KR101692244B1 - Method for spam classfication, recording medium and device for performing the method - Google Patents

Abstract

A spam classification method includes extracting, from a normal document and a spam document, a characteristic of a single document including a structural characteristic of the document; Generating a document classification model using a feature of the extracted single document as learning data; Extracting features of a single document from the classification target document; And applying the feature of the classification object document to the classification model to determine whether the classification object document is a spam document. Thus, efficient and economical spam blocking can be performed.

Description

TECHNICAL FIELD [0001] The present invention relates to a spam classification method, a recording medium for performing the spam classification method, and a spam classification apparatus,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a spam classification method, a recording medium and an apparatus for performing the spam classification method, and more particularly, to a spam classification method using characteristic analysis of a single document, and a recording medium and apparatus for performing the spam classification method.

A blog is a medium that leaves a personal thought or a record. It develops and operates contents of various fields through the development of the Internet and the web. The portal site provides a search service including a blog post or various types of blog services. However, these blogs are mixed with spammers' posts made by individuals and spammers made by the spammers, making it difficult for users to obtain useful information and deteriorating the search performance of search engines.

Link Spam is a type of spam that is used to increase the search ranking of a specific site, and content spam that inserts spam keywords by stealing news or other blog contents. Link spam can be analyzed using a PageRank technique to classify documents by constructing a link from a trust document or a spam document. Content spam analysis methods classify documents by decomposing sentences of text documents and using frequency information about words or extracting characteristics of documents to find differences between normal documents and spam documents.

Conventional techniques typically use the frequency of occurrence of words appearing in a document. The frequency of occurrence of a word is determined by how often it appears in the document and whether it appears frequently in the entire document. To obtain the frequency of occurrence of the word in the entire document, the document containing the word is found and the frequency is calculated. Therefore, in order to calculate the frequency of appearance of all the words of the learning data, the memory usage and frequency calculation time are additionally required.

In addition, if there is a lot of learning data, the memory usage also increases. If the memory usage exceeds the hardware threshold, it becomes difficult to refer to other documents. Methods using distributed processing to solve the memory usage problem have a disadvantage that computational complexity increases.

In addition, the existing spam document classification method uses characteristic words such as DF (Document Frequency) or the like for learning. One of the most basic methods, DF, is to refer to all the documents in which the word appears as a "number of documents with words." Extracting features using a large set of documents means that the size of every document in which the word appears will limit the available memory It is difficult to calculate.

KR 10-0902475 B1 KR 10-0614751 B1

 Sahami, M., Dumais, S., Heckerman, D., Horvitz, E. "A Bayesian approach to filtering junk e-mail." Learning for Text Categorization: Papers from the 1998 workshop. Vol. 62. 1998. Pp. 98-105.  Lee,. "A Spam Filtering Method Using Special Character and Word Frequency Ratios." Proceedings of the Korean Information Science Society Conference 38.1C 2011. pp. 280-283.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of the above problems, and it is an object of the present invention to provide a spam classification method that extracts features from a single document and saves time and cost for spam filtering.

Another object of the present invention is to provide a recording medium on which a computer program for performing the spam classification method is recorded.

It is still another object of the present invention to provide an apparatus for performing the spam classification method.

According to another aspect of the present invention, there is provided a spam classification method comprising: extracting a characteristic of a single document including a structural characteristic of a document from a normal document and a spam document; Generating a document classification model using a feature of the extracted single document as learning data; Extracting features of a single document from the classification target document; And applying the feature of the classification object document to the classification model to determine whether the classification object document is a spam document.

In an embodiment of the present invention, the characteristics of the single document include at least one of a document length, a document length ratio, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, The number of the anchor tags, and the similarity of the title and the first sentence of the body.

In an embodiment of the present invention, the characteristics of the single document include at least one of a document length, a document length ratio, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, The number of anchor tags, and the similarity between the title and the first sentence of the text.

In an embodiment of the present invention, the characteristic of the single document can be calculated as a characteristic value through a predetermined formula for each characteristic.

In an embodiment of the present invention, the step of generating the document classification model may include storing each feature value and a tagging value of a normal document, and each feature value and a tagging value of the spam document.

According to another embodiment of the present invention, a computer program for performing a spam classification method is recorded in a computer-readable storage medium.

According to another aspect of the present invention, there is provided a spam classification apparatus comprising: a feature extraction unit for extracting a feature of a single document including structural features of a document; A model generating unit for generating a document classification model for discriminating a normal document and a spam document by using a characteristic of the single document extracted from the normal document and the spam document as learning data; And a spam determination unit for determining whether the classification target document is a spam document by applying a characteristic of the classification object document to the classification model.

