KR102408205B1 - Method and apparatus for detecting life cycle step of website - Google Patents

Abstract

According to an aspect of the present disclosure, a method for detecting a life cycle stage of a website includes: acquiring an input domain corresponding to the website; based on the input domain, whether the website is an existing site or a new site detecting whether or not there is, transmitting an access request of the website by using the input domain, and detecting a life cycle stage of the website based on the access request.

Description

Method and device for detecting life cycle stages of a website

The technical idea of the present disclosure relates to a method and apparatus for detecting a life cycle stage of a website.

A website refers to an aggregate in which various information or contents are stored on a web server so that users can provide information or contents whenever they need them on the Internet. Most of these websites are legal sites, but some websites are illegal sites, for example, copyright-violating sites that violate copyrights and illegally distribute content, or harmful sites that distribute harmful content.

Organizations are blocking these illegal sites through periodic monitoring and blocking of access. However, since the conventional illegal site monitoring is performed manually, there is a limit to manually detecting and blocking all illegal sites.

In addition, even if the illegal site is blocked, the operator of the illegal site can easily re-operate the illegal site through an avoidance method such as partially changing a domain. According to the conventional manual detection method, it is virtually impossible to immediately detect and block such a domain change.

An object of the present invention is to provide a method for automatically detecting whether a website corresponding to an input domain is an existing site or a new site.

An object of the present invention is to provide a method for automatically detecting a life cycle stage of a website corresponding to an input domain.

In order to achieve the above object, a method for detecting a life cycle stage of a website according to an aspect according to the technical spirit of the present disclosure includes: acquiring an input domain corresponding to the website; based on the input domain detecting whether the website is an existing site or a new site; transmitting a request for access to the website using the input domain; and a life cycle stage of the website based on the access request. detecting step.

According to an embodiment, the step of detecting whether the website is an existing site or a new site includes extracting a keyword domain from the input domain, checking whether the extracted keyword domain exists in the site DB; and detecting that the website is an existing website when the extracted keyword domain exists in the site DB.

According to an embodiment, the detecting whether the website is an existing site or a new site may include, when the extracted keyword domain does not exist in the site DB, the HTML tag sequence of websites included in the site DB calculating a degree of similarity between each of the keywords and an HTML tag sequence of the website corresponding to the input domain; detecting that the website corresponding to the input domain is an existing site, and if there is no website having a similarity higher than the reference value among the websites included in the site DB, the website corresponding to the input domain The method may further include detecting that the website is a new site.

According to an embodiment, the detecting of the life cycle stage of the website includes: receiving a response code corresponding to the access request; and when the received response code is a response code classified as a closed phase, the website and detecting the life cycle stage of the as the closed stage.

According to an embodiment, the detecting of the life cycle stage of the website may include receiving a response domain corresponding to the access request, comparing the input domain with the response domain, and based on a result of the comparison It may include detecting life cycle stages of the website.

According to an embodiment, the detecting of the life cycle stage of the website based on the comparison result may include detecting the life cycle stage of the website as an operation stage when the input domain and the response domain are the same. may include

According to an embodiment, the detecting of the life cycle stage of the website based on the comparison result may include, when the input domain and the response domain are different and the response domain is not included in the pre-classified domain, the web site It may include detecting the life cycle stage of the site as a change stage.

According to an embodiment, the detecting of the life cycle stage of the website based on the comparison result may include: when the input domain and the response domain are different and the response domain is included in the pre-classified domain, the input The method may further include: attempting a bypass access of the website corresponding to the domain; and detecting a life cycle stage of the website based on a result of the bypass access.

According to an embodiment, the detecting of the life cycle stage of the website may include: when access to the website is blocked, attempting a bypass access to the website corresponding to the input domain; and and detecting a life cycle stage of the website based on the result.

According to an embodiment, the detecting of the life cycle stage of the website based on the result of the bypass connection may include: when the access to the website is blocked, detecting the life cycle stage of the website as a closing stage , when the response domain received according to the bypass connection is the same as the input domain, detecting the life cycle stage of the website as a corresponding stage; and when the response domain is different from the input domain, the website lifetime detecting the cycle phase as a change phase.

An apparatus for detecting a website life cycle stage according to an aspect according to the technical idea of the present disclosure detects whether a website corresponding to a communication interface and an input domain is an existing site or a new site, and uses the input domain and a processor for controlling the communication interface to transmit the access request of the website, and detecting a life cycle stage of the website based on the access request.

According to the method and apparatus for detecting a website life cycle according to the technical idea of the present disclosure, the keyword domain of the input domain to be detected is extracted or the website in which the website already exists by using the HTML tag sequence of the website of the input domain. Whether it is a site or a newly created site can be automatically detected. Accordingly, more accurate and efficient management of websites, particularly illegal sites such as copyright infringing sites or harmful sites, can be achieved.

