KR102428235B1 - System for blocking harmful site and method thereof - Google Patents

Abstract

The present invention discloses a system for blocking a harmful site and a method thereof. According to the present invention, when a terminal attempts to access a specific site, a screen of the specific site is obtained based on the information about the specific site obtained from the terminal, and if a previously acquired screen of a specific site is included among a plurality of screens included in the pre-stored blacklist, access to the specific site from the corresponding terminal is blocked. Therefore, it is possible to prevent leakage of user's personal information.

Description

System for blocking harmful site and method thereof

The present invention relates to a system for blocking harmful sites and a method therefor. In particular, when a terminal attempts to access a specific site, a screen of the specific site is obtained based on information about the specific site obtained from the terminal, and a pre-stored black The present invention relates to a harmful site blocking system and method for blocking access to a specific site from a corresponding terminal when a screen of a previously obtained specific site is included among a plurality of screens included in a list.

Harmful site refers to a site containing information deemed necessary for deliberation, such as illegal information pursuant to Article 44-7 of the Korea Communications Commission's Establishment and Operation Act, and information harmful to juveniles pursuant to Article 8 (1) of the Enforcement Decree.

These harmful sites are obscene, defamatory, fear or anxiety-inducing, hacking, speculative, illegal transactions, anti-government, terrorism, and criminal sites. It is regulated in a way that blocks access to the

In addition, in the case of blocking access to the harmful site, URL information or DNS information of the harmful site is collected, and when the user wants to access the harmful site, the collected URL information or DNS information of the harmful site Since the user's access to the harmful site is restricted using the

Korean Registration No. 10-1808033 [Title: Method and Device for Blocking Harmful Sites Using Accessibility Events]

An object of the present invention is to obtain a screen of a specific site based on information about a specific site obtained from a terminal when a terminal attempts to access a specific site, and obtain a screen from a plurality of screens included in a pre-stored blacklist. An object of the present invention is to provide a harmful site blocking system and method for blocking access to a specific site from a corresponding terminal when a screen of a specific site is included.

Another object of the present invention is to collect XML data related to a specific site based on information about the specific site obtained from the terminal when a terminal attempts to access a specific site, and to collect a plurality of XML data included in a pre-stored blacklist. An object of the present invention is to provide a harmful site blocking system and method for blocking access to a specific site from a corresponding terminal when XML data related to a specific site obtained above is included in the data.

A harmful site blocking system according to an embodiment of the present invention includes: a terminal for transmitting the selected link information when link information included in content is selected; and accessing a website corresponding to the link information transmitted from the terminal to obtain a screen of the website, and whether the acquired screen of the website is included in the blacklist including a plurality of harmful screens stored in advance in the server It is determined whether or not, and as a result of the determination, when the obtained web site screen is not included in the blacklist including a plurality of harmful screens previously stored in the server, the terminal and link information to be accessed by the terminal and the server performing a connection function between web sites corresponding to the .

As an example related to the present invention, the server confirms at least one of a color in the screen of the obtained website, the position or size of one or more objects, and text in the screen of the website through a character recognition function, and the confirmation Whether at least one of the color, the position or size of one or more objects, and the text in the screen of the website is similar to at least one of the color, the position or size of one or more objects, and the text in the plurality of harmful screens included in the blacklist can be judged

A harmful site blocking method according to an embodiment of the present invention includes, by a server, accessing a web site corresponding to link information transmitted from a terminal, and acquiring a screen of the web site; determining, by the server, whether a screen of the obtained website is included in a blacklist including a plurality of harmful screens previously stored in the server; As a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens stored in advance in the server, the server provides the link address corresponding to the link address to be accessed from the terminal. It is determined that the website is a harmful site, blocks access to the website corresponding to the link address from the terminal, and transmits guide information indicating that the website to be accessed from the terminal is a harmful site to the terminal step; and displaying, by the terminal, guide information transmitted from the server.

As an example related to the present invention, the step of determining whether the acquired website screen is included in the blacklist may include determining a plurality of similarities between a plurality of harmful screens included in the blacklist and the acquired website screens. the process of calculating each; and determining whether one or more similarities greater than or equal to a preset reference value exist among the plurality of calculated similarities.

