JP5121888B2 - Apparatus and method for determining spam IP address and apparatus and method for determining spam query - Google Patents

Description

  The present invention relates to an apparatus and method for determining a spam IP address, and an apparatus and method for determining a spam query.

  In recent years, a very large number of web pages have been released in document systems such as WWW (World Wide Web) via a network. The user inputs an appropriate query at the search site, selects a URL (Uniform Resource Locator) of the web page that matches the search condition from a plurality of candidates displayed as search results, and follows the link to the selected URL. Thus, a desired web page can be browsed.

  By the way, for a company, whether or not its own web page is listed at the top of the search result page (especially the first page) is extremely important because it greatly affects the number of accesses to the company's web page. Therefore, each company has devised various methods so that their web page is listed above the search result page. Examples of these ideas include selecting the target query appropriately, bringing the appropriate keyword corresponding to the query near the top of the title or web page, and the keyword corresponding to the query in the web page. Techniques such as properly using and linking to sites related to more queries are widely known.

  However, there are also fraudsters that automatically and repeatedly send spam queries to a search site for the purpose of ranking a specific web page higher in the search result page. The fraudulent trader automatically transmits a combination of a specific product name or service name and a specific company name to the search site as a spam query. This is intended to display a web page of a specific company at a higher position on the search result page in response to a query including the specific product name or service name input by a general user.

  On the other hand, for an operator who operates a search site, if the above-mentioned fraud is performed, an appropriate search result page corresponding to the content of the original web page may be returned to a query input by a normal user. become unable. Therefore, search site operators need to properly detect fraudsters and eliminate the effects of spam queries sent by fraudsters when determining the display order of each web page for a query. There is.

  In detecting fraudsters, it is conceivable to appropriately determine spam queries, but even spam queries that are automatically sent are often indistinguishable from regular queries. In addition, there is a clever trick of mixing regular queries that are not spam queries, making spam queries more difficult to distinguish.

  Patent Document 1 discloses a link destination evaluation unit that evaluates a website linked from a blog, a blog evaluation unit that evaluates a blog using the evaluation result of the website, and a blog based on the blog evaluation. Although a spam blog detection device including a determination unit for determining whether or not a spam blog is disclosed, the spam blog detection device does not solve the above-described problem relating to the determination of a spam query.

JP 2010-066980 A

  Against this background, there has been a demand for a technique for effectively and efficiently discriminating spam queries. The present invention has been made in view of such a point, and an object thereof is to provide an apparatus and method for effectively and efficiently discriminating spam queries. Furthermore, an object of the present invention is to provide an apparatus and method for effectively and efficiently determining a spam IP address of an apparatus that transmits a spam query.

  The present invention provides the following solutions.

  (1) A search log storage unit that stores a search log in which a query is associated with an IP address of a terminal that has transmitted the query, and a query transmitted from a terminal having a specific IP address is referred to the search log storage unit. A first query extraction unit that extracts the IP address of the terminal that has transmitted the query extracted by the first query extraction unit with reference to the search log storage unit. Second query extraction for extracting a query transmitted from the terminal having the IP address extracted by the first IP address extracting means or the second IP address extracting means with reference to the search log storage means And the IP address of the terminal that has transmitted the query extracted by the second query extraction means with reference to the search log storage means The second IP address extracting means, the repeating means for alternately and repeatedly executing the query extraction by the second query extracting means and the IP address extraction by the second IP address extracting means, and the repeating means The IP when the number of types of IP addresses extracted by the IP address extracting means when it is repeated a first number of times is repeated a second number of times greater than the first number of times by the repeating means. Spam IP address discrimination means for obtaining a ratio to the number of types of IP addresses extracted by the address extraction means, and for determining that the specific IP address is a spam IP address when the ratio value is equal to or greater than a predetermined value A spam IP address discrimination device comprising:

  According to the invention described in (1), the search log storage unit stores a search log that associates a query with the IP address of a terminal that has transmitted the query, and the first query extraction unit stores a specific IP address. The query transmitted from the terminal having the address is extracted with reference to the search log storage unit, and the first IP address extracting unit extracts the IP address of the terminal that has transmitted the query extracted by the first query extracting unit, The second query extracting unit searches for a query transmitted from the terminal having the IP address extracted by the first IP address extracting unit or the second IP address extracting unit. The second IP address extracting means extracts the IP address of the terminal that has transmitted the query extracted by the second query extracting means, by referring to the log storage means. To extract the reference means. Then, the repetition means repeatedly executes the query extraction by the second query extraction means and the IP address extraction by the second IP address extraction means, and the spam IP address determination means performs the first operation by the repetition means. The number of IP address types extracted by the IP address extracting means when it is repeated a number of times is extracted by the IP address extracting means when it is repeated a second number of times larger than the first number of times by the repeating means. A ratio to the number of types of IP addresses obtained is obtained. If the ratio value is equal to or greater than a predetermined value, the spam IP address determining means determines that the specific IP address is a spam IP address.

  In the case of a normal IP address, the spam IP address discriminator extracts after the second number of iterations compared to the number of IP address types that the spam IP address discriminator extracts after the first number of iterations. The number of types of IP addresses to be increased sufficiently. On the other hand, in the case of a spammer's spam IP address, the number of IP addresses that can be used by the fraudulent company is limited. The rate of increase in the number of address types is low. Paying attention to this, the spam IP address discriminating apparatus determines the IP address when the number of types of IP addresses extracted by the IP address extracting means when it is repeated the first number of times is repeated the second number of times. If the ratio of the number of types of IP addresses extracted by the extracting means is a predetermined value or more, it is determined that the IP address is a spam IP address.

  This makes it possible to efficiently and effectively determine the spam IP address of the fraudster, including the clever trick of camouflaging a normal query that is not spam into the spam query.

  (2) A method executed by the spam IP address discriminating apparatus, which refers to a search log database storing a search log in which a query and an IP address of a terminal that has transmitted the query are associated with each other. A first query extracting step for extracting a query transmitted from a terminal, and a first query extracting the IP address of the terminal that has transmitted the query extracted in the first query extracting step with reference to the search log database An IP address extraction step and a second query for extracting a query transmitted from the terminal having the IP address extracted in the first IP address extraction step or the second IP address extraction step with reference to the search log database An IP address of a terminal that has transmitted the query extracted in the extraction step and the second query extraction step; The second IP address extraction step to be extracted by reference, a repetition step of repeatedly executing the query extraction by the second query extraction step and the IP address extraction by the second IP address extraction step alternately The number of IP address types extracted in the IP address extraction step when the IP address extraction step is repeated a first number of times, the IP address extraction step being a second number of times greater than the first number of times. Spam for determining the ratio of the number of types of IP addresses extracted in the IP address extraction step when it is repeated and determining that the specific IP address is a spam IP address when the ratio is equal to or greater than a predetermined value A spam IP address discrimination method including an IP address discrimination step.

