JP5082917B2 - Illegal information detection device, illegal information detection method, and illegal information detection program - Google Patents

Description

  The present invention relates to an illegal information detection apparatus, an illegal information detection method, and an illegal information detection program, and in particular, detects information with high illegality from search result information searched based on search conditions for information published on a network. The present invention relates to an illegal information detection apparatus, an illegal information detection method, and an illegal information detection program.

  In recent years, it has become common to obtain information to be obtained using a search system or a search service on the Internet. Furthermore, it is becoming common to freely post (upload) and publish data such as content created on the Internet.

  At this time, depending on the uploaded data, copyright and privacy may be infringed, which is particularly problematic when a malicious user makes an illegal disclosure. As a method of preventing such illegal disclosure, it is illegal if the uploaded data and the legitimate data are collated using collation technology such as text, sound, image, and video, and the degree of coincidence is high. A method of detection is conceivable. For example, Non-Patent Document 1 describes a moving image matching technique.

  In addition, if illegal data disclosure is performed, the infringing data is likely to be accessed frequently by searching, etc., so it is illegal to use technology that detects data with concentrated access. A possible method is to detect disclosure. A technique for detecting and preventing such access concentration is described in Patent Document 1, for example.

  In addition, the content usage permission management method disclosed in Patent Document 2 extracts a feature of the content, and if it is determined that there is a possibility of copyright infringement compared with the feature of the content registered in advance, it is specified in advance. Compared with the use permission range of the original content, the use permission for the user is managed.

  In addition, the multimedia information distribution method disclosed in Patent Document 3 is intended to protect the copyright of the multimedia information holder by preventing unauthorized operation of the multimedia information by a distributor. . In Patent Document 3, each file name of a plurality of pieces of multimedia information included in prepared multimedia contents is obtained from a distribution device installed on a distributor by an operation from a viewer terminal connected to the network. Edit information describing the playback format is received. On the other hand, from the multimedia information holding device on the network under the management of the multimedia information holder, the body of a plurality of multimedia information specified by each file name described in the previously received editing information is directly read. Receive. Accordingly, the viewer terminal reproduces the plurality of multimedia information received from the multimedia information holding device according to the reproduction format described in the editing information received from the distribution device.

  The copyrighted material exchange mediation system disclosed in Patent Document 4 is intended to suppress the occurrence of copyright infringement when exchanging copyrighted works between users. In Patent Document 4, a work list of work data from a predetermined user terminal is registered in a work registration server, and the work registration server inquires whether or not there is a copyright for each work in the work list. With respect to the copyrighted work, the copyrighted work is made public when it is accessed from another user terminal.

  In addition, the time-series data search system disclosed in Patent Document 5 can perform a search without impairing the waveform characteristics of the time-series data. In Patent Document 5, a waveform is extracted from time-series data by wavelet transformation and a threshold value, compared with past data, a similar waveform is detected, and a future waveform is predicted.

  Further, the network system disclosed in Patent Document 6 for preventing a distributed denial-of-service attack extracts features in an access request, detects a DDoS (Distributed Denial of Service) attack based on the extracted feature values, and blocks the attack. By giving an instruction, a DDoS attack is detected at high speed.

In addition, the content information disclosure server disclosed in Patent Document 7 is intended to facilitate the search and publication of content on a network. In Patent Document 7, by registering attribute information such as registrant information, usage permission, etc., and feature quantities extracted from the registered content in the registered content, and searching the recorded information, It is possible to search and manage registrant information, attribute information, and feature quantities in content.
Izoe, Satoshi Sato, "Video Face Matching Using Pseudo Mahalanobis Mutual Distance Method", Information Science and Technology Forum 2002, LI-20, p.163-164 JP 2002-158660 A JP 2001-136363 A JP 2002-099285 A JP 2002-358374 A JP 2003-13088 A JP 2004-318742 A JP-A-2005-135146

  However, the above-mentioned Non-Patent Document 1 and Patent Documents 1 to 7 have a problem in that it is impossible to detect highly illegal data that is distributed and disclosed. This is because when illegal data is disclosed, it has the following characteristics. First, there is a tendency to concentrate access to sites where illegal data is published. Many users seeking illegal data use a search engine to search for illegal data using various search conditions, and based on the search results, access the site where the illegal data is published. It is because it performs. In addition, illegal data is not always disclosed in one place. In other words, there is a tendency to be disclosed to various sites by a plurality of malicious users. Furthermore, illegal data is repeatedly disclosed, deleted, and re-published, and at that time, there is a possibility that the data content or data format is slightly different but similar. Therefore, the search result searched by the user who seeks illegal data includes information related to similar data published on various sites.

