KR102322918B1 - System and method for detecting online living crime - Google Patents

Abstract

The present invention relates to a deep learning-based online life crime detection system and a method. According to one aspect of the present invention, provided is a method for detecting the online life crime, which includes the steps of: a) receiving target data for early detection of the online life crime by a target data collection module; b) determining whether the target is suspected illegal data by applying a suspected illegal data discrimination model to the target data by a suspected illegal data determination module; and c) performing crime prevention which measures and countermeasures for the suspected illegal data by a crime response module. Therefore, after collecting online data, it is possible to analyze the collected online data based on deep learning to determine whether the collected online data is the suspected illegal data, and if it is determined to be the suspected illegal data, follow-up measures can be implemented.

Description

SYSTEM AND METHOD FOR DETECTING ONLINE LIVING CRIME

The present invention relates to an online life crime detection system and method.

With the development of high-speed Internet networks, users can use the Internet anytime, anywhere, and users can access portal sites to acquire information or watch news and movies.

However, due to the increase in Internet use, the damage caused by Internet use is also increasing. Since online access is available to all regardless of age and gender, and data posted by netizens is posted without any filtering, posting adult advertisements that are harmful to adolescents can be harmful to the mental health of adolescents. In addition, there is a problem in that it is difficult to achieve the original purpose of operating a discussion space on a web page if many advertisements are posted in a space where netizens discuss their thoughts with each other.

In addition, life crimes online are also increasing. Life crimes refer to minor criminal crimes such as bicycle theft that are frequently encountered in daily life, and life crimes that are frequently encountered in daily life on the Internet, such as gambling, loan fraud, part-time job fraud, illegal pyramid schemes, and phishing scams, are gradually increasing. are doing

In the past, to prevent such cybercrime, when netizens press the "Report" button, it is reported to the web page administrator, and measures are taken to prevent such cybercrime related articles from being posted on the web page. In addition, the web page administrator was able to protect netizens from spam data by checking whether the data registered by the netizens one by one was a post that could be related to crime and then deleting it.

However, this method raises a problem that it is not easy to check the entire data registered in real time, and that a large amount of cost is required to fill the corresponding manpower. In addition, while posting articles on web pages is becoming common, many articles related to false advertisements and adult advertisements are also posted, which adversely affects the establishment of a healthy Internet culture.

Accordingly, there is a need to develop an algorithm capable of detecting and preventing the increasing number of cyber crimes in advance, and in the present invention, a system and method capable of detecting and responding to online crimes early suggest

An embodiment of the present invention is an online life crime detection system that collects online data and then analyzes it based on deep learning to determine illegal suspicious data, and when it is determined to be illegal suspicious data, it is possible to implement follow-up measures and to provide a method.

On the other hand, the technical problems to be achieved in the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned are clearly to those of ordinary skill in the art to which the present invention belongs from the description below. can be understood

An online life crime detection method according to an embodiment of the present invention comprises the steps of: a) receiving target data for early online life crime detection by an online life crime detection system; b) determining illegal suspicious data by applying a suspicious illegal identification model to the target data; and c) performing crime prevention measures and countermeasures for the suspected illegal data.

The step a) includes: a-1) receiving target data from open data including a search engine and SNS through data crawling; and a-2) receiving target data from a URL address through data crawling.

Step b) may include: b-1) extracting a first keyword by excluding special characters from text data included in the target data and performing natural language processing; b-2) extracting a second keyword by applying an OCR model to the image data included in the target data; and b-3) applying the suspected illegality determination model to the first keyword and the second keyword to determine suspicious illegal data.

Step b-2) may include: b-2-1) extracting text in phoneme units by applying an OCR model to the image data; b-2-2) determining a language type of the text based on the phoneme unit text; b-2-3) generating a combined text by combining the phoneme unit text in consideration of the handwriting direction in the language type determined in step b-2-2); and b-2-4) extracting the combined text as the second keyword.

The step b-2) includes: b-2-5) the shape of the first phoneme in the first language, which is the language type determined in step b-2-2) by the recombinant text generating unit, and the first language; generating a recombinant text by replacing the second phoneme with the first phoneme when the similarity between shapes of second phonemes of a second language, which is a different language type, exceeds a preset value; and b-2-6) extracting the recombinant text as the second keyword by a second keyword extraction unit.