In addition, the method and apparatus for detecting a website life cycle according to the technical spirit of the present disclosure provides a method and apparatus for detecting a website based on whether access is blocked when accessing an input domain (normal access and bypass access), a response code, and/or a response domain. Life cycle stages can be automatically detected and managed. That is, unlike the prior art, as automatic detection and management of the life cycle stage of a website is possible, the speed, accuracy, and efficiency of detection and management can be maximized.

Effects according to the technical spirit of the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned may be clearly understood by those of ordinary skill in the art to which the present invention belongs from the description below. There will be.

In order to more fully understand the drawings cited in this disclosure, a brief description of each drawing is provided.
1 is a diagram for explaining the stages of the life cycle of a website.
2 is a block diagram showing the configuration of a system for performing a method for detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure.
3 is a flowchart illustrating an operation of detecting whether a website corresponding to an input domain is an existing website according to an exemplary embodiment of the present disclosure.
4 is an exemplary diagram illustrating a structure of a URL including a domain in relation to an operation of extracting a keyword domain from an input domain.
5A to 5B are flowcharts for explaining an operation of detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure.
6 is an exemplary diagram of a program code executed by a detection system to add a blocked website to a bypass access list.
7 is a table in which response codes provided from a web server are classified in response to a domain access request.
8 is an exemplary diagram of a program code executed by a detection system to detect a life cycle stage based on whether or not a redirect to a domain requesting access is made.
9 is a schematic block diagram of a device for detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure.

Exemplary embodiments according to the technical spirit of the present disclosure are provided to more fully explain the technical spirit of the present disclosure to those of ordinary skill in the art, and the following embodiments are modified in various other forms may be, and the scope of the technical spirit of the present disclosure is not limited to the following embodiments. Rather, these embodiments are provided to more fully and complete the present disclosure, and to fully convey the technical spirit of the present invention to those skilled in the art.

Although the terms first, second, etc. are used in this disclosure to describe various members, regions, layers, regions, and/or components, these members, parts, regions, layers, regions, and/or components refer to these terms It is self-evident that it should not be limited by These terms do not imply a specific order, upper and lower, or superiority, and are used only to distinguish one member, region, region, or component from another member, region, region, or component. Accordingly, a first member, region, region, or component to be described below may refer to a second member, region, region, or component without departing from the teachings of the present disclosure. For example, without departing from the scope of the present disclosure, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

Unless defined otherwise, all terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the concepts of this disclosure belong, including technical and scientific terms. In addition, commonly used terms as defined in the dictionary should be construed as having a meaning consistent with their meaning in the context of the relevant technology, and unless explicitly defined herein, in an overly formal sense. shall not be interpreted.

In the case where certain embodiments can be implemented differently, the order of specific processes may be performed differently from the described order. For example, two processes described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the described order.

As used herein, the term 'and/or' includes each and every combination of one or more of the recited elements.

Hereinafter, embodiments according to the technical spirit of the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining the stages of the life cycle of a website.

Referring to FIG. 1 , in general, the life cycle phases of a website may include a creation phase 10 , an operation phase 20 , a response phase 30 , a change phase 40 , and a closing phase 50 . . However, depending on the embodiment, the life cycle stages of the website may not be divided into only the life cycle stages shown in FIG. 1 .

The creation step 10 may refer to a step in which a website is initially created through initial registration of a domain. It may be common for the website to be converted to the operation stage 20 after the creation stage 10 . However, if the website is intentionally created so that it can be accessed only through bypass access (eg, providing services only in a specific country, etc.), the life cycle stage of the website will be converted to the corresponding stage 30 after the creation stage 10. can In addition, when the corresponding website is intentionally created for redirection to another website, the life cycle stage may be switched to the change stage 40 after the creation stage 10 . On the other hand, when the website is closed immediately after creation, the life cycle stage may be switched to the closing stage 50 after the creation stage 10 .

The operation step 20 may refer to a step in which a website can be accessed through an input domain without a separate bypass connection. In the case of legitimate websites, access will not be blocked by institutions, etc., so if the website is closed or the domain is not intentionally changed by the website administrator, the website's life cycle phase is the continuous operation phase. can keep On the other hand, when only bypass access through a VPN (virtual private network) is possible as access using the input domain is blocked in a specific country by an institution, etc., the life cycle phase of the website is switched to the corresponding step 30 can be

Corresponding step 30 means a step in which normal access from a specific country or specific IP address is blocked for the input domain, but bypass access using another country or other IP address is possible. Alternatively, the corresponding step 30 may refer to a step in which only a bypass connection to the previous domain of the website corresponding to the input domain is possible and the user is not redirected to another domain. The response step 30 is a step in which the Internet Service Provider (ISP) blocks normal access using the domain of the website by recognizing that the website is an illegal website such as copyright infringement or providing harmful content.