  Here, in the method using the technique of Non-Patent Document 1, when data is arbitrarily uploaded by an unspecified number of users, it is difficult to determine when and which data is to be collated.

  In addition, since Patent Document 1 detects a single access concentration, for example, when an unspecified number of users upload and publish illegal data, or a part thereof, respectively, Alternatively, when the published data is deleted and republished at another site, the access may be distributed and the detection accuracy may be reduced.

  Further, Patent Document 2 needs to register the original content in advance, but cannot cope with the case where the acquired content is illegally copied and published once. Further, Patent Document 3 requires that the viewer terminal side has a function of performing processing based on editing information that describes a reproduction format of multimedia information to be distributed.

  In Patent Document 4, it is necessary to register a work list in advance in a work registration server. Patent Document 5 does not aim at detecting illegality in the first place. Patent Document 6 detects a DDoS attack, and cannot detect whether the accessed content is illegal. Further, Patent Document 7 needs to register content in advance, and cannot detect that the content has been illegally disclosed.

  The present invention has been made to solve such a problem, and an illegal information detection device, an illegal information detection method, and illegal information that can detect highly illegal data that is distributed and disclosed. An object is to provide a detection program.

  The illegal information detection apparatus according to the present invention detects highly illegal information from search result information searched based on search conditions for information published on a network. A feature value is extracted from the search result information storage unit in which the search result information is stored, and the search result information stored in the search result information storage unit, and the feature amount and the search result information are associated with each other. A similarity between the search result information is calculated from the feature extraction unit stored in the storage unit and the plurality of feature amounts stored in the feature amount storage unit, and the search result information is calculated based on the similarity. If the number of search result information determined to be similar by the similarity calculation means exceeds a predetermined value, the search result information is detected as highly illegal information. And illegality detecting means.

  The illegal information detection method according to the present invention detects highly illegal information from search result information searched based on search conditions for information published on a network. A feature amount extraction step for extracting a feature amount from the search result information, a similarity between each of the search result information is calculated from a plurality of feature amounts extracted by the feature extraction step, and based on the similarity A similarity calculation step for determining whether or not search result information is similar, and if the number of search result information determined to be similar by the similarity calculation step exceeds a predetermined value, the search result information is illegal An illegality detecting step for detecting as high information.

  The illegal information detection program according to the present invention causes a computer to execute a process of detecting information with high illegality from search result information searched based on a search condition for information published on a network. A feature value is extracted from the search result information storage unit in which the search result information is stored, and the search result information stored in the search result information storage unit, and the feature amount and the search result information are associated with each other. A similarity between the search result information is calculated from the feature extraction unit stored in the storage unit and the plurality of feature amounts stored in the feature amount storage unit, and the search result information is calculated based on the similarity. If the number of search result information determined to be similar by the similarity calculation means exceeds a predetermined value, the search result information is detected as highly illegal information. And illegality detecting means.

  According to the present invention, it is possible to provide an illegal information detection device, an illegal information detection method, and an illegal information detection program that can detect highly illegal data that is distributed and disclosed.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. In the drawings, the same elements are denoted by the same reference numerals, and redundant description will be omitted as necessary for the sake of clarity.

  FIG. 1 is a block diagram showing a configuration of an illegal information detection apparatus according to an embodiment of the present invention. The illegal information detection apparatus 1 in FIG. 1 stores in advance a plurality of search result information searched based on an arbitrary search condition for information published on the network, and is highly illegal from the search result information. Information is detected. Here, the search result information indicates, for example, a search result content in search processing executed by a plurality of users according to different search conditions for a search engine that searches content published on the Internet, or the content. Information indicating content such as a URL (Uniform Resource Locator).

  The illegal information detection apparatus 1 of the present invention is a general-purpose computer system, and includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and a non-volatile storage device as not shown. Prepare. In the illegal information detection apparatus 1, the CPU reads an OS (Operating System) and an illegal information detection program stored in a RAM, ROM, or a nonvolatile storage device, and executes illegal information detection processing. Thereby, highly illegal information can be detected from a plurality of search result information.

  The illegal information detection apparatus 1 does not have to be a single computer system, and may be configured by a plurality of computer systems. Furthermore, the information service search system 100 may operate computer systems having the same function in parallel for load distribution.

  As shown in FIG. 1, the illegal information detection apparatus 1 of the present invention includes a search result information storage unit 11, a feature extraction unit 12, a feature amount storage unit 13, a similarity calculation unit 14, and illegality detection. Means 15.