The step b) includes: b-4) setting the first keyword and the second keyword as suspicious keywords by a suspicious keyword setting unit; b-5) calculating a related keyword associated with the suspicious keyword by a related keyword calculating unit; and b-6) applying the suspected illegality discrimination model to the suspicious keyword and the related keyword by the suspicious illegal data determining unit to determine the suspicious illegal data.

The step c) includes: c-1) providing the suspected illegal data to the relevant organization for each online life crime by the relevant organization reporting unit; c-2) providing a damage report procedure to the user by a damage report procedure providing unit; c-3) providing a complaint or complaint writing method to the user by the complaint providing unit, or writing the complaint on behalf of the user; and c-4) providing the URL address to the relevant institution for each online life crime by the relevant institution reporting unit.

The illegal suspicion determination model may be configured to: analyze the target data through a deep learning model, and determine the suspicious illegal data based on the analysis result.

The illegal suspicion determination model may include: performing learning based on first learning data input from a user; additionally learning the second learning data received from public data through the Open API; It may be configured to additionally learn third learning data, which is data determined to be illegal suspicious data by the suspected illegality determination model.

An online life crime detection system according to an embodiment of the present invention includes a target data collection module configured to receive target data for performing early detection of online life crimes; an illegal suspicious data determination module configured to determine illegal suspicious data by applying a suspicious illegal identification model to the target data; and a crime response module configured to perform crime prevention measures and countermeasures for the suspected illegal data.

The online life crime detection system and method according to an embodiment of the present invention collects online data and analyzes it based on deep learning to determine illegal suspicious data, and if it is determined to be illegal suspicious data, follow-up measures are taken. can be implemented

On the other hand, the effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. will be able

1 is a diagram schematically showing each configuration of an online life crime detection system 10 and a state in which an online life crime detection method S10 is performed through it.
2 is a flowchart illustrating an online life crime detection method (S10).
3 is a flowchart illustrating in more detail step S100 performed by the target data collection module 100 .
4 is a flowchart illustrating in more detail step S200 performed by the suspicious illegal data determination module 200 .
5 is a diagram schematically showing each configuration of the second keyword extraction unit 220 .
6 is a flowchart illustrating in more detail step S220 performed by the second keyword extraction unit 220 .
7 is a diagram of extracting a second keyword in step S220 by the phoneme unit text extraction unit 221 , the language type determining unit 222 , the combined text generation unit 223 and the second keyword extraction unit 224 of FIG. 6 . It is an example diagram showing the appearance.
8 is S220 by the phoneme unit text extraction unit 221 , the language type determination unit 222 , the combined text generation unit 223 , the second keyword extraction unit 224 , and the recombinant text generation unit 225 of FIG. 6 . It is an exemplary diagram showing the state of extracting the second keyword in the step.

Other advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only this embodiment serves to complete the disclosure of the present invention, and to obtain common knowledge in the technical field to which the present invention pertains. It is provided to fully inform the possessor of the scope of the invention, and the present invention is only defined by the scope of the claims. Even if not defined, all terms (including technical or scientific terms) used herein have the same meaning as commonly accepted by common technology in the prior art to which this invention belongs. Terms defined by general dictionaries may be interpreted as having the same meaning as in the related description and/or in the text of the present application, and shall not be interpreted conceptually or overly formally, even if not expressly defined herein. won't

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. As used herein, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, 'comprise' and/or various conjugations of this verb, eg, 'comprise', 'comprising', 'comprising', 'comprising', etc., refer to the referenced composition, ingredient, component, A step, operation and/or element does not exclude the presence or addition of one or more other compositions, components, components, steps, operations and/or elements.

As used herein, the term 'and/or' refers to each of the listed components or various combinations thereof. Meanwhile, terms such as '~ unit', '~ group', '~ block', and '~ module' used throughout this specification may mean a unit that processes at least one function or operation. For example, it can mean software, hardware components such as FPGAs or ASICs. However, '~ part', '~ group', '~ block', and '~ module' are not meant to be limited to software or hardware. '~ unit', '~ group', '~ block', and '~ module' may be configured to reside in an addressable storage medium or to regenerate one or more processors. Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings of the present specification.