  According to the invention described in (2), the same effect as in (1) can be expected by using the method.

  (3) A search log storage unit that stores a search log in which a query is associated with an IP address of a terminal that has transmitted the query, and an IP address of a terminal that has transmitted the specific query are referred to the search log storage unit. A first IP address extracting unit that extracts the query transmitted from the terminal having the IP address extracted by the first IP address extracting unit with reference to the search log storage unit. Extraction means and second IP address extraction means for extracting the IP address of the terminal that has transmitted the query extracted by the first query extraction means or the second query extraction means with reference to the search log storage means And a query transmitted from the terminal having the IP address extracted by the second IP address extracting means is extracted with reference to the search log storage means. The second query extracting unit, a repeating unit that alternately and repeatedly executes the extraction of the IP address by the second IP address extracting unit and the extraction of the query by the second query extracting unit, and the repeating unit The IP when the number of types of IP addresses extracted by the IP address extracting means when it is repeated a first number of times is repeated a second number of times greater than the first number of times by the repeating means. Spam query determination means for determining a ratio to the number of types of IP addresses extracted by the address extraction means and determining that the specific query is a spam query when the ratio value is equal to or greater than a predetermined value. Spam query discrimination device.

  By the way, in the case of a normal query, the number of types of IP addresses extracted after repeating the second number of times is sufficiently larger than the number of types of IP addresses extracted after repeating the first number of times. To increase. On the other hand, in the case of a spam query transmitted from a spam IP address of a fraudulent trader, the number of IP addresses that can be used by the fraudulent trader is limited. The rate of increase in the number of types of IP addresses extracted by is reduced. Focusing on this, the rate of increase in the number of types of IP addresses extracted by the spam query determination device is low. Focusing on this, the spam query discriminating apparatus extracts the IP address when the number of types of IP addresses extracted by the IP address extracting means when it is repeated the first number of times is repeated the second number of times. When the ratio to the number of types of IP addresses extracted by the means is a predetermined value or more, the specific query is determined to be a spam query.

  As a result, it is possible to efficiently and effectively discriminate spam queries transmitted from fraudulent contractors' devices, including a clever technique of camouflaging ordinary queries that are not spam into spam queries.

  (4) A method executed by the spam query determination device, which transmits a specific query with reference to a search log database in which a search log in which the query is associated with the IP address of the terminal that transmitted the query is stored. A first IP address extracting step for extracting the IP address of the terminal, and a query transmitted from the terminal having the IP address extracted in the first IP address extracting step with reference to the search log database. Query extraction step, and second IP address extraction for extracting the IP address of the terminal that has transmitted the query extracted by the first query extraction step or the second query extraction step with reference to the search log database A query transmitted from the terminal having the IP address extracted in the step and the second IP address extracting step, and the search log data A second query extracting step for extracting with reference to a base; an iterative step for alternately and repeatedly executing extraction of an IP address by the second IP address extracting step and extraction of a query by the second query extracting step; The number of IP address types extracted in the IP address extraction step when the IP address extraction step is repeated a first number of times, the IP address extraction step being a second number of times greater than the first number of times. Spam query determination that obtains a ratio to the number of types of IP addresses extracted in the IP address extraction step when it is repeated and determines that the specific query is a spam query when the ratio value is equal to or greater than a predetermined value A spam query determination method including a process.

  According to the method described in (4), the same effect as in (3) can be expected by using the method.

  According to the present invention, there is provided an apparatus and method for efficiently and effectively discriminating a spam IP address and a spam query of a fraudulent trader, including a clever technique of camouflaging a normal query that is not spam into a spam query. Can be provided.

It is a figure showing the whole composition for explaining spam IP address discriminating device 1 concerning a 1st embodiment. It is a figure which shows the outline after performing the designation | designated operation of an IP address when selecting the spam IP address when the spam IP address discrimination device 1 which concerns on 1st Embodiment is used. It is a flowchart of spam IP address discriminating device 1 concerning a 1st embodiment. It is a figure which shows the usage example of the spam IP address discrimination device 1 which concerns on 1st Embodiment. It is a figure following FIG. It is a figure following FIG. It is a figure which shows the whole structure for demonstrating the spam query discrimination | determination apparatus 101 which concerns on 2nd Embodiment. It is a figure which shows the outline after performing the designation | designated operation of a query when using the spam query discrimination | determination apparatus 101 which concerns on 2nd Embodiment until it selects a spam query. It is a flowchart of the spam query discrimination | determination apparatus 101 which concerns on 2nd Embodiment. It is a figure which shows the usage example of the spam query discrimination | determination apparatus 101 which concerns on 2nd Embodiment. It is a figure following FIG. It is a figure following FIG. It is a figure following FIG.

[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.

[overall structure]
FIG. 1 is a diagram showing an overall configuration for explaining a spam IP address discrimination device 1 according to the first embodiment. The spam IP address determination device 1 includes a control unit 10 and a storage unit 20. The control unit 10 is a part that comprehensively controls each function related to the spam IP address discriminating apparatus 1, and includes a first query extraction unit 11, a first IP address extraction unit 12, a second query extraction unit 13, A second IP address extracting unit 14, a repeating unit 15, and a spam IP address determining unit 16 are provided. On the other hand, the storage unit 20 stores various programs (not shown) and a database for functioning as the spam IP address determination device 1 and includes a search log database 21.

  First, the search log database 21 will be described. Normally, a terminal user who uses the terminal 2 inputs a query related to an item to be searched from the terminal 2 using a search engine (not shown). The terminal 2 receives this, transmits it to the search engine, and the search process is executed. The search log database 21 stores past queries that have been accepted and transmitted along with such search processing. That is, the search log database 21 functions as a search log storage unit, and the search log database 21 associates the query, the IP address of the terminal 2 that transmitted the query, and the date and time when the query was received from the terminal 2. A search log is stored.

The first query extraction unit 11 extracts a query transmitted from the terminal 2 with the specific IP address IP ₀ with reference to the search log database 21. Here, the processing of the first query extraction unit 11 is set to 1 hop, and the query extracted by the first query extraction unit 11 in the first hop processing is represented by Q ₁₁ , Q ₁₂ ,... Q _1i in FIG. Correspond. The first query extraction unit 11 functions as a first query extraction unit.