  The search result information storage unit 11 stores the search result information described above. The search result information storage unit 11 may store the search result information in advance when the illegal information detection apparatus 1 executes the illegal information detection process according to the present invention. Here, the search result information is, for example, SNS (Social Networking Service) or text data that is a description content of a blog that is disclosed to an unspecified number of users on the Internet, image data that can be viewed, or viewing / listening. Audio data or video data that can be made available. The search result information storage unit 11 stores at least two pieces of search result information.

  The feature extraction unit 12 extracts a feature amount for each of the search result information stored in the search result information storage unit 11 and associates the feature amount with the search result information of the extraction source in the feature amount storage unit 13. Store. Here, the feature amount is represented by a feature amount vector F = (r1, r2,..., Rn) for the search result information R. The feature amount may be, for example, a character vector or a word vector for text data, a cepstrum for speech data, and shape information for moving image data. Note that the expression of the feature vector is not limited to that described above. Further, since the technique related to feature quantity extraction is well known as a known technique, detailed description thereof is omitted here.

  Here, the feature extraction unit 12 does not need to extract feature amounts for all the search result information stored in the search result information storage unit 11. In this case, the feature extraction unit 12 satisfies a predetermined condition that is arbitrarily determined among the search result information stored in the search result information storage unit 11, for example, search result information within a certain time, a certain group The search result information searched by a plurality of users belonging to may be targeted.

  The feature amount storage unit 13 stores the feature amount extracted from the search result information by the feature extraction unit 12.

  The similarity calculation means 14 performs similarity calculation on a plurality of feature amounts stored in the feature amount storage unit 13, and determines whether or not the plurality of search result information are similar based on the similarity. . For example, the similarity calculation unit 14 can obtain the similarity by obtaining the distance between the feature amount vectors. In that case, the similarity between the vector X and the vector Y is expressed as D (X, Y). The similarity calculation by the similarity calculation unit 14 is not limited to the distance between feature quantity vectors. Further, since the technique for calculating the similarity from the feature amount is well known as a known technique, detailed description thereof is omitted here.

  The illegality detection unit 15 aggregates the number of types of search result information determined to be similar by the similarity calculation unit 14, and if the number of types of the collected search result information exceeds a predetermined value, the search result information is illegal. Detect as highly specific information.

  The illegal information detection device 1 only needs to accept input of search result information in the search result information storage unit 11 and may be connected to a network such as the Internet. Alternatively, the illegal information detection device 1 may separately store the search result information acquired on the network in the search result information storage unit 11 even if it is not connected to the network.

  The search result information storage unit 11 and the feature amount storage unit 13 may be a non-volatile storage device such as a hard disk drive, a magneto-optical disk drive, or a flash memory, or a volatile memory such as a DRAM (Dynamic Random Access Memory). It may be a storage device. Further, the search result information storage unit 11 and the feature amount storage unit 13 may be storage devices externally attached to the illegal information detection device 1.

  Next, illegal information detection processing according to the embodiment of the present invention will be described with reference to the flowchart shown in FIG. First, the illegal information detection apparatus 1 extracts a feature amount from the search result information (S11). Specifically, the feature extraction unit 12 of the illegal information detection apparatus 1 reads the search result information stored in the search result information storage unit 11 and extracts one feature amount for one search information. Thereafter, the extracted feature quantity and the search result information of the extraction source are stored in the feature quantity storage unit 13 in association with each other. For example, the feature vector F1 = (r11, r12,..., R1n) is extracted from the search result information R1, and the search result information R1 and the feature vector F1 are associated with each other, that is, from the feature vector F1. The search result information R1 is stored in the feature amount storage unit 13 so as to be specified.

  Next, the illegal information detection apparatus 1 calculates the similarity between the search result information for a plurality of feature amounts (S12). Specifically, the similarity calculation unit 14 of the illegal information detection apparatus 1 acquires the feature amount stored in the feature amount storage unit 13 and calculates the similarity for all combinations of the feature amounts. And the similarity calculation means 14 determines with the search result information corresponding to the feature-value of the said combination being similar, when the calculated similarity is below a predetermined threshold value.

For example, the similarity calculation unit 14 determines that the similarity D (F1, F2) in the feature amount F1 extracted from the search result information R1 and the feature amount F2 extracted from the search result information R2 is ( 1) It is determined whether or not they are similar depending on whether or not the expression is satisfied.
D (F1, F2) <Dthre (1)
When the similarity D (F1, F2) satisfies the expression (1), the similarity calculation unit 14 refers to the feature amount storage unit 13 and searches for similarity between R1 and R2 corresponding to F1 and F2. It is determined as result information.