1 is a diagram schematically showing each configuration of an online life crime detection system 10 and a state in which an online life crime detection method (S10) is performed through it.

2 is a flowchart illustrating an online life crime detection method (S10).

1 and 2 , the online life crime detection system 10 includes a target data collection module 100 , an illegal suspicious data determination module 200 , and a crime response module 300 .

The target data collection module 100 is configured to receive target data for performing early detection of online life crimes. The suspicious illegal data determination module 200 is configured to determine the illegal suspicious data by applying the suspicious illegal identification model to the target data. The crime response module 300 is configured to perform crime prevention measures and countermeasures for illegal suspicious data.

The online life crime detection method (S10) is a step of receiving the target data for early detection of online life crimes by the target data collection module 100 (S100), illegal in the target data by the illegal suspicious data determination module 200 It includes a step (S200) of determining illegal suspicious data by applying a suspicious identification model and a step (S300) of performing crime prevention measures and countermeasures on the suspicious illegal data by the crime response module 300 (S300).

For example, the target data collection module 100 receives target data, which is content launched online, in order to perform early detection of online life crimes such as gambling or illegal pyramids. The suspected illegal data determination module 200 determines whether there is illegal suspicious data related to online life crimes in the target data by applying the suspicious illegal identification model to the target content input by the target data collection module 100 . When it is determined by the suspicious illegal data determination module 200 that there is suspicious illegal data, the crime response module 300 performs preventive measures and countermeasures therefor.

3 is a flowchart illustrating in more detail step S100 performed by the target data collection module 100 .

Referring to FIG. 3 , step S100 includes receiving target data from open data 20 including a search engine and SNS through data crawling ( S110 ) and receiving target data from a URL address through data crawling ( S120 ). ) may be included.

More specifically, in step S110, target data for online life crime detection is received by crawling data from the contents disclosed in the open data 20 including the search engine including Naver, Google, etc., or SNS such as Facebook, Twitter, etc. . In addition, the user 50 may also crawl articles posted online and comments attached thereto and use them as target data.

In step S120 , the URL address as well as the content included in the open data 20 may be further crawled, and this may be input as target data for online life crime detection. For example, it can crawl not only online posts, but also the text written in the URL of the post.

4 is a flowchart illustrating in more detail step S200 performed by the suspicious illegal data determination module 200 .

Referring to FIG. 4 , step S200 is a step of extracting a first keyword by natural language processing after excluding special characters from text data included in target data by the first keyword extraction unit 210 ( S210 ), a second keyword A step of extracting the second keyword by applying the OCR model to the image data included in the target data by the extraction unit 220 (S220) and the illegal suspicious data determining unit 230 for the first keyword and the second keyword It may include a step (S230) of determining illegal suspicious data by applying a suspicious determination model.

More specifically, in step S210 performed by the first keyword extraction unit 210 , special characters are excluded from the target data collected by the target data collection module 100 . For example, special characters are characters such as @ or #. Next, natural language processing of target data excluding special problems and extracting it as a first keyword.

In step S220 performed by the second keyword extraction unit 220, a second keyword that is text included in the image data is extracted by applying an OCR model capable of extracting text data from the image data.

In step S230 performed by the suspicious illegal data determining unit 230, the suspicious illegal data is determined by applying the suspicious illegal identification model to the first keyword extracted in step S210 and the second keyword extracted in step S220.

The suspected illegal identification model is configured to analyze the target data through a deep learning model and determine whether it is illegal suspicious data based on the analysis result, where the suspected illegal data is, for example, gambling, loan fraud, high part-timer fraud, This could include illegal pyramids and phishing scams.

The deep learning model used for the illegal suspicion discrimination model may include a BiLSTM-based deep learning model. However, it is not limited thereto, and any deep learning model that can be applied without difficulty by those skilled in the art, including autoencoder, self-attention, etc., may be applied without limitation.

The user 50 prepares the first learning data in advance to learn the deep learning model used in the illegal suspicion discrimination model and learns the deep learning model to be applied to the online life crime detection system 10 through this.