For each query extracted by the first query extraction unit 11, the first IP address extraction unit 12 extracts the IP address of the terminal 2 that has transmitted these queries with reference to the search log database 21. Here, the processing of the first IP address extraction unit 12 is set to 2 hop, and the IP addresses extracted by the first IP address extraction unit 12 in the second hop processing are IP ₂₁ , IP ₂₂ ,. Corresponds to IP _2j . The first IP address extraction unit 12 functions as first IP address extraction means. In addition, the 2hop th 2, the query _{Q 11, Q 12, ··· Q} 1i of IP addresses of the transmitted terminal 2, IP address _IP 21 of the terminal 2 that has transmitted the query _{Q 12, IP 22,} ... only IP _2j is described, but the first IP address extraction unit 12 also extracts the IP address of the terminal 2 that has transmitted another query.

  The second query extraction unit 13 extracts the query transmitted from the terminal having the IP address extracted by the first IP address extraction unit 12 with reference to the search log database 21. The processing of the second query extraction unit 13 here is 3 hop (not shown). The second query extraction unit 13 functions as second query extraction means.

  The second IP address extraction unit 14 extracts the IP address of the terminal that has transmitted the query extracted by the second query extraction unit 13 with reference to the search log database 21. The processing of the second IP address extracting unit 14 here is 4 hops (not shown). The second IP address extraction unit 14 functions as second IP address extraction means.

  The repeater 15 repeatedly executes the query extraction by the second query extractor 13 and the IP address extraction by the second IP address extractor 14 alternately. That is, the repetition unit 15 extracts the query by the second query extraction unit 13 as 5 hops, extracts the IP address by the second IP address extraction unit 14 as 6 hops, and so on. The process is repeated until the IP address extraction unit 14 extracts the IP address. However, the 5th hop query extraction uses the IP address extracted at the 4th hop, and the 6th hop IP address extraction uses the query extracted at the 5th hop. The repeating unit 15 functions as a repeating unit. In FIG. 2, only the query transmitted from the terminal 2 having a part of the IP address and the IP address of the terminal 2 that has transmitted the part of the query are described. The query transmitted from the terminal 2 having an address and the IP address of the terminal 2 that transmitted another query are also extracted.

The spam IP address discriminating unit 16 has the number of types of IP addresses extracted by the first IP address extracting unit 12 or the second IP address extracting unit 14 when the repeating unit 15 repeats the first number of times. A ratio to the number of types of IP addresses extracted by the second IP address extracting unit 14 when the repetition unit 15 repeats the second number of times is obtained. That is, the spam IP address discriminating unit 16 determines the number of types of IP addresses extracted by the first IP address extracting unit 12 or the second IP address extracting unit 14 when the repeating unit 15 repeats the first number of times. Is used as a numerator, and a ratio value is obtained with the number of types of IP addresses extracted by the second IP address extraction unit 14 when the repetition unit 15 repeats the second number of times as a denominator. The spam IP address discriminating unit 16 discriminates that the specific IP address IP ₀ is a spam IP address when the ratio value obtained is equal to or greater than a predetermined threshold value. The spam IP address determination unit 16 functions as a spam IP address determination unit. Further, the “predetermined threshold value” is a value predetermined by the user.

  By the way, if the query extraction and the IP address extraction are repeated, the “number” of IP addresses extracted by the first IP address extraction unit 12 or the second IP address extraction unit 14 increases. Even if the IP address extraction unit 12 or the second IP address extraction unit 14 extracts an IP address, it takes a lot of calculation processing time for the spam IP address determination unit 16 to calculate the “number of types” of the IP address. . Therefore, in particular, in order to reduce the calculation processing time, when calculating the “number of types” of the IP address, the first IP address extraction unit 12 or the second IP address when the repetition unit 15 repeats the first number of times. A predetermined number of IP addresses are randomly extracted from the IP addresses extracted by the IP address extracting unit 14, and the “number of types” of IP addresses can be estimated from the degree of duplication of the extracted IP addresses. Similarly, for the second number of times, a predetermined number of IP addresses are randomly extracted from the IP addresses extracted by the second IP address extraction unit 14 when the repetition unit 15 repeats the second number of times. The “number of types” of IP addresses can be estimated from the degree of duplication of the extracted IP addresses.

[Hardware and Software Configuration of this Embodiment]
The hardware and software configurations of this embodiment will be described. The hardware of the spam IP address discrimination device 1 includes a CPU as a control device (control unit), a storage device (storage unit), a communication device (communication unit), a display device (display unit), and an input device (input unit). ) Is included. Examples of the storage device (storage unit) include a memory (RAM, ROM, etc.), a hard disk drive (HDD), an optical disk (CD, DVD, etc.) drive, and the like. Examples of the communication device (communication unit) include various wired or wireless interface devices. Examples of the display device (display unit) include various displays such as a liquid crystal display or a plasma display. Examples of the input device (input unit) include a keyboard, a pointing device (such as a mouse), a remote control device, and the like.

  The software of the spam IP address discrimination device 1 includes a program and data for controlling the hardware. Programs and data are stored in a storage device (storage unit), and are appropriately executed and referenced by a control device (control unit). Further, the computer program and data can be distributed by an electromagnetic method, or can be recorded and distributed on a computer-readable medium such as a CD-ROM.

[flowchart]
FIG. 3 is a flowchart of the spam IP address discrimination device 1 according to the first embodiment.

In step S1, the first query extraction unit 11 performs a first query extraction process. In this process, the first query extraction unit 11 performs a process of extracting a query transmitted from the terminal 2 having a specific IP address with reference to the search log database 21. The specific IP address IP ₀ is specified by specifying an arbitrary IP address that is to be determined whether it is a spam IP address from among the IP addresses stored in the search log database 21. Preferably, a predetermined process for removing an IP address that causes an error from the IP addresses stored in the search log database 21 may be performed and designated from among them.

  In step S2, the first IP address extraction unit 12 performs a first IP address extraction process. In this process, the first IP address extraction unit 12 refers to the search log database 21 for the IP address of the terminal 2 that has transmitted these queries for each query extracted by the first query extraction unit 11. Process to extract.

  In step S3, the second query extraction unit 13 performs a second query extraction process. In this process, the second query extraction unit 13 performs a process of extracting the query transmitted from the terminal 2 having the IP address extracted by the first IP address extraction unit 12 with reference to the search log database 21. .

