement. 4 is a diagram illustrating an example of a Web page displayed on a display unit 13. FIG. It is a flowchart which shows an example of a fake site detection operation | movement. It is a flowchart which shows an example of a fake site detection operation | movement. FIG. 6 is a diagram showing an example of mail displayed on the display unit 13.

1. Embodiment 1-1. Configuration FIG. 1 is a diagram showing a configuration of a fake site detection device 1 according to an embodiment of the present invention. The fake site detection device 1 is an example of an “information processing system” according to the present invention.
The fake site detection device 1 is, for example, a personal computer. More specifically, it is a mobile terminal such as a smartphone or a tablet terminal, or a stationary computer. Roughly speaking, the fake site detection device 1 includes a processing unit 11, a storage unit 12, a display unit 13, a web browser 14, a mailer 15, and a communication unit 16, as shown in FIG. .

  The processing unit 11 is an arithmetic processing device such as a CPU (Central Processing Unit). As shown in FIG. 1, the processing unit 11 has functions of an extraction processing unit 111, an association determination unit 112, a storage processing unit 113, a comparison processing unit 114, and a risk score determination unit 115. These functions are realized by the processing unit 11 executing a program stored in the storage unit 12. These functions will be described later.

  The storage unit 12 is a storage device such as a hard disk or a flash memory. The storage unit 12 stores a program executed by the processing unit 11. Further, as shown in FIG. 1, the storage unit 12 includes a scenario DB (Database) 121, a keyword variation DB 122, an associated extracted item DB 123, a domain information DB 124, an extracted information DB 125, a risk score DB 126, Remember. Hereinafter, each database will be described.

  FIG. 2 is a diagram illustrating an example of the scenario DB 121. The scenario DB 121 is a database for storing scenario information. As shown in FIG. 2, each record constituting the scenario DB 121 includes fields “scenario ID”, “scenario name”, “extraction item”, “keyword trigger”, and “configuration trigger”. Composed.

  Here, the scenario ID is identification information uniquely given to the scenario information. The extracted item is information indicating the type of information extracted from the Web page or mail in the fake site detection operation described later. Information extracted at this time is referred to in order to detect a fake site. This extracted item includes, for example, a payment method, a contact address, and a person in charge. The keyword trigger is a keyword that triggers processing by the comparison processing unit 114 in the fake site detection operation described later. For example, the keyword trigger includes character strings such as “payment method” and “complete”. The configuration trigger is a configuration that serves as a trigger for processing by the comparison processing unit 114 in a false site detection operation described later. Configuration triggers include, for example, form parts such as radio buttons and pull-down menus.

  FIG. 3 is a diagram illustrating an example of the keyword variation DB 122. The keyword variation DB 122 is a database that stores extracted items and keyword trigger variations stored in the scenario DB 121. Variations stored in the keyword variation DB 122 are used to prevent omission of extraction when information or keyword triggers corresponding to extraction items are extracted in a fake site detection operation described later. Each record constituting the keyword variation DB 122 is composed of fields of “keyword” and “variation” as shown in FIG.

  FIG. 4 is a diagram illustrating an example of the association extraction item DB 123. As shown in FIG. 4, each record constituting the associated extracted item DB 123 includes fields of “related ID” and “related extracted item”. Here, the related ID is identification information uniquely given to the associated extracted item. The association extraction item is information indicating the type of information extracted from a Web page or mail in a fake site detection operation described later. Information extracted at this time is referred to in order to specify extraction information to be compared by the comparison processing unit 114 in a fake site detection operation described later.

  FIG. 5 is a diagram illustrating an example of the domain information DB 124. The domain information DB 124 is a database for recording information such as a Web page or a mail domain from which information corresponding to the above-described extraction items is extracted in a fake site detection operation described later. As shown in FIG. 5, each record constituting the domain information DB 124 is composed of fields of “domain”, “IP address”, and “site name”.

  FIG. 6 is a diagram illustrating an example of the extraction information DB 125. The main extraction information DB 125 is a database for recording information corresponding to the extraction items extracted from the Web page or mail in the fake site detection operation described later. The extracted information DB 125 has a table for each domain. As shown in FIG. 6, the records constituting each table include “information ID”, “information classification”, “content”, and “page name”. ”And“ acquisition date ”fields.