In addition to the first learning data, second learning data input from the public data 30 through the Open API may be additionally used for learning the deep learning model. In more detail, the server of a public institution such as the National Police Agency or the Financial Supervisory Service may include data including companies and persons related to life crimes. Therefore, by additionally learning the second learning data included in the public data 30 through the Open API to the deep learning model, it is possible to improve the identification accuracy through the illegal suspicious identification model.

In addition, the suspected illegality identification model may further learn by using the data determined as the illegal suspicious data as the third learning data.

In summary, in step S230 performed by the suspicious illegal data determining unit 230, the first keyword and the second keyword are inputted into the suspicious illegal identification model, and the inputted data is determined as the illegal suspicious data as an output.

5 is a diagram schematically showing each configuration of the second keyword extraction unit 220 .

6 is a flowchart illustrating in more detail step S220 performed by the second keyword extraction unit 220 .

5 and 6 , the second keyword extraction unit 220 includes a phoneme unit text extraction unit 221 , a language type determination unit 222 , a combined text generation unit 223 , and a second keyword extraction unit 224 . ) may be included.

Step S220 performed by the second keyword extraction unit 220 includes the step of extracting text in phoneme units by applying the OCR model to the image data by the phoneme unit text extraction unit 221 ( S221 ), and the language type determination unit ( S221 ). Determining the language type of the text based on the phoneme unit text by 222) (S222), the phoneme unit text in consideration of the handwriting direction in the language type determined at the step S222 by the combined text generating unit 223 and generating the combined text by combining ( S223 ) and extracting the combined text as the second keyword by the second keyword extraction unit 224 ( S224 ).

7 is a diagram of extracting the second keyword in step S220 by the phoneme unit text extraction unit 221, the language type determination unit 222, the combined text generation unit 223 and the second keyword extraction unit 224 of FIG. It is an example diagram showing the appearance.

Referring to FIG. 7 , as shown in FIG. 7 online, 'doba' may be written in the first row and 'a' may be disclosed at the bottom of 'bar' in the second row.

The phoneme unit text extraction unit 221 extracts the phoneme unit text from the text of FIG. 7 , and as a result of the extraction, 'c, ㅗ, f, a, a' may be extracted.

The language type determination unit 222 may determine the type of the corresponding language based on each extracted phoneme, and in the case of an example, may determine that it is Korean.

The combined text generating unit 223 generates combined text by combining the extracted phonemes. Since it is determined that the language is Hangul, the text in phoneme units is combined in consideration of the right and downward handwriting directions, and as a result, the combined text is generated. Combination text 'gambling' may be generated. If the language determined by the language type determination unit 222 is a language for handwriting in the left direction, the combined text generating unit 223 may generate the combined text by combining the phoneme unit text in consideration of the corresponding direction. .

Finally, the second keyword extraction unit 224 may extract the combination test 'gambling' as the second keyword.

Referring back to FIGS. 5 and 6 , the second keyword extraction unit 220 may further include a recombinant text generating unit 225 , and in step S220 , the language determined in step S222 by the recombinant text generating unit 225 . When the similarity between the shape of the first phoneme in the first language, which is a type, and the shape of the second phoneme, which is a different language from the first language, exceeds a preset value, the second phoneme is converted to the first phoneme. The method may further include generating the recombinant text by substituting (S225) and extracting the recombinant text as a second keyword by the second keyword extraction unit 224 (S226).

8 is S220 by the phoneme unit text extraction unit 221 , the language type determination unit 222 , the combined text generation unit 223 , the second keyword extraction unit 224 , and the recombinant text generation unit 225 of FIG. 6 . It is an exemplary diagram showing the state of extracting the second keyword in the step.

Referring to FIG. 8 , as in FIG. 8 , 'do r' is written in the first row and 'a' may be disclosed at the bottom of the 'bar' of the second row. In this case, 'do' in the first row and 'ㄱ' in the second row are Korean, and 'r' in the first row is a lowercase English alphabet.

The phoneme unit text extraction unit 221 extracts the phoneme unit text from the text of FIG. 8 , and as a result of the extraction, 'c, ㅗ, f, r, a' may be extracted.