  Thereafter, the illegal information detection apparatus 1 counts the number of types of search result information that is equal to or less than the threshold value of the similarity among the calculated similarities (S13). Specifically, the illegality detection unit 15 of the illegal information detection device 1 totals the number of types of all the search result information determined to be similar by the similarity calculation unit 14. At that time, duplicate search result information is excluded from the number of types to be tabulated. For example, when it is determined that the search result information R1 and R2 are similar, the number of types of the search result information is “2”. Further, if it is determined that the search result information R2 and R3 are similar, the search result information R2 has already been tabulated, and thus is excluded from the number of types, and the number of types of the search result information is “3”.

  Then, the illegal information detection apparatus 1 determines whether or not the total number of types of search result information is equal to or greater than a predetermined value (S14). Specifically, the illegality detection unit 15 of the illegal information detection device 1 determines whether or not the number of types of search result information collected in step S13 is a predetermined value, for example, “3” or more. If the value is equal to or greater than the predetermined value, the process proceeds to step S15. If the value is less than the predetermined value, the illegal information detection process is terminated.

  Thereafter, when it is determined in step S14 that the number of types of search result information is greater than or equal to a predetermined value, the illegal information detection device 1 detects the corresponding search result information as highly illegal information (S15). Specifically, for example, the illegality detection unit 15 of the illegal information detection device 1 detects an alarm indicating that there is information with high illegality, and is determined to be equal to or less than the similarity threshold in step S12. Outputs a list of search result information.

  When it is determined in step S14 that the number of types of search result information is less than a predetermined value, the illegality detection unit 15 may output information indicating that there is no information with high illegality.

  As described above, the illegal information detection apparatus 1 according to the present invention performs a search with a high similarity in feature amount from the search result information stored in the search result information storage unit 11 that is the target of the illegal information detection process. It is determined whether the number of types of result information is a predetermined value or more.

  Simply, when there are many pieces of the same search result information, there is a possibility that accesses are concentrated on the official content, so it cannot be determined that the illegality is high. However, the fact that there are many types of similar search result information, not limited to the same, means that there are many non-original contents in the search result information. Moreover, there is a high possibility that illegal data is disclosed to various sites, and it can be said that the information is highly urgent to restrict the disclosure of data.

  Therefore, by detecting an alarm in such a case where the illegality is high, for example, it is possible to assist a site administrator to confirm similar search result information and determine illegality. . Alternatively, it is possible to support the notification of illegality or notification of warning to the publisher of the site corresponding to the search result information.

  Moreover, in the illegal information detection apparatus 1 according to the present invention, it is not necessary to register contents for determining illegality in advance. There are innumerable contents that should be protected for copyright and privacy at the present time, and in order to predict the contents to be protected and to protect them, some protection mechanism, for example, Patent Document 2 and Patent Document 4 described above are used in advance. Or it is difficult to register in Patent Document 7.

  From the above, it is possible to target search result information from various viewpoints of multiple users by using search result information searched according to various search conditions from information distributed and published on the network. , Find the same or similar data in it, and detect that the more similar data types, the more likely it is illegal data copied from the original data be able to. Therefore, it is possible to detect highly illegal data that infringes copyrights and privacy that are distributed and disclosed by the present invention.

<Example 1>
An example of a search server will be described below as Example 1 of the illegal information detection apparatus according to the present embodiment. FIG. 3 is a block diagram illustrating the entire configuration of the illegal information detection system according to the first embodiment of the present invention. The illegal information detection system shown in FIG. 3 includes a search server 100 and a client 400. The search server 100 and the client 400 are connected to a network such as the Internet.

  The search server 100 collects content published on the network and provides a search service for the collected content to the client 400 and the like connected to the network. The search server 100 performs illegal information detection processing together with search processing in response to a search request. In the illegal information detection process, when the possibility of illegal information is detected, the detected result is reflected in the search result. For example, the fact that it is illegal information is added to the search result, or the search result detected as illegal information is excluded.

  The search server 100 is a general-purpose computer system connected to a network such as the Internet, and includes a CPU, a RAM, a ROM, and a nonvolatile storage device as components not shown. In the search server 100, the CPU reads and executes the OS, the Web server program, the search program, and the illegal information detection program stored in the RAM, ROM, or nonvolatile storage device. As shown in FIG. 3, the search server 100 includes an illegal information detection unit 1 a, a search engine unit 2, and a search target database 3.

  The search engine unit 2 performs search processing, and includes an input receiving unit 21, a search unit 22, and an output unit 23.

  The input receiving unit 21 receives an input of a search request included in a search condition from the client 400 or the like. Then, the input receiving unit 21 notifies the search unit 22 of the search condition.