In the embodiment of the present invention, the extracting unit extracts the length of the document, the length ratio of the document, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, The number and the similarity of the title and the first sentence of the text can be extracted.

In the embodiment of the present invention, the extracting unit extracts the length of the document, the length ratio of the document, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, It is possible to extract both the number and the characteristics of the title and the similarity of the first sentence of the text.

In an embodiment of the present invention, the feature of the single document may be a feature value calculated through a formula determined for each feature.

In an embodiment of the present invention, the document classification model may store each feature value of a normal document, a tagging value, and each feature value and a tagging value of a spam document.

According to such a spam classification method, since only the characteristics of a single document are utilized, the feature extraction time and memory efficiency for spam classification are improved. In particular, it does not refer to dictionaries and other documents, thus reducing the time and cost of spam word dictionary construction. In addition, the method proposed by the present invention extracts only the features of the document that are not dependent on words, and receives less influence on the learning document, thereby improving the accuracy of the spam discrimination.

1 is a block diagram of a spam classification apparatus according to an embodiment of the present invention.
2 is a detailed block diagram of the feature extraction unit of FIG.
FIG. 3 is a distribution map of spam documents and normal documents.
FIG. 4 is a graph showing a result of comparing the accuracy and the like with the conventional technique in order to verify the effect of the present invention.
5 is a flowchart of a spam classification method according to an embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a block diagram of a spam classification apparatus according to an embodiment of the present invention. 2 is a detailed block diagram of the feature extraction unit of FIG.

The spam classification according to the present invention uses a characteristic analysis of a single document. A characteristic of a single document refers to features that can be calculated without referring to other documents. For example, TF (Term Frequency) indicates the frequency of words appearing in one document, but DF (Document Frequency) is a characteristic that can be obtained by referencing the entire document with the frequency of the document in which the word appears. That is, the present invention extracts only the features of the document that are not dependent on the word, and is less affected by the learning document.

Referring to FIG. 1, the spam classification apparatus 10 according to the present invention includes a feature extraction unit 110, a model generation unit 130, and a spam classification unit 150.

The spam classification apparatus 10 according to the present invention may be installed with software (application) for performing spam classification, and the configuration of the feature extraction unit 110 and the like may be implemented by the spam classification apparatus 10, And may be controlled by software for performing spam classification.

The spam classification device 10 may be a separate terminal or a module of a terminal. In addition, the configuration of the feature extracting unit 110 and the like may be formed of an integrated module or one or more modules. However, conversely, each configuration may be a separate module.

The spam classification device 10 may be mobile or fixed. The device 10 may be in the form of a server or an engine and may be a device, an apparatus, a terminal, a user equipment (UE), a mobile station (MS) a wireless device, a handheld device, and the like.

For example, the spam classification apparatus 10 may be provided in an information terminal such as a user's mobile communication terminal or a computer, or may be provided in a mail server or a text message server. Or it may be an independent device that communicates with the terminal or server, or it may be in the form of a server.

The spam classification apparatus 10 can execute or produce various software based on an operating system (OS), i.e., a system. The operating system is a system program for allowing software to use the hardware of a device. The operating system includes a mobile computer operating system such as Android OS, iOS, Windows Mobile OS, Sea OS, Symbian OS, Blackberry OS, MAC, AIX, and HP-UX.

The feature extraction unit 110 extracts features of a single document including structural features of the document. A feature of a single document refers to features that can be calculated without reference to other documents. Here, the document refers to a web page such as a general blog, but not limited thereto, and all types of documents that can be displayed on a computer correspond to the web page.

In the present invention, the characteristics of a single document include a document length, a document length ratio, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, the number of words appearing in the main text, And the similarity between the title and the first sentence of the text.

These features of the single document are features of the document that are not word-dependent, unlike the prior art. However, the feature of the single document exemplified above is merely an example, and the feature can be added, changed or deleted as necessary.

The feature extraction unit 110 extracts at least one feature of the nine single documents. For example, the feature extraction unit 110 may extract all the features of the nine single documents. Alternatively, only a part of the features of the nine single documents may be extracted.

The feature extracting unit 110 can calculate and quantify the feature value through a predetermined formula for each feature. Referring to FIG. 2, the feature extraction unit 110 includes modules for extracting features. However, as an alternative embodiment, each feature may be extracted sequentially, or in any order, or concurrently, in one module.

Hereinafter, the characteristics of a single document extracted by the feature extraction unit 110 will be described in detail with reference to FIG.