The change step 40 means a step in which normal access to the input domain is possible but redirects to another domain, or normal access to the previous domain of the website corresponding to the input domain is blocked but bypass access is possible, It may mean a step of redirecting to another domain when a bypass connection is made.

The closing step 50 may mean a step in which both normal access and bypass access are impossible for all domains, such as an input domain and a previous domain. That is, the closing step 50 may mean a step in which content, information, or services are no longer provided through the web server.

The method for detecting the life cycle stage of a website according to an embodiment of the present disclosure automatically detects the life cycle stage of the website based on the domain of the specific website, thereby allowing an administrator, such as an institution, to learn more about the website. Allows for an easy response.

Hereinafter, a method for detecting a life cycle stage of a website according to an embodiment of the present disclosure will be described in detail with reference to the drawings.

2 is a block diagram showing the configuration of a system for performing a method for detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure.

Referring to FIG. 2 , a system 100 (hereinafter, referred to as a 'detection system') for performing a method for detecting a life cycle stage of a website according to an embodiment of the present disclosure may include at least one computing device. Each of the at least one computing device corresponds to a hardware-based device including a processor, a memory, and/or a communication interface. In this case, the components included in the detection system 100 may be implemented as hardware, software, or a combination thereof, and may be implemented by being integrated or divided into the at least one computing device.

The detection system 100 may include a site detection unit 110 , a life cycle detection unit 120 , and a site database (DB) 130 .

When information on a domain (input domain) to be detected is acquired, the site detector 110 may detect whether a website corresponding to the acquired input domain is an existing site or a new site. According to an embodiment, the site detection unit 110 may include a keyword domain extraction unit 112 and a tag order comparison unit 114 .

The keyword domain extraction unit 112 may extract a keyword domain from the obtained input domain. The keyword domain may refer to a word or string for identifying a corresponding website among domains included in a uniform resource locator (URL). For example, in the URL "https://www.ajou.ac.kr/kr/index-2021.do" of the Ajou University website, the keyword domain may correspond to 'ajou'.

In general, administrators of illegal sites, such as copyright infringing sites or other harmful sites, apply various rules to keyword domains when the domain being used is blocked, create a newer domain with some modifications to the previous domain, and access illegal sites Avoid blocking. Based on this, the keyword domain extraction unit 112 may extract a keyword domain from the input domain and compare the extracted keyword domain with keyword domains of illegal sites registered in the site DB 130 . Based on the comparison result, the keyword domain extraction unit 112 may detect whether the website corresponding to the input domain is an existing site or a new site. The keyword domain extraction unit 112 will be described in more detail later with reference to FIGS. 3 and 4 .

On the other hand, when the administrator of the illegal site creates a newer domain using a keyword domain other than the existing keyword domain, the keyword domain extraction unit 112 will detect that the illegal site is a new site not registered in the site DB. . In this case, a problem arises that the life cycle stage of the illegal site cannot be accurately identified. To prevent this, the site detection unit 110 may further include a tag sequence comparison unit 114 .

The tag order comparison unit 114 may detect whether the website is an existing site or a new site by using information about an HTML tag order indicating a basic structure of a website corresponding to the input domain. Specifically, the tag sequence comparison unit 114 compares the HTML tag sequence of the website with the HTML tag sequences of illegal sites stored in the site DB 130, etc. to determine whether the website corresponding to the input domain is an existing site. whether or not it can be detected. Content related to the tag sequence comparison unit 114 will be described in more detail later with reference to FIG. 3 .

The life cycle detector 120 may detect a life cycle stage of a website corresponding to the input domain. According to an embodiment, since the generation step 10 is difficult to detect substantially, the life cycle detection unit 120 determines that the life cycle phase of the website corresponding to the input domain is the operation phase 20 and the corresponding phase. It is possible to detect whether any of the (30), the changing phase (40), and the closing phase (50) are present. To this end, the life cycle detection unit 120 according to an embodiment of the present disclosure may include a response code verification unit 122 , a response domain verification unit 124 , and a bypass connection execution unit 126 .

The response code check unit 122 may receive and confirm a response code transmitted from a web server of the website in response to a request for accessing the website using the input domain. The life cycle detection unit 120 may detect the life cycle stage of the website based on the response code confirmed by the response code verification unit 122 . For example, the life cycle detection unit 120 may detect that the life cycle stage of the website is the closing stage 50 when the confirmed response code is any one of the response codes classified as the closing stage 50 . have. Specific details related thereto will be described later with reference to FIGS. 5A to 7 .

The response domain check unit 124 may detect a life cycle stage of the website by checking an actual response domain (response domain) when accessing the website using the input domain is requested. The life cycle detector 120 may detect the life cycle stage based on whether the input domain and the response domain are the same. This will be described in more detail later with reference to FIGS. 5A to 8 .