  The search unit 22 executes a search process on the search target database 3 based on the search condition notified from the input receiving unit 21. In addition, the search unit 22 acquires a search result from the search target database 3 and notifies the output unit 23 of the result.

  The output unit 23 generates a search result from the search result notified from the search unit 22 and the detection result notified from the illegality detection unit 15, and outputs the search result to the request source of the search process.

  Since the technology related to the search engine is well known as a publicly known technology, a detailed description is omitted here.

  The search target database 3 is a database in which data to be searched for search processing by the search means 22, that is, contents published on the network are stored.

  Note that the search server 100 includes a unit that travels on the network, collects content to be searched, and stores it in the search target database 3 as a configuration (not shown). Alternatively, the search server 100 may separately receive input of collected search target data and store it in the search target database 3.

  The illegal information detection unit 1 a corresponds to the illegal information detection device 1 of FIG. 1, and further includes a search result information storage unit 16 in addition to the function of the illegal information detection device 1. Therefore, in the following, the difference from FIG. 1 will be mainly described, and the description of the configuration corresponding to FIG. 1 and having the same function will be omitted.

  The search result information storage unit 16 acquires the search result acquired by the search unit 22 and stores it in the search result information storage unit 11.

  Further, the illegality detection unit 15 notifies the output unit 23 of the result of the illegal information detection process in the illegal information detection unit 1a.

  In the search server 100, the illegal information detection unit 1a, the search engine unit 2, and the search target database 3 do not need to exist in one computer system, and are configured by a plurality of computer systems. May be. Further, the search server 100 may operate computer systems having the same function in parallel for load distribution.

  The client 400 is a general-purpose computer system connected to a network such as the Internet, and includes a CPU, a RAM, a ROM, and a nonvolatile storage device as components not shown. In the client 400, the CPU reads and executes the OS and the Web client program stored in the RAM, ROM, or nonvolatile storage device. Thereby, the client 400 can transmit a search request including a search condition to the search server 100 and receive a search result that is a response to the search request.

  Next, the overall flow of the illegal disclosure detection process according to the first embodiment of the present invention will be described with reference to the sequence diagram shown in FIG. First, the client 400 inputs search conditions to the search server 100 (S101). Specifically, the client 400 transmits a search request including a search condition to the search engine unit 2 of the search server 100.

  Next, the search server 100 performs a search process based on the search condition (S102). Specifically, the input receiving unit 21 of the search server 100 receives a search request from the client 400, extracts a search condition included in the search request, and notifies the search unit 22 of the search condition. And the search means 22 inputs the search condition notified from the input reception means 21 to the search object database 3, and performs a search process.

  Then, the search server 100 acquires a search result (S103). Specifically, the search unit 22 of the search server 100 acquires a search result from the search target database 3 and notifies the output unit 23 of the search result.

  At this time, the search server 100 stores the search result (S104). Specifically, the search result information storage unit 16 of the search server 100 acquires the search result notified from the search unit 22 to the output unit 23 and stores it in the search result information storage unit 11.

  Thereafter, the search server 100 executes illegal information detection processing (S105). Specifically, illegal information detection processing as shown in FIG. 2 is performed by the feature extraction unit 12, similarity calculation unit 14, and illegality detection unit 15 of the search server 100.

  Then, the search server 100 acquires the detection result of the illegal information detection process (S106). Specifically, the illegality detection unit 15 of the search server 100 notifies the output unit 23 of the detection result of the illegal information detection process. For example, when an alarm is detected by the illegal information detection process, the illegality detection unit 15 notifies the output unit 23 of a list of corresponding search result information together with the alarm. If no alarm is detected by the illegal information detection process, the illegality detection unit 15 notifies the output unit 23 of information indicating that there is no information with high illegality.

  Thereafter, the search server 100 outputs the search result and the detection result to the client 400 (S107). Specifically, the output unit 23 of the search server 100 acquires the search result notified from the search unit 22 and the detection result notified from the illegality detection unit 15. If the detection result includes an alarm, the search result is corrected so as to add illegal information to the search result, and the result is returned to the client 400. For example, the output unit 23 adds a flag indicating illegal information to the search result corresponding to the search result information included in the detection result. Alternatively, the output unit 23 generates a search result excluding the search result corresponding to the search result information included in the detection result. Thereafter, the output unit 23 transmits the generated search result to the client 400 that is a request source of the search process.

  As described above, in the first embodiment of the present invention, the illegal information detection process is performed every time the search process is performed. Therefore, the illegal information can be detected and notified to the client 400 when the illegal information starts to spread. Alternatively, by excluding from the search result, it is possible to filter out information with high illegality and prevent outflow of information with high illegality.