  In step S4, the second IP address extraction unit 14 performs a second IP address extraction process. In this process, the second IP address extraction unit 14 performs a process of extracting the IP address of the terminal 2 that has transmitted the query extracted by the second query extraction unit 13 with reference to the search log database 21.

  In step S5, the repetition unit 15 performs a repetition process. In this process, the repetition unit 15 repeatedly performs the query extraction by the second query extraction unit 13 and the IP address extraction by the second IP address extraction unit 14 alternately. That is, the repetition unit 15 extracts the query by the second query extraction unit 13 as 5 hops, extracts the IP address by the second IP address extraction unit 14 as 6 hops, and so on. The process is repeated until the IP address extraction unit 14 extracts the IP address. However, the extraction of the IP address uses the query extracted immediately before, and the extraction of the query uses the IP address extracted immediately before. For example, the extraction of the fifth hop query uses the IP address extracted in the fourth hop, and the extraction of the sixth hop IP address uses the query extracted in the fifth hop.

In step S6, the spam IP address determination unit 16 performs a spam IP address determination process. In this process, the spam IP address discriminating unit 16 determines the IP address extracted by the first IP address extracting unit 12 or the second IP address extracting unit 14 when it is repeated by the repeating unit 15 a first number of times. A ratio of the number of types to the number of types of IP addresses extracted by the second IP address extraction unit 14 when the repetition unit 15 repeats the second number of times is obtained, and the value of the obtained ratio is a predetermined threshold value. In the above case, a process for determining that the specific IP address IP ₀ is a spam IP address is performed. When this process ends, the control unit 10 ends the series of processes.

[Example of Spam IP Address Discriminating Device 1 According to the First Embodiment]
4-7 is a figure which shows an example when the invention which concerns on the IP address discrimination | determination apparatus 1 as described in 1st Embodiment is implemented.

First, FIG. 4 will be described. First, the first query extraction unit 11 extracts a query transmitted from a terminal having a specific IP address IP ₀ with reference to the search log database 21. The processing of the first query extraction unit 11 here is 1 hop.

  FIG. 4 shows an example when the first query extraction unit 11 extracts a query transmitted on June 1, 2010 from a specific IP address “123.45.678.901”. The first line indicates a specific IP address and a date when the query is transmitted from the specific IP address, and is described as “IP address = 123.45.678.901, Date = 201100601”. The second and subsequent lines indicate the query transmitted from the terminal having the IP address “123.45.678.901” on June 1, 2010, and the number of times the query has been transmitted. “Forex abc securities” has been sent 4 times, query “camp license ghi driving school” has been sent 3 times, query “net shop logistics” has been sent 5 times, etc.

  Next, FIG. 5 will be described. For each query extracted by the first query extraction unit 11, the first IP address extraction unit 12 extracts the IP address of the terminal 2 that has transmitted these queries with reference to the search log database 21. Note that the processing of the first IP address extraction unit 12 here is 2 hops.

  FIG. 5 shows the queries extracted by the first query extraction unit 11, that is, the queries “Forex abc securities”, “camp license ghi driving school”, “net shop logistics”, etc. shown in FIG. An example in which the first IP address extracting unit 12 extracts the IP address of the terminal 2 that has transmitted these queries with reference to the search log database 21 will be described. The first block shows the IP address of the terminal that sent the query “Forex abc securities” on June 1, 2010, for example, “123.45.678.901”, “234.567.789.012”. , “345.678.901.234” and the like. A character on the right of the IP address indicates a query transmitted from a terminal having the IP address, and a character on the right of the query indicates the number of times the query is transmitted.

  The second block shows the IP address of the terminal that sent the query “camping camp license ghi driving school” on June 1, 2010. For example, “123.45.678.901”, “201.35.679. 023 "," 345.678.901.234 "and the like. The third block shows the IP address of the terminal that sent the query “net shop logistics” on the same day. For example, “123.45.678.901”, “345.678.901234”, “45.67”. .89.012 "and the like.

  Next, FIG. 6 will be described. The second query extraction unit 13 extracts the query transmitted from the terminal having the IP address extracted by the first IP address extraction unit 12 with reference to the search log database 21, and the second IP address extraction unit 14 extracts the IP address of the terminal that has transmitted the query extracted by the second query extraction unit 13 with reference to the search log database 21. Then, the repeating unit 15 repeatedly executes the query extraction by the second query extraction unit 13 and the IP address extraction by the second IP address extraction unit 14 alternately. That is, the second query extraction unit 13 extracts a query as 3 hops, the second IP address extraction unit 14 extracts an IP address as 4 hops, and then the repetition unit 15 performs 5 hops. Extraction of query by second query extraction unit 13, extraction of IP address by second IP address extraction unit 14 as 6 hop, extraction of IP address by second IP address extraction unit 14 as n hop Repeat until. However, the query extraction uses the IP address extracted immediately before, and the IP address extraction uses the query extracted immediately before. For example, the extraction of the third hop query uses the IP address extracted in the second hop, and the extraction of the fourth hop IP address uses the query extracted in the third hop. The extraction of the fifth hop query uses the IP address extracted in the fourth hop.

  In FIG. 6, the repetition unit 15 repeats the query extraction by the second query extraction unit 13 and the IP address extraction by the second IP address extraction unit 14 until the IP address is extracted as m hop. The result of extraction of the IP address at the time of m hop is shown. The view is the same as in FIG. 5. From the top, the IP address of the terminal that sent the query “May doll def doll store”, the query “glasses stu glasses store”, and the query “diamond purchase shop” on June 1, 2010. Indicates.

  The underline is attached for convenience of explanation, and is not attached as output information from the IP address discrimination device 1. The meaning of the underline will be explained later.

By the way, the spam IP address discriminating unit 16 determines the number of types of IP addresses extracted by the first IP address extracting unit 12 or the second IP address extracting unit 14 when the repeating unit 15 repeats the first number of times. The ratio of the number of types of IP addresses extracted by the second IP address extraction unit 14 when the repetition unit 15 repeats the second number of times is obtained. The spam IP address discriminating unit 16 discriminates that the specific IP address IP ₀ is a spam IP address when the ratio value obtained is equal to or greater than a predetermined threshold value.