Length of document

Documents containing HTML tags are often longer than spam documents in normal cases. Spam documents are usually created by automatically joining several short sentences, so they are concentrated in a certain document length (Fig. 3 (a)). The length D _i of the document can be calculated by the following equation (1).

[Equation 1]

Document length ratio

Spam documents are characterized by the fact that they do not use HTML tags much and list issue keywords or meaningless text to raise search rank. Therefore, documents occupying a large portion of the HTML tag as compared to the document length have a high ratio of normal documents (Fig. 3 (b)). The length ratio of the document is a ratio of the length of the document excluding the tag to the length of the document including the tag, and can be calculated as shown in Equation 2 below.

&Quot; (2) "

Number of images

In a typical search environment, documents containing search keywords are displayed as search results. The number of images included in a document is smaller than that of a normal document (Fig. 3 (c)) because a keyword is more important than an image that is not searched due to the characteristics of a spam document to be exposed as a result of keyword search. The number of images can be calculated by the following equation (3).

&Quot; (3) "

HTML  Number of tags

The nature of the automatically generated spam document is different from that of the spam document and takes the same format of HTML tags, so that the number of tags is often smaller or contains much more tags than the normal document (Fig. 3 (d)). Thus, the number of HTML tags can be an important measure to classify automatically generated spam documents. The number of HTML tags can be calculated by the following equation (4).

&Quot; (4) "

Percentage of white space

In normal documents, the larger the amount of text in the text, the greater the number of spaces. On the other hand, spam documents do not use spacing to emphasize spam keywords or to be recognized as spam keywords, or to manipulate words, such as using special characters instead of spacing. Therefore, in the case of a spam document, the number of blank characters is abnormally smaller than the length of the text (Fig. 3 (e)). The ratio of blank characters can be calculated by the following equation (5).

&Quot; (5) "

New line  Number of characters

Spam documents are generally less frequent than regular documents because they create documents without adding newline characters, typically by concatenating multiple sentences (see Figure 3 (f)). ). The number of new line characters can be calculated by the following equation (6).

&Quot; (6) "

Number of words appearing in the text

It is composed of sentence which is normally visible at the upper part of the body of the spam document, and a large number of issue keywords not related to the contents are arranged in the invisible area at the bottom. Thus, when a large number of issue keywords are inserted, And is highly likely to be spam (Fig. 3 (g)). The number of words appearing in the main text can be calculated by the following equation (7).

&Quot; (7) "

Number of anchor tags

Anchor tags are the characteristics of a Web document, meaning links that can move from one document to another. In an SPAM document, anchor tags can be used to increase the rank of another document or to link to a desired spam site, so that a document often includes a plurality of anchor tags (Fig. 3 (h)). Therefore, the number of anchor tags is also a measure of whether or not spam is detected. The number of anchor tags can be calculated by the following equation (8).

&Quot; (8) "

Similarity between the title and the first sentence of the text

Unlike a typical web page, a spam document that clearly distinguishes between a title and a text is placed in front of the text in order to make it look like a normal search result, so that the search result includes a normal document (Fig. 3 (i)). Therefore, only the first sentence is very similar to the title, and the subsequent contents are classified as spam documents.

For spam documents with a similar pattern to the first sentence of the title of the document, Jaccard similarity measures similarity between the first sentence and the title. In case of dividing a word based on a space for calculation of similarity, it is difficult to measure the similarity because the similarity is calculated by recognizing the same word as another word when two sentences have a space or an irradiation and the ending is different. Therefore, Bi-gram is applied to each sentence to solve the problem of spacing and word variation. The similarity of the first sentence of the title and the body can be calculated by the following equation (9).

&Quot; (9) "

는 문서의 제목이며,

는 본문의 처음 문장이다(단,

).here,

Is the title of the document,

Is the first sentence of the text (note,

).

The feature extraction unit 110 provides the feature value of the extracted single document to the model generation unit 130. The model generation unit 130 learns the feature value using the feature value as learning data, Create a document classification model to identify spam documents.

For this purpose, feature values of documents tagged as normal documents and spam documents can be used as learning data. For example, a blog document may be collected first, and a spam document and a normal document may be manually classified and stored in the database 20.

The feature extraction unit 110 extracts feature values of a normal document and a spam document stored in the database 20, and the model generation unit 130 learns the feature values, And generates a document classification model including the tagging value of the document.

Thereafter, when a classification target document for identifying a spam document is input, the feature extraction unit 110 extracts a characteristic value of a single document from the classification target document, and transmits the characteristic value to the spam determination unit 150. The classification target document may be a web page, but is not limited thereto. It may be any type of document that can be displayed on a computer, and may be automatically collected by the spam classification device 10.