The bypass connection execution unit 126 is configured to block access using the input domain (when a response code is not received), or a domain in which a response domain for the input domain is pre-classified (eg, a government agency (Broadcasting and Communications Review Committee) ), you can run a bypass connection using a VPN (virtual private network). According to an embodiment, the bypass connection execution unit 126 may include a VPN application, and the detection system 100 may attempt a bypass access to the input domain after executing the VPN application. The detection system 100 may detect a life cycle stage of the website based on whether the bypass connection is successful or not.

The site DB 130 may store information on a detection target website. For example, the detection target website may be an illegal site including a copyright infringement site or a harmful site. Information stored in the site DB 130 includes at least one domain (old domain and/or newest domain) corresponding to the detection target website, keyword domain, HTML tag sequence information, and website attributes (copyright infringement, harmfulness, etc.) ) may be included. The site DB 130 may be implemented in at least one computing device included in the detection system 10 , but may also be implemented in a separate database server connected to the detection system 10 according to an embodiment.

3 is a flowchart illustrating an operation of detecting whether a website corresponding to an input domain is an existing website according to an exemplary embodiment of the present disclosure. 4 is an exemplary diagram illustrating a structure of a URL including a domain in relation to an operation of extracting a keyword domain from an input domain.

Referring to FIG. 3 , the detection system 10 may acquire a domain (input domain) to be detected ( S300 ). The input domain may be included in a URL input through an input means (such as a keyboard) or may be included in a URL received from another device connected to the detection system 10 in communication. The input domain may be a domain of a URL of a website detected as an illegal site such as copyright infringement or harmful content provision, but is not limited thereto.

The detection system 10 may extract a keyword domain from the obtained input domain (S310). The keyword domain extraction unit 112 of the site detection unit 110 may extract a portion estimated to be a keyword domain from the input domain based on a predefined method.

In this regard, referring to FIG. 4 , the URL 400 may include a protocol 410 , a domain 420 , a sub-directory 430 , and a file name 440 . The domain 420 may include at least one sub-domain 422 and 424 and a top-level domain 426 .

The protocol 410 is a communication protocol used for data exchange between communication systems, and it can be seen that the HTTP protocol is used in the URL 400 of FIG. 4 . The sub-directory 430 and the file name 440 correspond to portions for indicating any one of web pages provided within the website. That is, the protocol 410 , the sub-directory 430 , and the file name 440 are not included in the domain 420 and may not correspond to the keyword domain.

The domain 420 is a character representation of a computer address on the Internet made of numbers (eg, the address of a web server of a website). The domain 420 may include a top-level domain 426 , sub-domains 422 and 424 , a host name, and the like. In general, the top-level domain 426 indicates a country or institution classification, a place of registration, and the like, and is far from a keyword domain of a website. The sub-domains 422 and 424 are parts that can be arbitrarily defined by the administrator of the website (web server), and in general, keyword domains for identifying the website may be included.

Accordingly, when the URL including the input domain is obtained, the keyword domain extraction unit 112 may extract the keyword domain from the subdomain of the obtained URL. For example, the keyword domain extraction unit 112 may extract the keyword domain using a general domain change rule of an illegal site. The domain change rule may vary, but some examples will be described as follows.

For example, when there is one sub-domain of the previous domain, the sub-domain may correspond to the keyword domain. In this case, the latest domain may be created by adding a number to the end of the keyword domain, adding a new subdomain to the right of the existing subdomain, or changing the top-level domain.

For example, when there are two sub-domains of the previous domain, the keyword domain may correspond to the right sub-domain. In this case, the latest domain may be created by changing or deleting the left sub-domain, adding a number to the end of the keyword domain, or changing the top-level domain.

The keyword domain extractor 112 may extract a keyword domain from the input domain based on the domain change rule described above. For example, when a number is added to the end of the subdomain (eg, 'ajou1'), the keyword domain extraction unit 112 extracts the remaining part ('ajou') from which the number is removed from the subdomain as the keyword domain. can do. According to an embodiment, the keyword domain extraction unit 112 may extract a plurality of keyword domains from the input domain based on the domain change rule. In this case, the detection system 100 may perform the following step S320 for each of the plurality of extracted keyword domains.

The detection system 100 may check whether the extracted keyword domain exists in the site DB 130 (S320). The keyword domain extraction unit 112 or processor (not shown) of the detection system 100 may check whether the extracted keyword domain is stored in the site DB 130 .

As a result of checking, if the extracted keyword domain exists in the site DB 130 (YES in S320), the detection system 100 may detect that the input domain is the latest domain of the existing site (S330). According to an embodiment, the detection system 100 may update the information on the input domain in the site DB 130 .