  Here, the information ID is identification information uniquely assigned to the extracted information. The information classification is information indicating the classification of the extracted information. This information classification includes, for example, a payment method, a contact address, and a person in charge, similarly to the above-described extraction items. The page name is the name of the Web page from which the extraction information is extracted. The acquisition date / time is the date / time when the extraction information is extracted.

FIG. 7 is a diagram illustrating an example of the risk score DB 126. This risk score DB 126 is a database for recording the accumulated risk score calculated in the fake site detection operation described later in domain units. As shown in FIG. 7, each record constituting the risk score DB 126 is composed of fields of “domain” and “cumulative risk score”. Here, the risk score is a score indicating the possibility of being a fake site.
This completes the description of the database.

  Next, the display unit 13 is a display device such as a liquid crystal display. As shown in FIG. 1, the display unit 13 has functions of a normal screen output unit 131 and a warning screen output unit 132. The normal screen output unit 131 outputs the Web page acquired by the Web browser 14 or the mail acquired by the mailer 15 as it is. On the other hand, the warning screen output unit 132 outputs a message warning the involvement of a fake site when displaying a Web page or an email.

The web browser 14 is application software executed for a user to browse a web page. The Web browser 14 has a function of acquiring data provided to the user when selling products or services through the site. Here, “data” according to the present invention is a concept including a Web page and mail. The function is an example of the “first acquisition unit” and the “second acquisition unit” according to the present invention.
A plug-in 141 is added to the Web browser 14 according to the present embodiment. Therefore, the Web page acquired by the Web browser 14 is once transferred to the processing unit 11 for a fake site detection operation described later. The web browser 14 is an example of a “first application” and a “second application” according to the present invention.

The mailer 15 is application software that is executed by a user to view mail. The mailer 15 has a function of acquiring data provided to the user when selling products or services through the site. The function is an example of the “first acquisition unit” and the “second acquisition unit” according to the present invention.
A plug-in 151 is added to the mailer 15 according to the present embodiment. Therefore, the mail acquired by the mailer 15 is once transferred to the processing unit 11 for a fake site detection operation described later. The mailer 15 is an example of a “first application” and a “second application” according to the present invention.

The communication unit 16 is, for example, a network card. As shown in FIG. 1, the communication unit 16 has functions of a transmission unit 161 and a reception unit 162. The transmission unit 161 transmits a Web page request acquired from the Web browser 14 to the Web server 2, or transmits a mail reception request acquired from the mailer 15 to the mail server 3. On the other hand, the receiving unit 162 transfers the Web page received from the Web server 2 to the Web browser 14 and transfers the mail received from the mail server 3 to the mailer 15.
Next, each function of the processing unit 11 will be described.

The extraction processing unit 111 extracts sales-related information that is information related to one sale of goods or services through the site from the Web page acquired by the Web browser 14 or the mail acquired by the mailer 15. Here, “sales related information” according to the present invention is a concept including a payment method, identification information of a person in charge on the seller side, and a contact information of the seller.
Specifically, the extraction processing unit 111 extracts information corresponding to an extraction item of scenario information stored in the scenario DB 121 from a Web page acquired by the Web browser 14 or an email acquired by the mailer 15.

Further, the extraction processing unit 111 extracts a keyword trigger and a configuration trigger of scenario information stored in the scenario DB 121 from a Web page acquired by the Web browser 14 or an email acquired by the mailer 15.
The extraction processing unit 111 is an example of a “first extraction unit” and a “second extraction unit” according to the present invention.

  The association determination unit 112 determines whether the Web page acquired by the Web browser 14 or the mail acquired by the mailer 15 is related to the domain stored in the domain information DB 124. Specifically, the association determination unit 112 compares information corresponding to the association extraction item extracted by the extraction processing unit 111 from the Web page or mail with information related to the domain stored in the domain information DB 124. Then, it is determined whether or not both match.

  The storage processing unit 113 stores information corresponding to the extraction item extracted by the extraction processing unit 111 from the Web page or mail in the extraction information DB 125. At this time, if a domain related to the Web page or mail is specified by the association determination unit 112, the storage processing unit 113 stores the information in the table of the domain in the extraction information DB 125.