  In the first embodiment, m and n are positive even numbers that satisfy m <n. This will be described with reference to FIG. Referring to FIG. 6, the IP address extracted by the first IP address extraction unit 12 or the second IP address extraction unit 14 when the repetition unit 15 repeats the first number of times (up to m hop) is: "123.45.678.901", "156.43.621.724", etc. Here, although the underline is drawn for convenience, this is an overlapping IP address extracted by the first IP address extracting unit 12 or the second IP address extracting unit 14. In calculating the “number of types”, the overlapping items are collectively calculated as “1”. Therefore, in the range shown in FIG. 6, in the range shown in FIG. The number of types of IP addresses extracted by the IP address extracting unit 12 or the second IP address extracting unit 14 is “13”. Actually, there are some that are not explicitly shown in FIG. 6, and as described in the lower right of FIG. 6, the description here assumes that the number of types of IP addresses is “50”.

  Although not shown, the number of IP address types extracted by the second IP address extraction unit 14 when the repetition unit 15 repeats the second number of times (up to n hop) is “80”. It will be explained as being.

  The number of IP address types extracted by the first IP address extraction unit 12 or the second IP address extraction unit 14 when the repetition unit 15 repeats the first number of times is “50”, and the repetition unit 15 If the number of types of IP addresses extracted by the second IP address extracting unit 14 when it is repeated by the second number of times is “80”, the ratio of the former to the latter is 50/80 (= 0.625) ) If the predetermined threshold is less than 0.625, the value of the ratio is equal to or greater than the predetermined threshold. Therefore, the spam IP address determination unit 16 determines that the specific IP address “123.45.678.901” is the spam IP address. It is determined that

  According to the invention described in the first embodiment, the search log database 21 stores a search log in which a query and an IP address of a terminal that has transmitted the query are associated with each other. The query transmitted from the terminal having the IP address is extracted with reference to the search log database 21, and the first IP address extracting unit 12 determines the IP address of the terminal that transmitted the extracted query as the search log database 21. Extract by referring to. Then, the second query extraction unit 13 extracts the query transmitted from the terminal of the IP address extracted by the first IP address extraction unit 12 with reference to the search log database 21, and the second IP address The extraction unit 14 extracts the IP address of the terminal that has transmitted the query extracted by the second query extraction unit 13 with reference to the search log database 21, and the repetition unit 15 is based on the second query extraction unit 13. The query extraction and the IP address extraction by the second IP address extraction unit 14 are repeatedly performed alternately, and the spam IP address determination unit 16 performs the first operation when the repetition unit 15 repeats the first number of times. The number of types of IP addresses extracted by the IP address extraction unit 12 or the second IP address extraction unit 14 is updated by the repetition unit 15. Determining the ratio of the number of types of the extracted IP address by a second IP address extraction section 14 when only repeated number of. If the ratio value is equal to or greater than a predetermined value, the spam IP address determination unit 16 determines that the specific IP address is a spam IP address.

  In the case of a normal IP address, the spam IP address discriminating apparatus 1 after repeating the second number of times compared to the number of types of IP addresses extracted by the spam IP address discriminating apparatus 1 after repeating the first number of times. The number of types of IP addresses extracted by will increase sufficiently. On the other hand, since the number of IP addresses that can be used by a fraudulent trader is limited in the case of a spammer IP address of a fraudulent trader, the spam IP address discriminating apparatus 1 extracts it compared to the case of a normal IP address. The rate of increase in the number of types of IP addresses is low. Paying attention to this, the spam IP address discriminating apparatus 1 determines that the IP number when the number of IP address types extracted by the IP address extracting means when it is repeated for the first number of times is repeated for the second number of times. When the ratio with respect to the number of types of IP addresses extracted by the address extracting means is a predetermined value or more, it is determined that the IP address is a spam IP address.

  This makes it possible to efficiently and effectively determine the spam IP address of the fraudster, including the clever trick of camouflaging a normal query that is not spam into the spam query.

[Second Embodiment]
Hereinafter, a second embodiment of the present invention will be described with reference to the drawings.

[overall structure]
FIG. 7 is a diagram showing an overall configuration for explaining the spam query determination apparatus 101 according to the second embodiment. The spam query determination apparatus 101 includes a control unit 110 and a storage unit 120. The control unit 110 is a part that comprehensively controls each function related to the spam query determination device 101, and includes a first IP address extraction unit 111, a first query extraction unit 112, a second IP address extraction unit 113, A second query extraction unit 114, a repetition unit 115, and a spam query determination unit 116 are provided. On the other hand, the storage unit 120 is a part that stores various programs (not shown) and a database for functioning as the spam query determination device 101, and includes a search log database 121.

  The search log database 121 has the same configuration as the search log database 21 of the first embodiment, and functions as a search log storage unit. The search log database 121 stores a search log that associates a query, the IP address of the terminal 102 that transmitted the query, and the date and time when the query was received from the terminal 102.

The first IP address extraction unit 111 extracts the IP address of the terminal 102 that has transmitted the specific query Q ₀ with reference to the search log database 121. Here, the processing of the first IP address extracting unit 111 is set to 1 hop, and the IP addresses extracted by the first IP address extracting unit 111 in the first hop processing are IP ₁₁ , IP ₁₂ ,. Corresponds to IP _1i . The first IP address extracting unit 111 functions as a first IP address extracting unit.

The first query extraction unit 112 extracts a query transmitted from the terminal 102 having the IP address extracted by the first IP address extraction unit 111 with reference to the search log database 121. Here, the processing of the first query extraction unit 112 is set to 2 hop, and the query extracted by the first query extraction unit 112 in the second hop processing is represented by Q ₂₁ , Q ₂₂ ,... Q _2j in FIG. Correspond. The first query extraction unit 112 functions as a first query extraction unit. 8 and 2 hop, among queries transmitted from the terminal 102 having the IP addresses IP ₁₁ , IP ₁₂ ,... IP _1i , queries Q ₂₁ , Q transmitted from the terminal 102 having the IP _{12 22} ,..., Q _2j are only described, but the first query extraction unit 112 also extracts queries transmitted from the terminals 102 having other IP addresses.

  The second IP address extraction unit 113 extracts the IP address of the terminal that has transmitted the query extracted by the first query extraction unit 112 with reference to the search log database 121. Here, the processing of the second IP address extraction unit 113 is 3 hops. The second IP address extracting unit 113 functions as a second IP address extracting unit. Also, the extraction of the IP address of the third hop uses the IP address extracted in the second hop.

  The second query extraction unit 114 extracts a query transmitted from the terminal 102 having the IP address extracted by the second IP address extraction unit 113 with reference to the search log database 121. The processing of the second query extraction unit 114 here is 4 hops. The second query extraction unit 114 functions as a second query extraction unit. The extraction of the IP address of the 4th hop uses the IP address extracted in the 3rd hop.