On the other hand, if the extracted keyword domain does not exist in the site DB 130 (NO in S320), the detection system 100 uses the HTML tag sequence of the website corresponding to the input domain to determine if the website is existing. It can detect whether it is a site or a new site.

Specifically, the detection system 100 may calculate a similarity between each of the HTML tag sequences of the websites in the site DB 130 and the HTML tag sequences of the website corresponding to the input domain ( S340 ).

Since the HTML tag sequence is information representing the unique structure of a website, if there is an existing site having an HTML tag sequence similar to that of the website corresponding to the input domain, the website corresponding to the input domain is It may be considered to be the same site as the site.

For example, the tag sequence comparison unit 114 utilizes a tool such as an HTML_similarity library of Python, each of the HTML tag sequences of the sites (websites) in the site DB 130, and the input domain. A degree of similarity between the HTML tag sequences of corresponding websites may be calculated.

Based on the result of calculating the degree of similarity, the detection system 100 may check whether a site having a similarity higher than a preset reference value among sites in the site DB 130 exists ( S350 ).

As a result of checking, if there is a site having a similarity higher than the reference value (YES in S350), the detection system 100 recognizes that the website corresponding to the input domain is an existing site having a similarity higher than the reference value, and , based on this, it can be detected that the input domain is the latest domain of the existing site (S360).

On the other hand, if there is no site having a similarity higher than the reference value (NO in S350), the detection system 100 may detect that the website corresponding to the input domain is a new site (S370).

For example, when the reference value is set to '90%', the detection system 100 may check whether a site having a similarity higher than 90% exists. As a result of the confirmation, if there is a site having a similarity higher than 90% (eg, 95%), the detection system 100 determines that the website corresponding to the input domain is the same as the site, and the input domain is that of the existing site. It can be detected that the domain is up-to-date.

3 to 4 , the detection system 100 extracts the keyword domain of the input domain to be detected or uses the HTML tag sequence of the website of the input domain to detect the website (illegal site). Whether it is an existing illegal site or a newly created illegal site can be automatically detected. Accordingly, more accurate and efficient management of illegal sites can be made.

5A to 5B are flowcharts for explaining an operation of detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure. 6 is an exemplary diagram of a program code executed by a detection system to add a blocked website to a bypass access list. 7 is a table in which response codes provided from a web server are classified in response to a domain access request. 8 is an exemplary diagram of a program code executed by a detection system to detect a life cycle stage based on whether or not a redirect to a domain requesting access is made.

5A to 5B , the detection system 100 may transmit a request for access to a website corresponding to an input domain ( S500 ).

The detection system 100 may transmit a request for accessing a website corresponding to the input domain to a DNS server of an Internet service provider (ISP) by using the URL including the input domain. The DNS server converts the URL included in the received access request into an IP address of a web server corresponding to the website, thereby proceeding to access the web server.

The detection system 100 may check whether access to the website is blocked (S505).

For example, when a response code to the access request is received or a response domain is received, the detection system 100 may confirm that access to the website is not blocked. On the other hand, when an access error occurs in response to the access request or a response code or response domain is not received, the detection system 100 may determine that access to the website is blocked.

When the access request of the website corresponding to the input domain is blocked (YES in S505), the detection system 100 may attempt a bypass access to the input domain as described later with reference to FIG. 5B (S545).

In this regard, referring to FIG. 6 , the detection system 100 (or the life cycle detection unit 120 ) may classify whether a bypass access attempt is required for the input domain based on whether access is blocked. In FIG. 6, a program code 600 for classifying a site (domain) requiring a bypass connection attempt based on whether or not "Connection Error" of the Python Requests library occurs is disclosed. However, this corresponds to an example for convenience of description, and a method for classifying whether a bypass access attempt is required for the input domain may be implemented in various ways.

On the other hand, when the access request of the website corresponding to the input domain is not blocked (NO in S505), the detection system 100 may check a response code corresponding to the access request (S510).

The response code is a code transmitted by the web server in response to the access request, and may correspond to an HTTP response code (or HTTP status code) included in an HTTP response message. Referring to the response code table 700 shown in FIG. 7 , the response code may be composed of three digits.

The state of the response code may be largely classified based on the number of the first digit. Specifically, when the first digit is '1', it means that the web server has received a request and continues to work, and the first digit of '2' means that the connection is successful. When the first digit is '3', it may mean a state in which an access request domain (new domain) and a response domain are different, that is, a state in which redirection has occurred.

Meanwhile, when the first digit is '4', it may mean that an error has occurred with respect to the access request. Looking at some of the specific response codes, a '400' response code means that the server did not recognize the syntax of the request (bad request), and '401' means a status that requires authentication for access (no permission). have. '402' means payment is required (payment required), '403' means the server rejects the request (prohibited). In particular, if the response page contains the "Forbidden" keyword, all user access is blocked. It may correspond to the closing step 50 as a state in which the website is not operated. '404' indicates that the requested page cannot be found (not found) and may mean that a web server corresponding to the new domain does not exist.