The comparison processing unit 114 compares the first sales related information extracted by the extraction processing unit 111 with the second sales related information. Specifically, the extraction processing unit 111 includes information corresponding to the extraction item extracted by the extraction processing unit 111 from the Web page or mail, and the extraction information extracted by the extraction processing unit 111 and stored in the extraction information DB 125. Compare And the comparison process part 114 outputs the comparison result as information which shows the reliability of a site.
The comparison processing unit 114 is an example of a “comparison unit” and an “output unit” according to the present invention.

  The risk score determination unit 115 calculates a risk score based on the result of the comparison process by the comparison processing unit 114. Further, the risk score determination unit 115 calculates the latest cumulative risk score by adding the calculated risk score to the cumulative risk score stored in the risk score DB 126. The risk score determination unit 115 compares the calculated latest cumulative risk score with a predetermined threshold value.

1-2. Operation Next, the operation of the fake site detection device 1 will be described. Specifically, an operation for detecting a fake site based on a Web page or an email (hereinafter referred to as “fake site detection operation”) will be described. In the following description, the fake site detection operation executed for the Web page and the fake site detection operation executed for the mail will be described separately.

1-2-1. False Site Detection Operation Performed on Web Page FIGS. 8 and 9 are flowcharts illustrating an example of a false site detection operation performed on a Web page. First, when the processing unit 11 is activated in step Sa1 of this operation, the extraction processing unit 111 calls various information necessary for this operation from the storage unit 12 (steps Sa2 and Sa3). Specifically, the extraction processing unit 111 calls the scenario information from the scenario DB 121, calls the keyword variation information from the keyword variation DB 122, and calls the associated extracted item information from the associated extracted item DB 123. When obtaining the information, the extraction processing unit 111 completes the preliminary preparation for the operation (step Sa4).

  Next, the web browser 14 transmits a web page request to the web server 2 in accordance with an instruction from the user (step Sa5). When receiving the transmitted request, the Web server 2 returns the requested Web page to the Web browser 14 (step Sa6). When acquiring the returned Web page, the Web browser 14 transfers the Web page to the processing unit 11 (step Sa7).

  When the extraction processing unit 111 of the processing unit 11 acquires the transferred Web page, the extraction processing unit 111 executes an extraction process on the Web page (Step Sa8). Specifically, the extraction processing unit 111 extracts information corresponding to the extraction item of the scenario information acquired in step Sa4 on the Web page. Hereinafter, this extraction process will be described with reference to the drawings.

FIG. 10 is a diagram illustrating an example of a Web page displayed on the display unit 13. FIG. 10A is a diagram showing an example of a top page of a website selling watches, and FIG. 10B is a diagram showing a page for selecting a payment method on the website.
When the Web page shown in FIG. 10A is the processing target, for example, information corresponding to the extraction item “payment method” of the scenario information with the scenario ID “001” shown in FIG. 2 is extracted. The information “bank transfer” and “card payment” located in the vicinity of the extracted item is extracted.

  Regarding the information extraction method at this time, for example, when the Web page has a tag structure, information having a predetermined structural positional relationship with the extraction item in the Web page may be extracted. Good (for example, refer to JP 2007-47974 A). More specifically, for example, when the Web page includes a table structure and an extraction item is described as an item name of the table, the item value paired with the item name is extracted. May be. As another method, an extraction item may be searched on the Web page, and information corresponding to a candidate stored in advance within a predetermined distance from the searched extraction item may be extracted (for example, JP, 2002-175330, A).

When the extraction process is performed, the keyword variation information acquired in step Sa4 is used. Specifically, for example, when information corresponding to the extraction item “payment method” of the scenario information with the scenario ID “001” shown in FIG. 2 is extracted, FIG. 3 is a variation of this extraction item. Information corresponding to the extracted items such as “payment method”, “settlement method”, and “payment method” shown is also extracted.
Therefore, when the information corresponding to the extraction item “payment method” of the scenario information is extracted when the Web page shown in FIG. 10B is a processing target, the variation “ Information “bank transfer” located in the vicinity of “settlement method” is extracted.