As an example related to the present invention, the step of determining whether the screen of the obtained website is included in the blacklist may include: a color in the screen of the obtained website, a position or size of one or more objects, and a character recognition function. checking at least one of texts in the screen of the website through the process; and at least one of a color, a position or size of one or more objects, and text in the screen of the identified website is at least one of a color in a plurality of harmful screens included in the blacklist, a position or size of one or more objects, and text; It may include a process of determining whether they are similar.

As an example related to the present invention, as a result of the determination, when the screen of the obtained website is not included in the blacklist including a plurality of harmful screens previously stored in the server, by the server, the terminal and the The method may further include performing a connection function between web sites corresponding to link information to be accessed by the terminal.

A harmful site blocking system according to an embodiment of the present invention includes: a terminal for transmitting the selected link information when link information included in content is selected; and accessing a web site corresponding to the link information transmitted from the terminal, collecting XML data related to the web site, and relating to the collected web site from a blacklist including a plurality of harmful XML data stored in advance in a server. It is determined whether XML data is included, and as a result of the determination, when the XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in the server in advance, the terminal accesses It is determined that the website corresponding to the desired link address is a harmful site, the terminal blocks access to the website corresponding to the link address, and indicates that the website to be accessed from the terminal is a harmful site and the server for transmitting guide information to the terminal.

A harmful site blocking method according to an embodiment of the present invention includes, by a server, accessing a web site corresponding to link information transmitted from a terminal, and collecting XML data related to the web site; determining, by the server, whether XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in the server in advance; and when, as a result of the determination, XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data stored in the server in advance, by the server, the terminal and the terminal are connected The method may include performing a connection function between web sites corresponding to desired link information.

As an example related to the present invention, the step of determining whether XML data related to the collected web site is included in the blacklist is a process of checking one or more components included in the XML data related to the collected web site ; and determining whether the at least one identified component is similar to a plurality of harmful XML data included in the blacklist.

As an example related to the present invention, when the XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in advance in the server as a result of the determination, by the server, the terminal determines that the web site corresponding to the link address to be accessed is a harmful site, blocks access to the web site corresponding to the link address from the terminal, and the web site to be accessed from the terminal is a harmful site transmitting guide information indicating that and displaying, by the terminal, guide information transmitted from the server.

In the present invention, when a terminal attempts to access a specific site, a screen of the specific site is obtained based on information about the specific site obtained from the terminal, and a previously obtained specific site from among a plurality of screens included in a pre-stored blacklist is obtained. When the screen of the site is included, the user's personal information can be prevented from being leaked by blocking access to a specific site from the corresponding terminal.

In addition, the present invention collects XML data related to the specific site based on information on the specific site obtained from the terminal when an attempt is made to access a specific site from the terminal, and a plurality of XML data included in a pre-stored blacklist Among them, when XML data related to a specific site obtained above is included, access to the specific site from the corresponding terminal is blocked, thereby preventing the user from being exposed to risk information.

1 is a block diagram showing the configuration of a harmful site blocking system according to an embodiment of the present invention.
2 is a flowchart illustrating a method for blocking harmful sites according to the first embodiment of the present invention.
3 is a diagram illustrating an example of a screen configuration of a terminal according to an embodiment of the present invention.
4 is a flowchart illustrating a method for blocking harmful sites according to a second embodiment of the present invention.

It should be noted that the technical terms used in the present invention are only used to describe specific embodiments, and are not intended to limit the present invention. In addition, the technical terms used in the present invention should be interpreted as meanings generally understood by those of ordinary skill in the art to which the present invention belongs, unless otherwise defined in the present invention, and excessively comprehensive It should not be construed as a human meaning or in an excessively reduced meaning. In addition, when the technical term used in the present invention is an incorrect technical term that does not accurately express the spirit of the present invention, it should be understood by being replaced with a technical term that can be correctly understood by those skilled in the art. In addition, general terms used in the present invention should be interpreted as defined in advance or according to the context before and after, and should not be interpreted in an excessively reduced meaning.