Meanwhile, when the first digit is '5', it may mean that a server error has occurred with respect to the access request. Among them, the '500' response code means that the domain server is not operating normally due to an internal error in the server.

The detection system 100 may detect a life cycle stage of a website corresponding to the input domain based on the response code.

Referring back to FIG. 5A , when the response code is identified as a response code classified as a closed phase, the detection system 100 detects that the life cycle phase of the website corresponding to the input domain is the closed phase 50 . It can be done (S515).

For example, the response code classified as the closing stage may include '404' and '500'. In addition, the '403' response code may be classified as a closed stage when the "Forbidden" keyword is included in the response page. When the response code received in response to the access request is '404', '500', or '403' including the keyword "Forbidden" in the response page, the detection system 100 is a website corresponding to the input domain. It can be detected that the life cycle stage of is a closed stage (50).

Meanwhile, the detection system 100 may check the domain (response domain) of the website accessed according to the access request (S520). As a result of the check, if the input domain and the response domain are the same (YES in S525), the detection system 100 may detect that the life cycle phase of the website corresponding to the input domain is the operation phase 20 ( S530).

When the input domain and the response domain are the same, it means that a website can be normally accessed using the input domain. Accordingly, the detection system 100 may detect that the life cycle stage of the website corresponding to the input domain is the operation stage 20 . Although not shown, the detection system 100 may detect that the life cycle phase is the operation phase 20 when the first digit of the response code is '2'.

On the other hand, when the input domain and the response domain are different (NO in S525), the detection system 100 may check whether the response domain is a pre-classified domain (S535).

The difference between the input domain and the response domain may mean that redirection occurs when accessing the input domain using the input domain. The detection system 100 may detect the occurrence of redirection by comparing whether the input domain and the response domain are the same. Alternatively, when the response code is '3xx', the detection system 100 may detect the occurrence of redirection by determining that the input domain and the response domain are different.

When the response domain is a pre-classified domain (YES in S535), the detection system 100 may attempt a bypass access to the input domain as described later with reference to FIG. 5B (S545). On the other hand, if the response domain is not a pre-classified domain (NO in S535), the detection system 100 may detect that the life cycle phase of the website corresponding to the input domain is the change phase 40 ( S540).

Redirection may be intentional by the website operator, or may be forced by an institution (such as the Korea Communications Standards Commission) (eg, redirection to the "warning.or.kr" domain).

In the case of redirection that is forcibly generated by an institution or the like, a website other than the website corresponding to the input domain is accessed. Since this redirection is not a redirection intended by the website operator, it is necessary to attempt a bypass connection in order to detect the lifecycle stage of the website. In particular, in the case of redirection that is forced by an institution, etc., since the redirected domain is constant (“warning.or.kr” domain in Korea), the domain can be classified as a domain requiring a bypass access attempt. That is, the response domain at the time of redirection forcibly generated by the institution may be included in the pre-classified domain. The detection system 100 may attempt a bypass connection when the response domain is the same as the previously classified domain.

On the other hand, in the redirection intended by the website operator, the website operator may change the access domain of the website from the input domain to another domain (the latest domain). That is, since the access domain of the website has been changed to the latest domain, the life cycle phase of the website may correspond to the change phase 40 . Since the response domain corresponding to the latest domain is not included in the pre-classified domain, the detection system 100 may detect the life cycle phase of the website as the changing phase 40 .

Referring to FIG. 5B , the detection system 100 attempts a bypass access to the website corresponding to the input domain when the access is blocked according to step S505 or the response domain is a pre-classified domain according to step S535. It can be (S545).

As described above in FIG. 2 , the bypass connection execution unit 126 of the life cycle detection unit 120 may include a VPN application for bypass connection. The bypass connection execution unit 126 may attempt a bypass access to the website using the input domain through the VPN.

If the access is blocked despite the bypass access attempt (YES in S550), it may mean that both the normal access and the bypass access to the website are impossible. Accordingly, the detection system 100 may detect the life cycle stage of the website as the closing stage 50 (S555).

On the other hand, when access to the website is possible during bypass access (NO in S550), the detection system 100 may detect a life cycle stage by comparing the input domain with the response domain (S560).

As a result of the comparison, if the input domain and the response domain are the same (YES in S560), the detection system 100 may detect the life cycle stage of the website corresponding to the input domain as the corresponding step 30 (S565) . On the other hand, when the input domain and the response domain are different (NO in S560) (when redirection occurs), the detection system 100 detects the life cycle stage of the website corresponding to the input domain as a change step 40 You can (S570).