  If information is not extracted as a result of the extraction process in step Sa8 (step Sa9: NO), the normal screen output unit 131 of the display unit 13 displays the Web page as it is (step Sa31). On the other hand, when information is extracted as a result of the extraction process in step Sa8 (step Sa9: YES), the extraction processing unit 111 executes step Sa10.

  In step Sa10, the extraction processing unit 111 extracts information corresponding to the association extraction item indicated in the association extraction item information acquired in step Sa4 from the Web page. For example, the extraction processing unit 111 extracts a domain from the Web page.

  Next, the association determination unit 112 calls domain information from the domain information DB 124 (steps Sa11 and Sa12). Then, the association determination unit 112 determines whether or not the Web page is related to the domain indicated in the called domain information (step Sa13). Specifically, the association determination unit 112 compares the information extracted in step Sa10 with the domain information and determines whether or not they match. For example, when the information extracted in step Sa10 is the domain “xyz.com” and the domain of the domain information includes “xyz.com”, the association determination unit 112 associates the Web page. Is determined.

Further, for example, the domain of the HTTP referrer extracted in step Sa10 is “xyz.com”, the site name is “clock shop”, the domain information domain includes “xyz.com”, and the site name is “ When “clock shop” is included, the association determination unit 112 determines that the Web page is associated.
By determining the association based on the HTTP referrer and the site name in this way, even if the domain of the Web page is different from the domain stored in the domain information DB 124, the association can be performed. In addition to the site name, for example, the association between Web pages with different domains may be determined based on information such as the purchased product or service name and the payment amount.

If the result of the determination in step Sa13 is that the web page is not associated (step Sa14: NO), the storage processing unit 113 stores various information of the web page in the extraction information DB 125 and the domain information DB 124 ( Step Sa30). Specifically, the storage processing unit 113 creates a new table including the information extracted in step Sa8, the information classification of the information, the acquisition date and time of the information, and the page name of the Web page. And stored in the extraction information DB 125. In addition, the storage processing unit 113 creates a new record including the information extracted in step Sa10 (specifically, the domain, IP address and / or site name) and stores it in the domain information DB 124.
Then, the normal screen output unit 131 of the display unit 13 displays the Web page as it is (step Sa31).

  On the other hand, as a result of the determination in step Sa13, if the Web page is associated (step Sa14: YES), the extraction processing unit 111 uses the keyword trigger and configuration of the scenario information acquired in step Sa4 from the Web page. A trigger is extracted (step Sa15). For example, when this extraction process is executed for the Web page shown in FIG. 10A, the keyword trigger “payment method” of the scenario information with the scenario ID “001” shown in FIG. 2 is extracted. . For example, when the main extraction process is executed for the Web page shown in FIG. 10B, the configuration trigger “radio button” of the scenario information with the scenario ID “001” shown in FIG. 2 is extracted. Is done.

If the trigger is not extracted as a result of the extraction process in step Sa15 (step Sa16: NO), the storage processing unit 113 stores various information of the Web page in the extraction information DB 125 (step Sa29). Specifically, the storage processing unit 113 stores a new record including the information extracted in Step Sa8, the information classification of the information, the acquisition date and time of the information, and the page name of the Web page in Step Sa13. It is added to the table of the domain whose association is confirmed in the determination. When the web page is a page having a domain different from the associated domain, the URL of the page is substituted as the page name of the web page.
Then, the normal screen output unit 131 of the display unit 13 displays the Web page as it is (step Sa31).

  On the other hand, when a trigger is extracted as a result of the extraction process in step Sa15 (step Sa16: YES), the comparison processing unit 114 calls the extraction information from the extraction information DB 125 (steps Sa17 and Sa18). At this time, the comparison processing unit 114 calls the extracted information stored in the table of the domain whose association is confirmed in the determination at Step Sa13.

  Next, the comparison processing unit 114 compares the information extracted in step Sa8 with the extracted information that has been called (step Sa19). Specifically, the comparison processing unit 114 compares the information extracted in step Sa8 with the extracted content of the called extracted information for each information category (or extracted item). For example, when information “bank transfer” is extracted as information corresponding to the extraction item “payment method” from FIG. 10B in step Sa8, in the example of the extraction information shown in FIG. Of the extracted information of the information ID “001” having the same information classification extracted from the extracted item and FIG. 10A, “bank transfer (XX bank XXX sagittalou); card payment” is compared with the information.