  In addition, in the present invention, not only simply counting the number of searches of certain data (search results), but also when different users are publishing the same data, by counting the number of types, for example, , Also supports situations where multiple users upload similar information separately and disclose them, or situations where the same or another user republishes after deleting the data once the copyright violation has been pointed out it can.

<Example 2>
Subsequently, an example of a search server will be described below as Example 2 of the illegal information detection apparatus according to the present embodiment. In the second embodiment of the present invention, compared to the first embodiment, illegal information is detected by further using a search condition, and the detection accuracy is improved.

  Here, the search condition is arbitrary character string data, and one search condition includes a plurality of words. For example, let us consider a case where personal information of a person A, for example, personal history and personal relationship information, is disclosed on the Internet without permission (without permission). In other words, for example, a text document including personal information of the person A is uploaded by another person. At this time, if there is some topicality in the personal information of the person A, for example, a criminal record or a dating history with a celebrity, the document may be cited in various other documents and searched frequently. . In this case, the search conditions include, for example, query D “Mr. A, past, dating”, query E “past, catastrophe, actor B”, query F “dating, actor B” included in the search request made to the search system. , 2000 ".

  FIG. 5 is a block diagram illustrating the entire configuration of the illegal disclosure detection system according to the second embodiment of the present invention. The illegal information detection system shown in FIG. 5 includes a search server 101 and a client 400. The search server 101 and the client 400 are connected to a network such as the Internet. Here, the client 400, the search engine unit 2 and the search target database 3 in the search server 101 are the same as those in FIG. Only the differences from FIG. 3 will be described below.

  The search server 101 is obtained by replacing the illegal information detection unit 1a in FIG. 3 with an illegal information detection unit 1b. Compared to the illegal information detection unit 1a, the illegal information detection unit 1b includes a search condition storage unit 17 and a search condition storage unit 18, and the feature extraction unit 12 is replaced with the feature extraction unit 12a.

  The search condition storage unit 17 acquires the search condition received by the input reception unit 21 and stores it in the search condition storage unit 18.

  The search condition storage unit 18 stores the search conditions described above. The search condition storage unit 18 may be a nonvolatile storage device such as a hard disk drive, a magneto-optical disk drive, or a flash memory, or may be a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the search condition storage unit 18 may be a storage device externally attached to the illegal information detection device 1.

  The feature extraction unit 12a extracts a feature amount from a set of the search condition stored in the search condition storage unit 18 and the search result information stored in the search result information storage unit 11 corresponding to the search condition, and the feature The amount and the search result information of the extraction source are stored in the feature amount storage unit 13 in association with each other. Here, the feature quantity is represented by the search condition C and the feature quantity vector F = (c1, c2,..., Cm, r1, r2,..., Rn) for the search result information R. Note that the expression of the feature vector is not limited to that described above.

  FIG. 6 is a sequence diagram illustrating the entire flow of the illegal disclosure detection process according to the second embodiment of the present invention. Hereinafter, the difference from FIG. 4 will be mainly described, and detailed description of the same processing as in FIG. 4 will be omitted.

  First, the client 400 inputs search conditions to the search server 100 as in step S101 (S201). Next, similarly to step S102, the search server 100 performs a search process based on the search condition (S202).

  Here, the search server 100 stores the search conditions (S203). Specifically, the search condition storage unit 17 of the search server 100 acquires the search condition notified from the input receiving unit 21 to the search unit 22 and stores it in the search condition storage unit 18.

  And the search server 100 acquires a search result similarly to step S103 (S204). Subsequently, the search server 100 stores the search result as in step S104 (S205).

  Note that step S203 may be performed before execution of the search process by the search unit 22 as long as the search condition included in the search request is extracted by the input receiving unit 21 in step S202. Alternatively, step S203 may be executed after step S205. That is, step S203 should just be performed before the illegal information detection process of step S206 mentioned later.

  Thereafter, the search server 100 executes illegal information detection processing (S206). Specifically, illegal information detection processing is performed by the feature extraction unit 12a, the similarity calculation unit 14, and the illegality detection unit 15 of the search server 100. Here, as a difference from step S11 in FIG. 2, the feature extraction unit 12a is characterized by a search condition from the search condition storage unit 18 and a set of search result information corresponding to the search condition from the search result information storage unit 11. Extract the amount. Thereafter, steps S12 to S15 are the same processing as in FIG.

  And the search server 100 acquires the detection result of illegal information detection processing similarly to step S106 (S207). Thereafter, the search server 100 outputs the search result and the detection result to the client 400 as in step S107 (S208).