Also, the singular expression used in the present invention includes the plural expression unless the context clearly dictates otherwise. In the present invention, terms such as "consisting of" or "comprising" should not be construed as necessarily including all of the various components or various steps described in the invention, and some components or some steps may not be included. It should be construed that it may further include additional components or steps.

Also, terms including ordinal numbers such as first, second, etc. used in the present invention may be used to describe the components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of the reference numerals, and the redundant description thereof will be omitted.

In addition, in the description of the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, it should be noted that the accompanying drawings are only for easy understanding of the spirit of the present invention, and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

1 is a block diagram showing the configuration of a harmful site blocking system 10 according to an embodiment of the present invention.

As shown in FIG. 1 , the harmful site blocking system 10 includes a terminal 100 and a server 200 . Not all of the components of the harmful site blocking system 10 shown in FIG. 1 are essential components, and the harmful site blocking system 10 may be implemented by more components than the components shown in FIG. The harmful site blocking system 10 may be implemented with fewer components.

The terminal 100 includes a smart phone, a portable terminal, a mobile terminal, a foldable terminal, a personal digital assistant (PDA), and a portable multimedia (PMP). Player) terminal, telematics terminal, navigation terminal, personal computer, notebook computer, slate PC, tablet PC, ultrabook, wearable device Device, for example, watch-type terminal (Smartwatch), glass-type terminal (Smart Glass), HMD (Head Mounted Display), etc.), Wibro (Wibro) terminal, IPTV (Internet Protocol Television) terminal, smart TV, for digital broadcasting It can be applied to various terminals such as a terminal, an audio video navigation (AVN) terminal, an audio/video (A/V) system, a flexible terminal, and a digital signage device.

The server 200 may be implemented in the form of a web server, a database server, a proxy server, or the like. In addition, one or more of a network load balancing mechanism, or various software that enables the server 200 to operate on the Internet or other networks may be installed in the server 200, which will be implemented as a computerized system. can Also, the network may be an http network, and may be a private line, an intranet, or any other network. Furthermore, the connection between the terminal 100 and the server 200 may be connected to a secure network so that data is not attacked by any hacker or other third party. In addition, the server 200 may include a plurality of database servers, and these database servers may be implemented in such a way that they are separately connected to the server 200 through any type of network connection including a distributed database server architecture. have.

Each of the terminal 100 and the server 200 includes a communication unit (not shown) for performing a communication function with other terminals, a storage unit (not shown) for storing various information and programs (or applications), and various A display unit (not shown) for displaying information and program execution results, a voice output unit (not shown) for outputting voice information corresponding to the various information and program execution results, and controlling various components and functions of each terminal It may include a control unit (not shown) for

The terminal 100 communicates with the server 200 , a hosting server (not shown) for operating a website, and another terminal (not shown) for sharing content (or information/data). Here, the terminal 100 has a function of accessing a website provided by the hosting server through a dedicated app (or dedicated website) provided by the server 200, and shares (or transmits/receives) content with the other terminal. It may be a terminal possessed by a general user to receive a function, etc.

In addition, the terminal 100 is a general user for receiving a website access function, a content sharing function, etc. through a dedicated app and/or website provided by the server 200 by interworking with the server 200 . to register as a member, and personal information and the like are registered in the server 200 . In this case, the personal information includes an ID, e-mail address, password (or password), name, gender, date of birth, contact information, address (or address information), and the like.

In addition, the terminal 100 may sign up as a user to the server 200 by using the SNS account information or account information of a third-party site subscribed by the user of the terminal 100 as a user. Here, the SNS account may be information related to Facebook, Twitter, Instagram, Kakao Story, Naver blog, and the like. In addition, the third-party account may be information related to YouTube, Kakao, Naver, and the like.