Referring to an embodiment of the program code 800 shown in FIG. 8 , the response domain check unit 124 of the detection system 100 performs a connection (normal connection and bypass connection) using the input domain, the input domain. By comparing the response domain with the response domain, it is possible to determine whether redirection has occurred.

For example, when redirection occurs and the response URL (res.url) including the response domain is a URL ("http://warning.or.kr") including the pre-classified domain, the detection system 100 is A bypass connection may be attempted to the input domain.

On the other hand, when redirection does not occur and a VPN for bypass connection is used, the detection system 100 may detect the life cycle stage of the website corresponding to the input domain as the corresponding stage 30 . On the other hand, when redirection does not occur and a normal connection is made, the detection system 100 may detect the life cycle stage of the website as the operation stage 20 .

On the other hand, when redirection occurs and the response domain included in the response URL (res.url) does not correspond to a pre-classified domain, the detection system 100 changes the life cycle phase of the website to a changing phase 40 . can detect

The detection system 100 can manage the information on the life cycle stage of the website with the latest information by updating the information on the life cycle stage detected as described above in the site DB 130 .

According to the embodiment shown in FIGS. 5A to 8 , the detection system 100 according to the present disclosure is based on whether access is blocked, a response code, and/or a response domain during access (normal access and bypass access) using an input domain. Thus, it is possible to detect and manage the stages of the life cycle of a website. That is, unlike the prior art, as automatic detection and management of the life cycle stage of a website is possible, the speed, accuracy, and efficiency of detection and management can be maximized.

9 is a schematic block diagram of a device for detecting a life cycle stage of a website according to an exemplary embodiment of the present disclosure.

Referring to FIG. 9 , a device 900 according to an embodiment of the present disclosure may correspond to any one of at least one computing device constituting the detection system 100 described above in FIG. 2 .

The device 900 may include a processor 910 , a communication interface 920 , and a memory 930 . However, the components of the device 900 are not limited to the above-described example. For example, the device 900 may include more or fewer components than the aforementioned components. In addition, the processor 910 may be at least one, and the communication interface 920 and the memory 930 may also be at least one each. In addition, two or more of the processor 910 , the communication interface 920 , and the memory 930 may be combined into one chip.

According to an embodiment, the processor 910 may correspond to the keyword domain extractor 112 that extracts a keyword domain from an input domain based on predefined domain change rules (patterns). The processor 910 may detect whether the website corresponding to the input domain is an existing site or a new site by comparing the extracted keyword domain with keyword domains stored in the site DB 130 .

According to an embodiment, the processor 910 compares the HTML tag sequence of the website corresponding to the input domain with the HTML tag sequence of each of the websites stored in the site DB 130 to calculate the similarity of the tag sequence comparison unit It can correspond to (114). The processor 910 may detect whether the website corresponding to the input domain is an existing site or a new site based on the calculated similarities.

According to an embodiment, the processor 910 controls the communication interface 920 to transmit an access request using the input domain, and receives a response message including a response code and/or a response domain through the communication interface 920 . can receive The processor 910 provides a response code verification unit 122 and/or a response domain verification unit 124 for detecting a life cycle stage of a website corresponding to the input domain based on the received response code and/or response domain. can respond

According to an embodiment, the processor 910 may correspond to the bypass connection execution unit 126 that executes a bypass connection of a website corresponding to the input domain through a VPN. The processor 910 may detect a life cycle stage of the website based on whether or not a connection is made or a response domain during the bypass connection.

According to an embodiment, the processor 910 may update information stored in the site DB 130 based on the above-described detection result (existing site status and/or life cycle stage).

The processor 910 includes hardware such as a CPU, an application processor (AP), an integrated circuit, a microcomputer, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), and/or a neural processing unit (NPU). can do.

The communication interface 920 may connect the device 900 to another device, a DNS server, a web server of a website, and the like through a network. The communication interface 920 may include a modem supporting at least one of various known wired/wireless communication methods.

According to an embodiment of the present disclosure, the memory 930 may store programs and data necessary for the operation of the device 900 .

Also, the memory 930 may store at least one of data generated or acquired through the processor 910 . According to an embodiment, the memory 930 may include the site DB 130 described above with reference to FIG. 2 .

The memory 930 may be configured of a storage medium such as ROM, RAM, flash memory, SSD, HDD, or a combination of storage media.

Since the descriptions of the above embodiments are merely those given with reference to the drawings for a more thorough understanding of the present disclosure, they should not be construed as limiting the technical spirit of the present disclosure.

In addition, it will be apparent to those of ordinary skill in the art to which the present disclosure pertains that various changes and modifications can be made without departing from the basic principles of the present disclosure.