  As described above, in the second embodiment of the present invention, by calculating the similarity using both the search request and the search result as the feature amount, the detection can be performed with higher accuracy than the case where only the search result is used as the feature amount. It becomes possible.

<Other examples>
In the first and second embodiments, an alarm is detected when the number of types of search result information made similar by the illegality detection means 15 exceeds a certain amount. An alarm may be detected even when the appearance frequency of search result information, that is, the number of search hits both exceeds a certain amount. In other words, not only when there are a wide variety of search results, but also when the same search results are obtained repeatedly, detecting an alarm enables detection with higher accuracy. For example, if similar content is published in three places and 10 search result information is obtained per content, the number of types is 3, but the total number of search results is 30, which is more detected. It can be said that it becomes easy.

  Similarly, using time information of search result information, a search performed within a certain time period or a search performed at a certain time may be detected. In that case, the search result information storage unit 11 may store the search result information in association with the time information when the search result information is searched. The feature extraction unit 12 or the feature extraction unit 12a can be realized by setting search result information corresponding to a certain time or a certain time as a processing target. Thereby, detection with higher accuracy becomes possible. Further, the detection may be performed by reusing the accumulation of past search result information.

  Further, the embodiment of the present invention is not limited to the search server. For example, the illegal information detection apparatus 1 in FIG. 1 may be used by a site administrator for detecting illegal information. In this case, the illegal information detection process may be performed periodically, for example, once a day, and detection may be performed on the search result information of the day. And what is necessary is just to be able to perform the illegal information detection process at an arbitrary timing in an emergency.

  In recent years, information that has been illegally disclosed is propagated quickly and more widely, and it is difficult to predict information that is illegally disclosed in advance. Therefore, the present invention is applicable to such a situation.

  In addition, the present invention can be applied to uses such as a service that has a database as content and publishes and shares the database using the Internet or the like.

  According to the present invention, it is possible to protect copyright and privacy from illegal data disclosure on the Internet. In other words, illegal data that is distributed and uploaded by a large number of unspecified users can be detected by counting the number of types of search results obtained by searching instead of concentration of access to the data. It becomes possible to detect illegal data disclosure. The reason for this is that since it is illegal data, the disclosure, deletion, and re-publication are repeated, it can be said that the same data or slightly different data exists in a plurality of locations. For this reason, a large number of types of data that are the same or similar (such as URLs) is an important factor in determining illegality.

  Furthermore, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the gist of the present invention described above.

It is a block diagram which shows the structure of the illegal information detection apparatus concerning embodiment of this invention. It is a flowchart figure which shows the illegal information detection process concerning embodiment of this invention. It is a block diagram which shows the whole structure of the illegal information search system concerning Example 1 of this invention. It is a sequence diagram which shows the whole flow of the illegal disclosure detection process concerning Example 1 of this invention. It is a block diagram which shows the whole structure of the illegal disclosure detection system concerning Example 2 of this invention. It is a sequence diagram which shows the whole flow of the illegal disclosure detection process concerning Example 2 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Illegal information detection apparatus 1a Illegal information detection unit 1b Illegal information detection unit 11 Search result information storage unit 12 Feature extraction unit 12a Feature extraction unit 13 Feature quantity storage unit 14 Similarity calculation unit 15 Illegal detection unit 16 Search result information storage unit DESCRIPTION OF SYMBOLS 17 Search condition storage means 18 Search condition memory | storage part 100 Search server 101 Search server 2 Search engine part 21 Input reception means 22 Search means 23 Output means 3 Search object database 400 Client

Claims (21)