  As a result of the comparison, when the two pieces of information match for each information classification (step Sa20: YES), the storage processing unit 113 stores various information of the Web page in the extraction information DB 125 (step Sa29). The specific processing contents of step Sa29 are as described above. Then, the normal screen output unit 131 of the display unit 13 displays the Web page as it is (step Sa31).

  On the other hand, as a result of this comparison, if the two pieces of information do not match for any of the information classifications (step Sa20: NO), the risk score determination unit 115 calculates a risk score (step Sa21). Here, in this embodiment, since a risk score is set for each scenario information, the risk score determination unit 115 uses the scenario referred to in step Sa8 to extract information compared with the extracted information in the comparison of step Sa19. Identify the risk score set in the information. If there are multiple information inconsistencies, the risk scores specified for each inconsistency are added together.

  Next, the risk score determination unit 115 calls the cumulative risk score from the risk score DB 126 (steps Sa22 and Sa23). At this time, the risk score determination unit 115 calls the cumulative risk score associated with the domain whose association has been confirmed in the determination of step Sa13. Then, the risk score determination unit 115 calculates the latest cumulative risk score by adding the risk score calculated in step Sa21 to the called cumulative risk score. (Step Sa24).

Next, the risk score determination unit 115 compares the cumulative risk score calculated in step Sa24 with a predetermined threshold (step Sa25). If the cumulative risk score is less than the threshold value as a result of the comparison (step Sa26: NO), the storage processing unit 113 updates the risk score stored in the risk score DB 126 (step Sa28). Specifically, the storage processing unit 113 updates the cumulative risk score called in Steps Sa22 and Sa23 with the cumulative risk score calculated in Step Sa24. In addition, the storage processing unit 113 stores various types of information on the Web page in the extraction information DB 125 (Step Sa29). The specific processing contents of step Sa29 are as described above.
Then, the normal screen output unit 131 of the display unit 13 displays the Web page as it is (step Sa31).

On the other hand, when the cumulative risk score is equal to or greater than the threshold value as a result of the comparison in step Sa25 (step Sa26: YES), when the warning screen output unit 132 of the display unit 13 displays the web page, A message warning that the page may be a fake site page and the reason are displayed together (step Sa27).
This completes the description of the false site detection operation.

1-2-2. False Site Detection Operation Performed for Mail FIGS. 11 and 12 are flowcharts illustrating an example of a false site detection operation performed for mail. This operation is the same as the operation shown in FIGS. 8 and 9 except that the execution target is not a Web page but an email. Therefore, in the following description, the same processes as those shown in FIGS. 8 and 9 are denoted by the same reference numerals, and detailed description thereof is omitted.

  In this operation, when the extraction processing unit 111 completes the preliminary preparation (step Sa4), the mailer 15 transmits a mail reception request to the mail server 3 in response to an instruction from the user or automatically (step Sb1). . When the mail server 3 receives the received reception request, the mail server 3 delivers the requested mail to the mailer 15 (step Sb2). When the mailer 15 acquires the distributed mail, the mailer 15 transfers the mail to the processing unit 11 (step Sb3).

When the extraction processing unit 111 of the processing unit 11 acquires the transferred mail, the extraction processing unit 111 executes an extraction process on the mail (step Sa8). Hereinafter, this extraction process will be supplementarily described with reference to the drawings.
FIG. 13 is a diagram illustrating an example of mail displayed on the display unit 13. More specifically, it is a diagram showing an example of an email notifying completion of an order transmitted from a business operator who operates a Web site that sells watches. When this mail is a processing target, for example, when information corresponding to the extracted item “person in charge” of the scenario information with the scenario ID “003” shown in FIG. 2 is extracted, the vicinity of the extracted item The information “Taro Scam” located in is extracted.

  If information is not extracted as a result of the extraction process in step Sa8 (step Sa9: NO), the normal screen output unit 131 of the display unit 13 displays the mail as it is (step Sa31). On the other hand, when information is extracted as a result of the extraction process in step Sa8 (step Sa9: YES), the extraction processing unit 111 executes step Sa10.