The language type determination unit 222 may determine the type of the corresponding language based on each extracted phoneme. It may be determined that the phonemes 'c, ㅗ, f, a' are Korean and the 'r' phoneme is English.

The difference between FIG. 8 and FIG. 7 is that, in the case of FIG. 8 , the recombinant text generating unit 225 replaces 'r' with 'a' to generate the recombinant text.

More specifically, the recombinant text generating unit 225 sets the language having the highest frequency among the language types of each phoneme determined by the language type determining unit 222 as the first language, and sets the language of the next frequency as the second language. set to Accordingly, in the case of FIG. 8 , Korean may be set as the first language and English may be set as the second language.

Thereafter, it is determined whether the similarity exceeds a preset value by comparing the similarity between the shape of each phoneme of the first language and the shape of each phoneme of the second language. For example, in the case of FIG. 8 , the similarity between the shape of the first phoneme 'a', which is the first phoneme of the first language, and the shape of the second phoneme, 'r', which is the second phoneme, of English as the second language may exceed a preset value. In this case, the 'r' phoneme can be replaced with the 'a' phoneme.

If necessary, the determination data for the similarity comparison may be directly input by the user 50 , and the recombinant text generating unit 225 may compare the similarity based thereon.

Finally, the recombinant text may be extracted as the second keyword by the second keyword extraction unit 224 .

1 and 4 again, in step S200, the first keyword and the second keyword are set as suspicious keywords by the suspicious keyword setting unit 240 (S240), and suspicious by the related keyword calculating unit 250 Calculating a keyword related to the keyword (S250) and applying the suspicious keyword and the illegal suspicion determination model to the suspicious keyword and the related keyword by the suspicious illegal data determination unit 230 to determine the illegal suspicious data (S260) can

In steps S210 to S230, it is determined whether or not the suspected illegal data corresponds to the first keyword and the second keyword by applying the suspected illegality discrimination model.

Additionally, in steps S250 to S250, the illegal suspicion determination model can be applied not only to the first keyword and the second keyword, but also to a related keyword, which is a related keyword.

In this case, the related keyword may be a keyword provided when a suspicious keyword is input into a search engine.

For example, the suspicious keyword setting unit 240 may set 'toto' as a suspicious keyword, and the related keyword calculating unit 250 may use 'exchange, charging, playground', which is a related search word for 'toto', as a related keyword. can be calculated. Accordingly, the suspected illegal data determining unit 230 may determine whether or not suspicious data is illegal by additionally inputting 'toto' as well as 'exchange, charging, playground', etc. into the suspected illegal data determination model.

8 is a flowchart illustrating in more detail step S300 performed by the crime response module 300 .

Referring to FIG. 8 , step S300 may include a step (S310) of providing illegal suspicious data to the related organizations 40 for each online life crime by the related agency reporting unit 310, and the related agency reporting unit 310 It may further include the step of providing the URL address to the relevant organization 40 for each online life crime by.

In addition, information on the situation of the escape received by the user 50 may be provided together with the suspected illegal data. In this case, the relevant institutions 40 may include all public institutions related to online life crimes, such as the National Police Agency, the Financial Supervisory Service, the Fair Trade Commission, and the Korea Communications Standards Commission.

Step S300 may further include a step of providing a damage report procedure to the user 50 by the damage report procedure providing unit 320 .

For example, the damage report procedure provider 320 may guide the damage report procedure, recommend an expert or lawyer related to the damage, or guide how to receive advice from the expert or lawyer.

Step S300 may further include a step of providing a complaint or a complaint writing method to the user 50 by the complaint providing unit 330 or writing the complaint on behalf of the user 50 .

For example, if the user 50 is harmed, he or she guides how to write a complaint or complaint directly, or if the user delivers the damage to the complaint providing unit 330, receives it and writes a complaint or complaint based on it to provide it to the user 50 .

The present invention is a computer-readable recording medium, and may further include a recording medium in which a program for executing the above-described online life crime detection method (S10) with a computer is recorded.

Although the present invention has been described by way of examples above, the above examples are merely for explaining the spirit of the present invention and are not limited thereto. Those skilled in the art will understand that various modifications may be made to the above-described embodiments. The scope of the present invention is determined only through interpretation of the appended claims.