  The repeating unit 115 repeatedly performs the IP address extraction by the second IP address extraction unit 113 and the query extraction by the second query extraction unit 114 alternately. That is, the repetition unit 115 extracts the IP address by the second IP address extraction unit 113 as 5 hop, the query by the second query extraction unit 114 as 6 hop, and so on. The process is repeated until the IP address extraction unit 113 extracts the IP address. The repeater 115 functions as a repeater. FIG. 8 shows only the IP addresses of the terminals 102 that have transmitted some queries and the queries transmitted from the terminals 102 that have some IP addresses. Queries transmitted from the terminal 102 having the IP address of the terminal 102 that has transmitted and other IP addresses are also extracted. However, the query extraction uses the IP address extracted immediately before, and the IP address extraction uses the query extracted immediately before. For example, the extraction of the IP address at the 5th hop uses the query extracted at the 4th hop, and the extraction of the query at the 6th hop uses the IP address extracted at the 5th hop.

The spam query determination unit 116 repeats the number of IP address types extracted by the second IP address extraction unit 113 when the repetition unit 115 is repeated the first number of times by the repetition unit 115 a second number of times. The ratio with respect to the number of types of IP addresses extracted by the second IP address extracting unit 113 is obtained. That is, the spam query determination unit 116 uses the number of IP address types extracted by the second IP address extraction unit 113 when the repetition unit 115 repeats the first number of times as a numerator, The ratio value having the denominator as the number of IP address types extracted by the second IP address extracting unit 113 when the number of times is repeated is obtained. The spam query determination unit 116, when the value of the determined ratio is not smaller than a predetermined threshold value, the particular query Q ₀ is determined to be spam query. The spam query determination unit 116 functions as a spam query determination unit. Further, the “predetermined threshold value” is a value predetermined by the user.

  By the way, if the query extraction and the IP address extraction are repeated, the “number” of IP addresses extracted by the second IP address extraction unit 113 increases, so that the second IP address extraction unit 113 selects the IP address. Even after extraction, it takes a lot of calculation processing time for the spam query determination unit 116 to calculate the “number of types” of IP addresses. Therefore, in particular, in order to reduce the calculation processing time, when calculating the “number of types” of IP addresses, the IP address is extracted by the second IP address extracting unit 113 when it is repeated by the repeating unit 115 a first number of times. A predetermined number of IP addresses are randomly extracted from the IP addresses, and the “number of types” of IP addresses can be estimated from the degree of duplication of the extracted IP addresses. Similarly, for the second number of times, a predetermined number of IP addresses are randomly extracted from the IP addresses extracted by the second IP address extraction unit 113 when the repetition unit 115 repeats the second number of times. The “number of types” of IP addresses can be estimated from the degree of duplication of the extracted IP addresses.

  The hardware and software configurations of the second embodiment are the same as those of the first embodiment, and the hardware of the spam query determination device 101 includes a storage device in addition to a CPU as a control device (control unit). (Storage unit), communication device (communication unit), display device (display unit), and input device (input unit) are included. Further, the software of the spam query determination apparatus 101 includes a program and data for controlling the hardware.

[flowchart]
FIG. 9 is a flowchart of the spam query determination apparatus 101 according to the second embodiment.

In step S101, the first IP address extraction unit 111 performs a first IP address extraction process. In this process, the first IP address extraction unit 111 performs a process of extracting the IP address of the terminal 102 that has transmitted the specific query Q ₀ with reference to the search log database 121. The specific query Q ₀ is specified by specifying an arbitrary query that is to be determined as to whether it is a spam query from among the queries stored in the search log database 121. Preferably, a predetermined process such as removing a query that causes an error from the queries stored in the search log database 121 may be performed and designated from among them.

  In step S102, the first query extraction unit 112 performs a first query extraction process. In this process, the first query extraction unit 112 performs a process of extracting a query transmitted from the terminal 102 having the IP address extracted by the first IP address extraction unit 111 with reference to the search log database 121. .

  In step S103, the second IP address extraction unit 113 performs a second IP address extraction process. In this process, the second IP address extraction unit 113 performs a process of extracting the IP address of the terminal 102 that has transmitted the query extracted by the first query extraction unit 112 with reference to the search log database 121.

  In step S104, the second query extraction unit 114 performs a second query extraction process. In this process, the second query extraction unit 114 performs a process of extracting the query transmitted from the terminal 102 having the IP address extracted by the second IP address extraction unit 113 with reference to the search log database 121. .

  In step S105, the repetition unit 115 performs a repetition process. In this process, the repetition unit 115 repeatedly performs the IP address extraction by the second IP address extraction unit 113 and the query extraction by the second query extraction unit 114 alternately. That is, the repetition unit 115 extracts the IP address by the second IP address extraction unit 113 as 5 hop, the query by the second query extraction unit 114 as 6 hop, and so on. The process is repeated until the IP address extraction unit 113 extracts the IP address. However, the query extraction uses the IP address extracted immediately before, and the IP address extraction uses the query extracted immediately before. For example, the extraction of the IP address at the 5th hop uses the query extracted at the 4th hop, and the extraction of the query at the 6th hop uses the IP address extracted at the 5th hop.

In step S106, the spam query determination unit 116 performs a spam query determination process. In this process, the spam query discriminating unit 116 uses the repetition unit 115 to calculate the number of IP address types extracted by the second IP address extraction unit 113 when the repetition unit 115 repeats the first number of times. When the number of types of IP addresses extracted by the second IP address extracting unit 113 is repeated for the number of times, the specific query Q is determined when the ratio value is equal to or greater than a predetermined threshold. A process of determining that ₀ is a spam query is performed. When this process ends, the control unit 10 ends the series of processes.

[Example of Spam IP Address Discriminating Device 1 According to Second Embodiment]
10-12 is a figure which shows an example when the invention which concerns on the spam query discrimination device 101 as described in 2nd Embodiment is implemented.

First, FIG. 10 will be described. First, the first IP address extraction unit 111 extracts the IP address of the terminal 102 that has transmitted the specific query Q ₀ with reference to the search log database 121. Note that the processing of the first IP address extraction unit 111 here is 1 hop.

  FIG. 10 shows the case where the first IP address extraction unit 111 extracts the IP address of the terminal 102 that has transmitted the specific query “Forex abc securities” on June 1, 2010 with reference to the search log database 121. An example of The first line indicates a specific query and date, and is described as “Query = Forex abc securities, Date = 201100601”. The second and subsequent lines indicate the IP address of the terminal 102 that transmitted the query “Forex abc securities” on June 1, 2010, the query transmitted from the terminal 102 having the IP address, and the number of times the query is transmitted. From the terminal having the IP address “123.45.678.901”, “foreign exchange abc securities” is transmitted four times.