  In step Sa10, the extraction processing unit 111 extracts information corresponding to the associated extraction item indicated in the associated extracted item information acquired in step Sa4 from the mail. For example, when the mail shown in FIG. 13 is a processing target, the extraction processing unit 111 extracts the domain “xyz.com” from the transmission source address of the mail. In addition, the extraction processing unit 111 extracts the site name “clock shop” from the subject or body of the email.

  Next, the association determination unit 112 calls domain information from the domain information DB 124 (steps Sa11 and Sa12). Then, the association determination unit 112 determines whether the mail is related to the domain indicated in the called domain information (step Sa13). For example, when the information extracted in step Sa10 is the domain “xyz.com” and the domain of the domain information includes “xyz.com”, the association determination unit 112 determines that the email is associated. judge. Alternatively, when the information extracted in step Sa10 is the site name “clock shop” and the site name of the domain information includes “clock shop”, the association determination unit 112 determines that the mail is associated. judge.

  As a result of the determination in step Sa13, when the mail is not associated (step Sa14: NO), the normal screen output unit 131 of the display unit 13 displays the mail as it is (step Sa31). On the other hand, as a result of the determination in step Sa13, if the mail is associated (step Sa14: YES), the extraction processing unit 111 executes the keyword trigger and the configuration trigger for the scenario information acquired in step Sa4 from the mail. Extract (step Sa15). For example, when this extraction process is executed for the mail shown in FIG. 13, the keyword trigger “complete” of the scenario information of the scenario ID “003” shown in FIG. 2 is extracted.

  If the trigger is not extracted as a result of the extraction process in step Sa15 (step Sa16: NO), the storage processing unit 113 stores various pieces of information of the mail in the extraction information DB 125 (step Sa29). At this time, the subject of the mail is used as the page name of the Web page. Then, the normal screen output unit 131 of the display unit 13 displays the mail as it is (step Sa31).

On the other hand, when a trigger is extracted as a result of the extraction process in step Sa15 (step Sa16: YES), the comparison processing unit 114 calls the extraction information from the extraction information DB 125 (steps Sa17 and Sa18).
Next, the comparison processing unit 114 compares the information extracted in step Sa8 with the extracted information that has been called (step Sa19). For example, when information “XX bank YY sagita” is extracted from FIG. 13 as information corresponding to the extraction item “payment method” in step Sa8, in the example of the extraction information shown in FIG. Of the extracted information of the information ID “001” having the same information classification extracted from the extracted item and FIG. 10A, “bank transfer (XX bank XXX sagittalo); card payment” is compared with the information.
As a result of the comparison, if the two pieces of information match for each information classification (step Sa20: YES), the storage processing unit 113 stores various pieces of information of the mail in the extraction information DB 125 (step Sa29). Then, the normal screen output unit 131 of the display unit 13 displays the mail as it is (step Sa31).

On the other hand, as a result of this comparison, if the two pieces of information do not match for any of the information classifications (step Sa20: NO), the risk score determination unit 115 calculates a risk score (step Sa21).
Next, the risk score determination unit 115 calls the cumulative risk score from the risk score DB 126 (steps Sa22 and Sa23), adds the risk score calculated in step Sa21 to the called cumulative risk score, and obtains the latest cumulative risk score. Is calculated. (Step Sa24).

Next, the risk score determination unit 115 compares the cumulative risk score calculated in step Sa24 with a predetermined threshold (step Sa25). If the cumulative risk score is less than the threshold value as a result of the comparison (step Sa26: NO), the storage processing unit 113 updates the risk score stored in the risk score DB 126. Further, the storage processing unit 113 stores various pieces of information of the mail in the extraction information DB 125 (Step Sa29).
Then, the normal screen output unit 131 of the display unit 13 displays the mail as it is (step Sa31).

On the other hand, if the cumulative risk score is greater than or equal to the threshold value as a result of the comparison in step Sa25 (step Sa26: YES), the warning screen output unit 132 of the display unit 13 displays the email when the email is displayed. A message that warns that the mail is transmitted from the operator of the fake site is also displayed (step Sa31).
This completes the description of the false site detection operation.