The spam determining unit 150 determines whether the classification target document is a spam document by applying the feature value of the classification target document to the classification model, and outputs the result. Since the present invention learns only features that can be extracted from only a single document, it shortens the feature extraction time and is excellent in memory efficiency. Therefore, it is possible to efficiently detect and block spam.

In order to verify the feasibility of the present invention, a comparative experiment with the prior art was conducted using the same data and learning algorithm. A method for classifying spam based on probability of occurrence of words in a document (Lee, Seong-jin, Jongbaek, Jae-seok, and Suwon Lee, "Spam Filtering Method Using Special Character and Word Frequency Ratios"). pp. 280-283). The prior art refers to another document to calculate the appearance probability of a word, but the present invention refers to only a single document.

For the experiment, we collected 94,224 blog data using API on internet portal, and used 10,983 spam data and 83,241 normal data. Since the number of normal data is large, only about 61% of the data are sampled and used to extract the characteristics of the nine single documents.

As a test method, 10-fold cross vaidation was used, and binarization with spam documents and normal documents was performed to evaluate the accuracy and recall. The accuracy rate means a probability that a document judged to be spam as a result of spam filtering is an actual spam document and a recall rate means a probability of a document judged to be spam as a true spam document. As long as the system finds as many spam documents as possible, the recall is improved, and most of the documents judged to be spam are spam, which improves the accuracy.

In addition, in the spam document classification, the risk of classifying normal documents as spam documents is far greater than in the opposite case. Therefore, a comparative evaluation for the FP-Rate is also necessary, which can be performed by Equation (10) below.

&Quot; (10) "

In the field of data mining, we have been experimenting with a decision tree classification algorithm, which is a classification algorithm, using Weka, which is open to the public and widely used. Table 1 below shows the confusion matrix of the spam document classification.

Experiment spam normal real spam 10,552 431 normal 344 82,897

Referring to Table 1, the precision and recall were calculated as 0.992 and 0.992, respectively, and the F-measure was 99.2% and the FP-rate was 0.035. 4 (a) shows the result of a comparative experiment conducted using an algorithm and a data set based on a comparison experiment with a conventional technique for determining whether or not spam is based on the probability of occurrence of a special character and a word.

Referring to FIG. 4 (a), as a result of a comparative experiment, the accuracy of the present invention was 0.002% higher than that of the prior art. Referring to FIG. 4 (b), the feature extraction time is reduced by 52% on average and the memory usage is improved by 33% in comparison with the prior art.

5 is a flowchart of a spam classification method according to an embodiment of the present invention.

The spam classification method according to the present embodiment can be performed in substantially the same configuration as the spam classification apparatus 10 of FIG. Therefore, the same components as those of the spam classification device 10 of FIG. 1 are denoted by the same reference numerals, and repeated descriptions are omitted. In addition, the spam classification method according to the present embodiment can be executed by software (application) for performing spam classification.

Referring to FIG. 5, the spam classification method according to the present embodiment first learns a learning data set to form a document classification model. For this purpose, normal documents and spam documents can be collected and stored.

From the stored normal documents and spam documents, features of a single document including the structural features of the document are extracted (step S10). A feature of a single document refers to features that can be calculated without reference to other documents. Here, the document refers to a web page such as a general blog, but not limited thereto, and all types of documents that can be displayed on a computer correspond to the web page.

The characteristics of the single document include a document length, a document length ratio, the number of images, the number of HTML tags, the ratio of blank characters, the number of new line characters, the number of words appearing in the main text, Or at least one of the similarities in the first sentence of the text, or both.

These features of the single document are features of the document that are not word-dependent, unlike the prior art. However, the feature of the single document exemplified above is merely an example, and the feature can be added, changed or deleted as necessary.

The step of extracting features of a single document including the structural features of the document (step S10) can calculate and quantify feature values through a predetermined formula for each feature. Each feature value of a single document can be calculated by the formulas in Table 2 below.

Features of a single document Equation Length of document

Document length ratio

Number of images

Number of HTML tags

Percentage of white space

Number of newline characters

Number of words appearing in the text

Number of anchor tags

Similarity between the title and the first sentence of the text

When the features of the normal document and the spam document are extracted, the feature value is used as learning data, and a document classification model for distinguishing the normal document and the spam document is generated (step S30). The distributions of the normal document and the spam document are shown in Fig.

The step of generating the document classification model (step S30) includes learning the feature values of the normal document and the spam document, and creating a document classification model including the feature values, the normal document, and the tagging value of the spam document.