Claims (15)

A method for detecting a life cycle stage of a website using at least one computing device, the method comprising:
obtaining an input domain corresponding to the website;
detecting whether the website is an existing site or a new site based on the input domain;
transmitting a request for access to the website by using the input domain; and
based on the access request, detecting a life cycle stage of the website;
The step of detecting whether the website is an existing site or a new site comprises:
extracting a site keyword domain from the input domain and checking whether the extracted keyword domain exists in the site DB;
When the extracted keyword domain does not exist in the site DB, calculating a similarity between each of the HTML tag sequences of the websites included in the site DB and the HTML tag sequence of the website corresponding to the input domain; ; and
based on the calculated similarity, detecting whether the website corresponding to the input domain is an existing site or a new site,
How to detect stages in the life cycle of a website. According to claim 1,
The step of detecting whether the website is an existing site or a new site comprises:
extracting a keyword domain from the input domain;
checking whether the extracted keyword domain exists in the site DB; and
If the extracted keyword domain exists in the site DB, further comprising the step of detecting that the website is an existing site,
How to detect stages in the life cycle of a website. According to claim 1,
Detecting whether the website corresponding to the input domain is an existing site or a new site based on the calculated similarity includes:
detecting that a website corresponding to the input domain is an existing website, when a website having a similarity higher than a reference value exists among websites included in the site DB; and
The method further comprising: detecting that the website corresponding to the input domain is a new website when there is no website having a similarity higher than the reference value among the websites included in the site DB;
How to detect the stages of a website life cycle. According to claim 1,
The step of detecting the life cycle stage of the website comprises:
receiving a response code corresponding to the access request; and
detecting the life cycle stage of the website as the closing stage when the received response code is a response code classified as the closing stage;
How to detect the stages of a website life cycle. According to claim 1,
The step of detecting the life cycle stage of the website comprises:
receiving a response domain corresponding to the access request;
comparing the input domain and the response domain; and
detecting a life cycle stage of the website based on the comparison result;
How to detect the stages of a website life cycle. 6. The method of claim 5,
The step of detecting the life cycle stage of the website based on the comparison result comprises:
When the input domain and the response domain are the same, detecting the life cycle stage of the website as an operation stage,
How to detect the stages of a website life cycle. 6. The method of claim 5,
The step of detecting the life cycle stage of the website based on the comparison result comprises:
detecting the life cycle phase of the website as a change phase when the input domain and the response domain are different and the response domain is not included in the pre-classified domain;
How to detect the stages of a website life cycle. 8. The method of claim 7,
The step of detecting the life cycle stage of the website based on the comparison result comprises:
attempting a bypass access to the website corresponding to the input domain when the input domain and the response domain are different and the response domain is included in the pre-classified domain; and
detecting a life cycle stage of the website based on a result of the bypass connection;
How to detect the stages of a website life cycle. According to claim 1,
The step of detecting the life cycle stage of the website comprises:
when access to the website is blocked, attempting a bypass access to the website corresponding to the input domain; and
detecting a life cycle stage of the website based on a result of the bypass connection;
How to detect the stages of a website life cycle. 10. The method according to claim 8 or 9,
Detecting the life cycle stage of the website based on the result of the bypass connection,
detecting a life cycle phase of the website as a closed phase when access to the website is blocked;
detecting a life cycle stage of the website as a corresponding stage when the response domain received according to the bypass connection is the same as the input domain; and
detecting the life cycle stage of the website as a change stage when the response domain is different from the input domain;
How to detect the stages of a website life cycle. communication interface; and
Detect whether the website corresponding to the input domain is an existing site or a new site,
controlling the communication interface to transmit a request for access to the website by using the input domain;
A processor for detecting a life cycle stage of the website based on the access request,
The processor is
extracting a site keyword domain from the input domain;
Checking whether the keyword domain exists in the DB in the site DB included in the detection device or included in the device connected through the communication interface,
If the extracted keyword domain does not exist in the site DB, calculating a similarity between each of the HTML tag sequences of the websites included in the site DB and the HTML tag sequence of the website corresponding to the input domain;
based on the calculated similarity, detecting whether the website is an existing site or a new site,
Website lifecycle detection device. 12. The method of claim 11,
The processor is
When the extracted keyword domain exists in the site DB, detecting that the website is an existing site,
Website lifecycle detection device. 12. The method of claim 11,
The processor is
If there is a website having a similarity higher than a reference value among websites included in the site DB, it is detected that the website corresponding to the input domain is an existing website,
Detecting that a website corresponding to the input domain is a new website when there is no website having a similarity higher than the reference value among websites included in the site DB;
Website lifecycle detection device. 12. The method of claim 11,
The processor is
receiving a response code corresponding to the access request;
When the received response code is a response code classified as a closing stage, detecting the life cycle stage of the website as a closing stage,
Website lifecycle detection device. 12. The method of claim 11,
The processor is
receiving a response domain corresponding to the access request;
detecting the life cycle stage of the website based on whether the received response domain and the input domain are the same,
Website lifecycle detection device.

Images