According to the fake site detection apparatus 1 described above, a new method of determining whether or not the web site is a fake site by verifying the consistency of sales related information among a plurality of pages constituting the web site. A fake site detection method is provided. This fake site detection method asks that various types of payment methods can be selected on the top page of the website in the same manner as the regular site, while the payment method convenient for the seller on the page that actually selects the payment method. It was thought in view of the characteristics of fake sites that only present.
Further, according to the fake site detection device 1 described above, not only the Web page acquired by the Web browser 14 but also the mail acquired by the mailer 15 is the target of the fake site detection operation. It is also possible to verify the consistency of information between the two.

2. Modifications The above embodiment may be modified as follows. Further, the following modifications may be combined with each other.

2-1. Modification 1
In the fake site detection operation according to the above embodiment, a conventional fake site detection method may also be used. For example, when inconsistency of information is detected in step Sa20 of the above operation, it is determined whether or not the IP address of the Web page and the discount rate described in the Web page or mail meet a predetermined condition. You may make it do. When the IP address or the discount rate matches a predetermined condition, a corresponding risk score may be added to the cumulative risk score calculated in step Sa24.

2-2. Modification 2
In steps Sa17 and Sa18 of the fake site detection operation according to the above embodiment, the comparison processing unit 114 may call only extracted information extracted within a predetermined period from the extracted information DB 125. For example, the comparison processing unit 114 may call only the extracted information extracted from the current date and time within a predetermined period (for example, one day) from the extracted information DB 125. This means that after a certain amount of time has passed, the payment method may be changed even if the site is a legitimate site. This is because it may be detected.

2-3. Modification 3
Although the false site detection device 1 according to the above embodiment is assumed as a terminal device, the false site detection operation described above may be executed in a device other than the terminal device. For example, it may be executed in a relay device that relays between the terminal device and the Web server 2 or the mail server 3. This relay device is an example of an “information processing system” according to the present invention. Here, the relay device is, for example, a proxy server.

  When the fake site detection operation is performed in the relay device, the relay device transmits the web page request transmitted from the terminal device to the web server 2 in the above step Sa5, and in the above step Sa7. Then, the Web page returned to the terminal device is transferred to the processing unit 11 of the own device. In addition, the relay device transmits a reception request of the mail transmitted from the terminal device to the mail server 3 in the above step Sb1, and the mail distributed to the terminal device is processed by the own device in the above step Sb3. Forward to unit 11. In the case where the extracted information is written in the storage unit in steps Sa29 and Sa30, the information is stored in units divided for each user by a user ID or the like.

  In addition, in step Sa31, the relay device directly transfers the Web page or mail to the terminal device. On the other hand, in step Sa27, the information indicating the detection of the fake site is transmitted together with the Web page or email to the terminal device. Send to.

2-4. Modification 4
The extraction information DB 125 according to the above embodiment may be managed by another server different from the fake site detection device 1. The information extracted in step Sa8 of the fake site detection operation is stored in the storage unit of the server, and the extracted information compared in step Sa19 of the operation is called from the storage unit of the server. It may be. According to such an embodiment, when a plurality of false site detection devices 1 exist, there is an advantage that extraction information can be shared between the devices.

When this modification is adopted, the transmission unit 161 of the fake site detection device 1 transmits the sales related information extracted by the extraction processing unit 111 to the server. The receiving unit 162 receives sales related information managed by the server. On the other hand, the server includes a storage unit that stores sales related information transmitted by the transmission unit 161.
The fake site detection device 1 according to this modification is an example of the “first information processing device” and the “second information processing device” according to the present invention.

2-5. Modification 5
The program for realizing the function group of the fake site detection device 1 shown in FIG. 1 may be provided via a recording medium readable by a computer device. Here, the recording medium is, for example, a magnetic recording medium such as a magnetic tape or a magnetic disk, an optical recording medium such as an optical disk, a magneto-optical recording medium, or a semiconductor memory. In addition, this program may be provided via a network such as the Internet.