  Next, FIG. 11 will be described. The first query extraction unit 112 extracts a query transmitted from the terminal 102 having the IP address extracted by the first IP address extraction unit 111 with reference to the search log database 121. Note that the processing of the first query extraction unit 112 here is 2 hops.

  FIG. 11 shows the IP addresses extracted by the first IP address extraction unit 111, that is, “123.45.678.901”, “234.56.7799.012”... Shown in FIG. An example when the first query extraction unit 112 extracts the information by referring to the search log database 121 is shown. The first block shows a query sent from a terminal having an IP address “123.45.678.901” on June 1, 2010. For example, “Forex abc securities”, “camp license ghi driving school” , "Net shop logistics". The characters to the right of the query indicate the number of times that query has been sent.

  The second block shows a query transmitted from the terminal having the IP address “234.56.789.012” on the same day. For example, “Forex abc securities”, “Used car jkl sale”, “Overseas travel mno tours” And so on. The third block shows a query sent from the terminal having the IP address “345.678.901.234” on the same day. For example, “May doll def doll store”, “Glasses stu glasses store”, “Diamond” Purchase shop vwx ".

  Next, FIGS. 12 and 13 will be described. The second IP address extraction unit 113 extracts the IP address of the terminal 102 that has transmitted the query extracted by the first query extraction unit 112 with reference to the search log database 121, and the second query extraction unit 114. Extracts the query transmitted from the terminal 102 having the IP address extracted by the second IP address extracting unit 113 with reference to the search log database 121. Then, the repeating unit 115 alternately and repeatedly performs the extraction of the IP address by the second IP address extracting unit 113 and the extraction of the query by the second query extracting unit 114. That is, the second IP address extraction unit 113 executes extraction of an IP address as 3 hops, the second query extraction unit 114 executes extraction of a query as 4 hops, and then the repetition unit 115 performs 5 hops. IP address extraction by the second IP address extraction unit 113 as the second IP address extraction unit 113 as n hop, extraction of the IP address by the second IP address extraction unit 113 as 6 hop, extraction of the query by the second query extraction unit 114 as 6 hop Repeat until extraction is complete.

  In FIG. 12, the repetition unit 115 repeats the extraction of the IP address by the second IP address extraction unit 113 and the extraction of the query by the second query extraction unit 114 until the IP address is extracted as m hop. The result of extracting the IP address at the m hop is shown. The view is the same as in FIG. 5, and shows the IP address of the terminal that sent the query “Forex abc securities”, the query “camp license ghi driving school”, and the query “net shop logistics” on June 1, 2010 from the top. . In FIG. 13, the repetition unit 115 extracts the IP address as n hop by extracting the IP address by the second IP address extraction unit 113 and extracting the query by the second query extraction unit 114. 10 shows the result of extracting the IP address at the n hop point when the above is repeated. The way of viewing is the same as FIG. 5 and FIG. 12, and from the top, the query “May doll def doll store”, the query “glasses stu glasses store”, and the query “diamond purchase shop vwx” were sent on June 1, 2010. Indicates the IP address of the terminal. The underline is added for convenience of later explanation, and is not added as output information from the spam query determination device 101.

By the way, the spam query discriminating unit 116 uses the repetition unit 115 to calculate the second number of IP address types extracted by the second IP address extraction unit 113 when the repetition unit 115 repeats the first number of times. The ratio with respect to the number of types of IP addresses extracted by the second IP address extracting unit 113 when it is repeated only is obtained. And the spam query discriminating unit 116 discriminates that the specific query Q ₀ is a spam query when the ratio value obtained is equal to or larger than a predetermined threshold value.

  In the second embodiment, the values of m and n are positive odd numbers that satisfy m <n. Referring to FIG. 12, the IP addresses extracted by the second IP address extracting unit 113 when the repetition unit 115 repeats the first number of times are “123.45.678.901” and “234.56”. .789.12 ”... Here, for convenience, the underline is underlined, but this is an overlapping IP address extracted by the second IP address extraction unit 113. When calculating the “number of types”, the overlapping items are collectively calculated as “1”. Therefore, when the number of types is repeated by the repetition unit 115 for the first number of times (up to m hop) within the range specified in FIG. The number of types of IP addresses extracted by the second IP address extracting unit 113 is “13”. Actually, there are some that are not explicitly shown in FIG. 12, so that the number of types of IP addresses is “50” here as shown in the lower right of FIG.

  Referring to FIG. 13, the IP address extracted by the second IP address extraction unit 113 when the repetition unit 115 repeats the second number of times (up to n hop) is “123.45.678. 901 "," 156.43.621.724 ", etc. In the range shown in FIG. 13, the number of types of IP addresses extracted by the second IP address extracting unit 113 when the repetition unit 115 repeats the second number of times is “13”. Actually, there are some that are not explicitly shown in FIG. 13, and therefore, here, as shown in the lower right of FIG. 13, it is assumed that the number of types of IP addresses is “80”.

  The number of types of IP addresses extracted by the second IP address extraction unit 113 when the repetition unit 115 is repeated the first number of times is “50”, and the number of types of IP addresses extracted by the repetition unit 115 is the second number of times. If the number of types of IP addresses extracted by the second IP address extraction unit 113 at that time is “80”, the ratio of the former to the latter is 50/80 (= 0.625). If the predetermined threshold is less than 0.625, the value of the ratio is equal to or greater than the predetermined threshold. Therefore, the spam query determination unit 116 determines that the specific query “foreign abc securities” is a spam query.

According to the invention described in the second embodiment, the search log database 121 stores a search log that associates a query with the IP address of a terminal that has transmitted the query, and the first IP address extraction unit 111 includes: The IP address of the terminal that has transmitted the specific query Q ₀ is extracted with reference to the search log database 121, and the first query extraction unit 112 extracts the query transmitted from the terminal having the IP address as the search log database 121. Extract by referring to. Then, the second IP address extraction unit 113 extracts the IP address of the terminal 102 that has transmitted the query extracted by the first query extraction unit 112 with reference to the search log database 121, and performs the second query extraction. The unit 114 extracts a query transmitted from the terminal having the IP address extracted by the second IP address extracting unit with reference to the search log database 121, and the repeating unit 115 includes the second IP address extracting unit 113. The IP address extraction by the second query extraction unit 114 and the query extraction by the second query extraction unit 114 are alternately and repeatedly executed. The spam query determination unit 116 performs the second IP when the repetition unit 115 repeats the first number of times. The number of types of IP addresses extracted by the address extraction unit 113 is the second number of times by the repetition unit 115. Determining the ratio of the number of types of the returned IP address extracted by the second IP address extraction section 113 when the Ri. Then, if the value of the ratio is equal to or greater than a predetermined value, spam query determination unit 116, the particular query Q ₀ is determined to be spam query.