10: Online life crime detection system
20: Open Data
30: public data
40: Relevant organs
50: user
100: target data collection module
200: illegal suspicious data identification module
210: first keyword extraction unit
220: second keyword extraction unit
221: phoneme unit text extraction unit
222: language type determination unit
223: Combination text generation unit
224: second keyword extraction unit
225: Recombinant text generation unit
230: illegal suspicious data determination unit
240: suspicious keyword setting unit
250: related keyword calculation unit
300: crime response module
310: Reporting Department of Relevant Organizations
320: Damage report process provider
330: small intestine provision unit

Claims (10)

Online life crime detection system,
a) receiving target data for early detection of online life crimes;
b) determining illegal suspicious data by applying a suspicious illegal identification model to the target data; and
c) performing crime prevention measures and countermeasures for the suspected illegal data;
Step b) is:
b-1) extracting a first keyword by natural language processing after excluding special characters from text data included in the target data;
b-2) extracting a second keyword by applying an OCR model to the image data included in the target data; and
- Here, step b-2) is:
b-2-1) extracting text in phoneme units by applying an OCR model to image data included in the target data; b-2-2) determining a language type of the text based on the phoneme unit text; b-2-3) generating a combined text by combining the phoneme unit text in consideration of the handwriting direction in the language type determined in step b-2-2); and b-2-4) extracting the combined text as the second keyword.
b-3) applying the suspicious illegal identification model to the first keyword and the second keyword to determine the illegal suspicious data; According to claim 1,
Step a) is:
a-1) receiving target data from open data including a search engine and SNS through data crawling; and
a-2) An online life crime detection method comprising the step of receiving target data from a URL address through data crawling. delete delete According to claim 1,
Step b-2) is:
b-2-5) the shape of the first phoneme in the first language which is the language type determined in step b-2-2) by the recombinant text generating unit and the shape of the second language which is a language type different from the first language generating a recombinant text by replacing the second phoneme with the first phoneme when the similarity between shapes of the second phoneme exceeds a preset value; and
b-2-6) The online life crime detection method further comprising the step of extracting the recombinant text as the second keyword by a second keyword extraction unit. According to claim 1,
Step b) is:
b-4) setting the first keyword and the second keyword as suspicious keywords by a suspicious keyword setting unit;
b-5) calculating a related keyword associated with the suspicious keyword by a related keyword calculating unit; and
b-6) The online life crime detection method further comprising the step of determining the suspected illegal data by applying the suspicious illegal identification model to the suspicious keyword and the related keyword by a suspicious illegal data determining unit. 3. The method of claim 2,
Step c) is:
c-1) providing the suspected illegal data to the relevant organizations for each online life crime by the relevant organization reporting unit;
c-2) providing a damage report procedure to the user by a damage report procedure providing unit;
c-3) providing a complaint or complaint writing method to the user by the complaint providing unit, or writing the complaint on behalf of the user; and
c-4) An online life crime detection method comprising the step of providing the URL address to a related organization for each online life crime by the related organization reporting unit. According to claim 1,
The illegal suspicion detection model is:
An online life crime detection method configured to analyze the target data through a deep learning model and determine the illegal suspicious data based on the analysis result. 9. The method of claim 8,
The illegal suspicion detection model is:
performing learning based on the first learning data input from the user;
additionally learning the second learning data received from public data through the Open API;
An online life crime detection method configured to additionally learn third learning data, which is data determined as illegal suspicious data by the illegal suspicious determination model. a target data collection module configured to receive target data for performing early detection of online life crimes;
an illegal suspicious data determination module configured to determine illegal suspicious data by applying a suspicious illegal identification model to the target data; and
Including a crime response module configured to perform crime prevention measures and countermeasures for the suspected illegal data,
The illegal suspicious data identification module includes:
After excluding special characters from the text data included in the target data, natural language processing is performed to extract the first keyword, and the OCR model is applied to the image data included in the target data to extract the text in phoneme units, and the phoneme unit determining the language type of the text based on the text of An online life crime detection system for determining suspected illegal data by applying the suspicious illegal identification model to the first keyword and the second keyword.

Images