An illegal information detection device for detecting highly illegal information from search result information searched based on search conditions for information published on a network,
A search result information storage unit for storing the search result information;
Feature extraction means for extracting a feature quantity from the search result information stored in the search result information storage section, and storing the feature quantity and the search result information in association with each other in the feature quantity storage section;
Similarity that calculates similarity between each of the search result information from a plurality of feature values stored in the feature value storage unit, and determines whether the search result information is similar based on the similarity Degree calculation means,
An illegal information detection apparatus comprising: illegality detection means that detects, when the number of search result information determined to be similar by the similarity calculation means exceeds a predetermined value, the search result information as highly illegal information.   The illegal information detection device according to claim 1, further comprising a search result information storage unit that acquires search result information searched based on the search condition and stores the search result information in the search result information storage unit. . The illegal information detection device includes:
A search condition storage unit for storing the search conditions;
Search condition storage means for acquiring the search condition and storing it in the search condition storage unit;
The feature extraction unit extracts a feature amount from a search condition stored in the search condition storage unit and search result information stored in the search result information storage unit corresponding to the search condition. The illegal information detection device described. The search result information storage unit stores the number of searches of the search result information in association with the search result information,
When the number of search result information in which the number of searches exceeds a predetermined value among search result information determined to be similar by the similarity calculation unit exceeds the predetermined value, the illegality detection unit may illegally search the search result information. The illegal information detection device according to claim 2, wherein the illegal information detection device detects the information as highly specific information. The search result information storage unit stores time information of the search result information in association with the search result information,
5. The illegal information detection device according to claim 2, wherein the feature extraction unit extracts a feature amount from search result information in a predetermined time information range stored in the search result information storage unit. 6. .   The illegal information detection device according to claim 1, wherein the search result information is content that is information disclosed on the network or information related to the content.   The feature extraction unit extracts at least one of a character vector, a word vector, a cepstrum, or shape information as a feature amount of the search result information, according to any one of claims 1 to 6. The illegal information detection device described. An illegal information detection method for detecting highly illegal information from search result information searched based on search conditions for information published on a network,
A feature amount extraction step of extracting a feature amount from the search result information;
Similarity between each of the search result information is calculated from the plurality of feature amounts extracted by the feature extraction step, and the similarity is determined based on the similarity. A calculation step;
An illegal information detection method comprising: an illegality detection step of detecting, when the number of search result information determined to be similar in the similarity calculation step exceeds a predetermined value, the search result information as highly illegal information. A search result information storing step of acquiring search result information searched based on the search condition and storing the search result information in a search result information storage unit is further provided,
The illegal information detection method according to claim 8, wherein the feature extraction step extracts a feature amount from search result information stored in the search result information storage unit. A search condition storage step of acquiring the search condition and storing it in the search condition storage unit;
The feature extraction step extracts a feature amount from a search condition stored in the search condition storage unit and search result information stored in the search result information storage unit corresponding to the search condition. Illegal information detection method.   If the number of search result information in which the number of searches of the search result information exceeds a predetermined value among the search result information determined to be similar in the similarity calculation step exceeds the predetermined value, the illegality detection step The illegal information detection method according to claim 9 or 10, wherein the result information is detected as highly illegal information.   The illegal information detection method according to claim 9, wherein the feature extraction step extracts a feature amount from the search result information in a predetermined time information range.   The illegal information detection method according to any one of claims 8 to 12, wherein the search result information is content that is information disclosed on the network or information related to the content.   14. The feature extraction step according to claim 8, wherein at least one of a character vector, a word vector, a cepstrum, or shape information is extracted as a feature amount of the search result information. The illegal information detection method described. An illegal information detection program for causing a computer to execute processing for detecting highly illegal information from search result information searched based on a search condition for information published on a network,
A search result information storage unit for storing the search result information;
Feature extraction means for extracting a feature quantity from the search result information stored in the search result information storage section, and storing the feature quantity and the search result information in association with each other in the feature quantity storage section;
Similarity that calculates similarity between each of the search result information from a plurality of feature values stored in the feature value storage unit, and determines whether the search result information is similar based on the similarity Degree calculation means,
An illegal information detection program comprising: illegality detection means for detecting search result information as highly illegal information when the number of search result information determined to be similar by the similarity calculation means exceeds a predetermined value.   The illegal information detection program according to claim 15, further comprising search result information storage means for acquiring search result information searched based on the search condition and storing the search result information in the search result information storage unit. . The illegal information detection program is:
A search condition storage unit for storing the search conditions;
Search condition storage means for acquiring the search condition and storing it in the search condition storage unit;
The feature extraction unit extracts a feature amount from a search condition stored in the search condition storage unit and search result information stored in the search result information storage unit corresponding to the search condition. Illegal information detection program. The search result information storage unit stores the number of searches of the search result information in association with the search result information,
When the number of search result information in which the number of searches exceeds a predetermined value among search result information determined to be similar by the similarity calculation unit exceeds the predetermined value, the illegality detection unit may illegally search the search result information. The illegal information detection program according to claim 16 or 17, wherein the illegal information detection program detects the information as highly specific information. The search result information storage unit stores time information of the search result information in association with the search result information,
The illegal information detection program according to any one of claims 16 to 18, wherein the feature extraction unit extracts a feature amount from search result information in a predetermined time information range stored in the search result information storage unit. .   The illegal information detection program according to any one of claims 15 to 19, wherein the search result information is content that is information disclosed on the network or information related to the content.   The feature extraction unit extracts at least one of a character vector, a word vector, a cepstrum, or shape information as a feature amount of the search result information, according to any one of claims 15 to 20. The illegal information detection program described.

Images