  In the case of a normal query, the number of types of IP addresses extracted after repeating the second number of times is sufficiently larger than the number of types of IP addresses extracted after repeating the first number of times. . On the other hand, in the case of a spam query transmitted from a spam IP address of a fraudulent trader, the number of IP addresses that can be used by the fraudulent trader is limited. The rate of increase in the number of types of IP addresses extracted by 101 is low. Focusing on this, the rate of increase in the number of types of IP addresses extracted by the spam query determination apparatus 101 is low. Paying attention to this, the spam query discriminating apparatus 101 is repeated the second number of times of the number of types of IP addresses extracted by the second IP address extracting unit 113 when it is repeated the first number of times. When the ratio with respect to the number of types of IP addresses extracted by the second IP address extraction unit 113 is greater than or equal to a predetermined value, it is determined that the query transmitted from the terminal having the IP address is a spam query.

  This makes it possible to efficiently and effectively discriminate spam queries transmitted from a device having a spam IP address of a fraudster, including a clever technique of camouflaging a normal query that is not spam into a spam query.

  It should be noted that the effects described in the first and second embodiments only list the most preferable effects resulting from the present invention, and the effects according to the present invention are the same as those described in the first and second embodiments. It is not limited.

DESCRIPTION OF SYMBOLS 1 Spam IP address discrimination | determination apparatus 10 Control part 11 1st query extraction part 12 1st IP address extraction part 13 2nd query extraction part 14 2nd IP address extraction part 15 Repeat part 16 Spam IP address discrimination | determination part 20 Memory | storage Part 21 Search log database

Claims (4)

A search log storage means for storing a search log that associates the query with the IP address of the terminal that transmitted the query;
First query extraction means for extracting a query transmitted from a terminal having a specific IP address with reference to the search log storage means;
First IP address extracting means for extracting the IP address of the terminal that has transmitted the query extracted by the first query extracting means with reference to the search log storage means;
Second query extraction means for extracting a query transmitted from a terminal having an IP address extracted by the first IP address extraction means or the second IP address extraction means with reference to the search log storage means;
The second IP address extracting means for extracting the IP address of the terminal that has transmitted the query extracted by the second query extracting means with reference to the search log storage means;
Repetitive means for alternately and repeatedly executing query extraction by the second query extraction means and IP address extraction by the second IP address extraction means;
The number of types of IP addresses extracted by the IP address extraction unit when the repetition unit repeats the first number of times is repeated by the repetition unit a second number of times greater than the first number of times. Spam for determining the ratio of the number of types of IP addresses extracted by the IP address extracting means when the ratio is greater than or equal to a predetermined value, and that the specific IP address is a spam IP address A spam IP address discrimination device comprising IP address discrimination means. A method performed by a spam IP address discrimination device,
A first query extraction step of extracting a query transmitted from a terminal having a specific IP address with reference to a search log database storing a search log in which a query and an IP address of a terminal that transmitted the query are associated; ,
A first IP address extracting step of extracting the IP address of the terminal that has transmitted the query extracted in the first query extracting step with reference to the search log database;
A second query extraction step of extracting a query transmitted from the terminal of the IP address extracted in the first IP address extraction step or the second IP address extraction step with reference to the search log database;
The second IP address extracting step of extracting the IP address of the terminal that has transmitted the query extracted in the second query extracting step with reference to the search log database;
A repetition step of alternately and repeatedly executing query extraction by the second query extraction step and IP address extraction by the second IP address extraction step;
When the IP address extraction step is repeated a first number of times, the number of types of IP addresses extracted in the IP address extraction step is repeated the second number of times greater than the first number of times. A spam IP that obtains a ratio to the number of types of IP addresses extracted in the IP address extraction step and determines that the specific IP address is a spam IP address when the ratio value is equal to or greater than a predetermined value A spam IP address determination method including an address determination step. A search log storage means for storing a search log that associates the query with the IP address of the terminal that transmitted the query;
First IP address extracting means for extracting an IP address of a terminal that has transmitted a specific query with reference to the search log storage means;
First query extraction means for extracting a query transmitted from a terminal having an IP address extracted by the first IP address extraction means with reference to the search log storage means;
Second IP address extraction means for extracting the IP address of the terminal that has transmitted the query extracted by the first query extraction means or the second query extraction means with reference to the search log storage means;
The second query extraction means for extracting a query transmitted from the terminal of the IP address extracted by the second IP address extraction means with reference to the search log storage means;
Repetitive means for alternately and repeatedly executing extraction of an IP address by the second IP address extraction means and extraction of a query by the second query extraction means;
The number of types of IP addresses extracted by the IP address extraction unit when the repetition unit repeats the first number of times is repeated by the repetition unit a second number of times greater than the first number of times. A spam query determination that obtains a ratio to the number of types of IP addresses extracted by the IP address extraction means and determines that the specific query is a spam query if the ratio is greater than or equal to a predetermined value And a spam query discrimination device. A method executed by a spam query determination device,
A first IP address extracting step of extracting an IP address of a terminal that has transmitted a specific query with reference to a search log database in which a search log that associates the query with the IP address of the terminal that has transmitted the query is stored; ,
A first query extraction step of extracting a query transmitted from the terminal of the IP address extracted in the first IP address extraction step with reference to the search log database;
A second IP address extracting step of extracting the IP address of the terminal that has transmitted the query extracted by the first query extracting step or the second query extracting step with reference to the search log database;
A second query extraction step of extracting a query transmitted from the terminal of the IP address extracted in the second IP address extraction step with reference to the search log database;
An iterative process for alternately and repeatedly executing the extraction of the IP address by the second IP address extracting process and the extraction of the query by the second query extracting process;
When the IP address extraction step is repeated a first number of times, the number of types of IP addresses extracted in the IP address extraction step is repeated the second number of times greater than the first number of times. A spam query determination step of obtaining a ratio to the number of types of IP addresses extracted in the IP address extraction step and determining that the specific query is a spam query when the ratio is equal to or greater than a predetermined value Spam query determination method including.

Images