Thereafter, if a classification target document to be a spam document is inputted, the characteristic of a single document is extracted from the classification target document (step S50). The classification target document may be a web page, but is not limited thereto. The classification target document may be any type of document that can be displayed on a computer, and may be automatically collected by the spam classification apparatus 10.

If the feature value of the classification target document is extracted, the feature value of the classification target document is applied to the classification model to determine whether the classification target document is a spam document (step S70).

Since the present invention learns only features that can be extracted from only a single document, it shortens the feature extraction time and is excellent in memory efficiency. Therefore, it is possible to efficiently detect and block spam.

Such a spam classification method may be implemented in an application or may be implemented in the form of program instructions that may be executed through various computer components and recorded on a computer readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination.

The program instructions recorded on the computer-readable recording medium may be ones that are specially designed and configured for the present invention and are known and available to those skilled in the art of computer software.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims. You will understand.

Since the present invention utilizes only the characteristics of a single document, it shortens the feature extraction time and improves the memory efficiency for spam classification, and thus can be effectively utilized in the design and implementation of the automatic classifier. In addition, it will be widely used in the field of document classification, blog spam, content spam, spam detection and spam filtering, both now and in the future.

10: Spam classification device 20: Database
110: Feature extraction unit 130: Model generation unit
150: Spam discrimination unit

Claims (11)

Extracting from the normal document and the spam document a feature of a single document including structural features of the document;
Generating a document classification model using a feature of the extracted single document as learning data;
Extracting features of a single document from the classification target document; And
Applying a feature of the classification object document to the classification model to determine whether the classification object document is a spam document,
The characteristics of the single document include the length of the document, the length ratio of the document, the number of HTML tags, the ratio of blank characters, the number of new line characters, the number of words appearing in the main text, the number of anchor tags, The degree of similarity,
If the characteristic of the single document is the length ratio of the document, the ratio of the length of the document excluding the tag and the length of the document including the tag is calculated to determine whether a single document is a spam document,
Wherein if the characteristic of the single document is a ratio of the blank character, the ratio of the length of the document excluding the tag and the number of blank characters is calculated to determine whether the single document is a spam document.
The method according to claim 1,
If the characteristic of the single document is the number of new line characters, the number of new line characters is extracted according to the following equation 1, and if the number of extracted new line characters is larger than the number of new line characters of the learned spam document, Recognize,
Equation 1

(here,

:document,

: Newline character)
If the number of the anchor tags is smaller than the number of the anchor tags of the learned spam document, the classification target document is divided into a general document Further comprising recognizing the spam as a spam.
Equation 2

(here,

:document,

: Anchor tag)
delete The method of claim 1,
Wherein the feature value is calculated by a formula determined for each feature.
5. The method of claim 4, wherein generating the document classification model comprises:
Storing each feature value and a tagging value of each normal document and each feature value and a tagging value of the spam document.
A computer-readable recording medium storing a computer program for performing the spam classification method according to any one of claims 1, 2, 4, and 5.
A feature extraction unit that extracts features of a single document including structural features of the document;
A model generating unit for generating a document classification model for discriminating a normal document and a spam document by using a characteristic of the single document extracted from the normal document and the spam document as learning data; And
And a spam judgment unit for applying the characteristic of the classification object document to the classification model to determine whether the classification object document is a spam document,
Wherein the feature extracting unit extracts features of a document excluding an HTML tag and a document including an HTML tag separately,
Wherein the spam determining unit determines whether the classification target document is a spam document by using a characteristic of the document including the HTML tag and the document excluding the HTML tag.
8. The method of claim 7,
The spam-
Wherein if the characteristic of the single document is a length ratio of the document, the ratio of the length of the document excluding the HTML tag to the length of the document including the HTML tag is calculated to determine whether the single document is a spam document.
8. The method of claim 7,
The spam-
Wherein when the characteristic of the single document is a ratio of blank characters, the ratio of the length of the document excluding the HTML tags and the number of blank characters is calculated to determine whether the single document is a spam document.
8. The apparatus of claim 7, wherein the feature extraction unit
Further comprising: extracting the number of new line characters by the following formula, and if the number of extracted new line characters is larger than the number of new line characters of the learned spam document, the spam discrimination unit recognizes the classification target document as a general document Device.
Equation

(here,

:document,

: Newline character)
8. The method of claim 7,
Wherein the feature extracting unit determines the number of anchor tags by the following formula and the spam determining unit recognizes the number of anchor tags as a general document if the number of anchor tags is less than the number of anchor tags of the learned spam document.
Equation

(here,

:document,

: Anchor tag)

Images