2-6. Other Modifications In the fake site detection operation according to the above-described embodiment, when a keyword trigger or a configuration trigger is extracted from a Web page or an email, a comparison process is performed by the comparison processing unit 114 (Steps Sa16 to Sa19). reference). However, the comparison processing by the comparison processing unit 114 may be executed regardless of whether or not these triggers are extracted. That is, steps Sa15 and Sa16 may be omitted in the fake site detection operation according to the above embodiment.

  Further, in the fake site detection operation according to the above-described embodiment, when the cumulative risk score is equal to or higher than the threshold value, a message notifying the detection of the fake site is displayed on the display unit 13 (see steps Sa26 and Sa27). However, as a result of the comparison processing by the comparison processing unit 114, a message notifying the detection of a fake site may be displayed on the display unit 13 when information mismatch is detected.

DESCRIPTION OF SYMBOLS 1 ... Fake site detection apparatus, 2 ... Web server, 3 ... Mail server, 11 ... Processing part, 12 ... Memory | storage part, 13 ... Display part, 14 ... Web browser, 15 ... Mailer, 16 ... Communication part, 111 ... Extraction process , 112 ... Association determination unit, 113 ... Storage processing unit, 114 ... Comparison processing unit, 115 ... Risk score determination unit, 121 ... Scenario DB, 122 ... Keyword variation DB, 123 ... Association extraction item DB, 124 ... Domain Information DB, 125 ... Extraction information DB, 126 ... Risk score DB, 131 ... Normal screen output unit, 132 ... Warning screen output unit, 141 ... Plug-in, 151 ... Plug-in, 161 ... Transmission unit, 162 ... Reception unit

Claims (5)

A first acquisition unit that acquires first data provided to a user when selling a product or service through the site;
A first extraction unit that extracts first sales related information that is information related to the one sale from the first data acquired by the first acquisition unit;
A second acquisition unit for acquiring second data provided to the user at the time of the one sale;
A second extraction unit that extracts second sales-related information that is information related to the one sale from the second data acquired by the second acquisition unit;
A comparison unit that compares the first sales related information extracted by the first extraction unit with the second sales related information extracted by the second extraction unit;
An information processing system comprising: an output unit that outputs a result of comparison by the comparison unit as information indicating reliability of the site. The first acquisition unit is a function provided by a first application that is executed by a user to view the first data;
The second acquisition unit is a second application that is executed by a user to view the second data, and is a function provided by a second application different from the first application. The information processing system according to claim 1. The information processing system includes a first information processing device, a second information processing device different from the first information processing device, and a server.
The first information processing apparatus includes:
The first acquisition unit;
The first extraction unit;
A transmission unit that transmits the first sales related information extracted by the first extraction unit to the server;
The server includes a storage unit that stores first sales related information transmitted by the transmission unit,
The second information processing apparatus
The second acquisition unit;
The second extraction unit;
The comparison unit;
The output unit;
A receiving unit for receiving first sales related information stored in the storage unit from the server;
The said comparison part compares the 1st sales related information received by the said receiving part, and the 2nd sales related information extracted by the said 2nd extraction part. Information processing system described in 1. An information processing method executed by an information processing system,
A first acquisition step of acquiring first data provided to the user when selling a product or service through the site;
A first extraction step of extracting first sales related information that is information related to the one sale from the first data acquired by the first acquisition step;
A second acquisition step of acquiring second data provided to the user at the time of the one sale;
A second extraction step of extracting second sales related information that is information related to the one sale from the second data acquired by the second acquisition step;
A comparison step for comparing the first sales related information extracted by the first extraction step with the second sales related information extracted by the second extraction step;
An information processing method comprising: an output step of outputting a result of the comparison in the comparison step as information indicating the reliability of the site. On the computer,
A first acquisition step of acquiring first data provided to the user when selling a product or service through the site;
A first extraction step of extracting first sales related information that is information related to the one sale from the first data acquired by the first acquisition step;
A second acquisition step of acquiring second data provided to the user at the time of the one sale;
A second extraction step of extracting second sales related information that is information related to the one sale from the second data acquired by the second acquisition step;
A comparison step for comparing the first sales related information extracted by the first extraction step with the second sales related information extracted by the second extraction step;
An output step of outputting a result of the comparison in the comparison step as information indicating the reliability of the site.

Images