In addition, when performing the membership registration procedure, the terminal 100 must complete the authentication function through the self-authentication means (eg, mobile phone, credit card, i-Pin, etc.) to perform the membership registration procedure for the server 200 normally. can be completed

In addition, after membership registration is completed, the terminal 100 corresponds to a dedicated app (or application/application program/specific app) provided from the server 200 in order to use the service provided by the server 200 . installed in the terminal 100 . In this case, the dedicated app may be an app for performing a website access function, a content sharing function, and the like.

Also, after membership registration is completed, the terminal 100 may display a discount coupon provided from the server 200 through a corresponding dedicated app. In this case, the discount coupon may be a discount coupon including discount information of a certain percentage when performing a web site access function, a content sharing function, etc. provided by the server 200 .

In addition, when the corresponding link information is selected from among contents (eg, including text, image, etc.) including link information (or URL information/website address) displayed on the terminal 100, the terminal 100 is The selected link information and identification information of the terminal 100 are transmitted to the server 200 . Here, the identification information of the terminal 100 includes a mobile directory number (MDN), mobile IP, mobile MAC, subscriber identity module (Sim) card unique information, serial number, and the like.

That is, when the corresponding link information is selected from among the contents (eg, including text, image, etc.) including link information displayed on the terminal 100, the terminal 100 is displayed on the website corresponding to the corresponding link information. In order to access, the corresponding link information (or content including the corresponding link information), identification information of the terminal 100, and the like are transmitted to the server 200 . At this time, the terminal 100 transmits the link information, identification information of the terminal 100, etc. through the dedicated app running in the background state while the dedicated app provided from the server 200 is running in the background state. It can be transmitted to the server 200 .

In addition, as a result of determining whether the link information is harmful in the server 200, when it is determined that the website corresponding to the link information is harmful, the terminal 100 responds to the previously transmitted link information, etc., to the server Receive guidance information indicating that the website to be accessed by the terminal 100 is a harmful site transmitted from 200, and receive guidance information indicating that the received website to be accessed from the terminal 100 is a harmful site Display (or output).

In addition, the terminal 100 ends the access process to the website corresponding to the link information. At this time, the terminal 100 permanently deletes the content including the link information from the terminal 100 (or spam processing), and information (eg, a phone call) of another terminal (not shown) that provided the content. You can also spam (or blindly process numbers, email addresses, messenger account information, etc.).

In addition, as a result of determining whether the link information is harmful in the server 200, when it is determined that the website corresponding to the link information is not harmful, the terminal 100 intermediaries ( or management) accesses (or connects) to a website corresponding to the link information to be accessed from the corresponding terminal 100 .

In an embodiment of the present invention, the terminal 100 may perform various functions (eg, including a website access function, a content sharing function, etc.) provided by the server 200 in the form of a dedicated app or a web site. .

The server 200 communicates with the terminal 100 , the hosting server, the other terminal, and the like.

In addition, the server 200 performs a membership registration procedure for a user of the terminal 100 and the like.

In addition, the server 200 registers personal information related to a user of the terminal 100 and the like. In this case, the server 200 may register (or manage) the corresponding personal information in a DB server (not shown).

In addition, the server 200 performs a member management function for a user such as the terminal 100 .

In addition, the server 200 provides a dedicated app and/or a website that provides a website access function, a content sharing function, and the like, to the terminal 100 and the like.

In addition, the server 200 provides a bulletin board function for announcements, events, and the like.

In addition, the server 200 identifies as a harmful site in relation to a specific screen related to specific raw data, specific XML data, etc. with respect to a harmful site determination model through a plurality of screens related to the blacklist for learning, a plurality of XML data, etc. It performs a learning function for the contents of harmful sites. At this time, the server 200 stores raw data in parallel and distributed, and stored raw data (or including a plurality of screens related to a blacklist for learning, a plurality of XML data, etc.) Structured) data and semi-structured data are refined, preprocessing including classification is performed as metadata, and analysis including data mining is performed on the preprocessed data, and at least one type of machine Big data can be built by conducting learning, training, and testing based on learning. At this time, at least one type of machine learning is supervised learning, semi-supervised learning, unsupervised learning, reinforcement learning, and deep reinforcement learning. It may consist of any one or a combination of at least one.

That is, the server 200 performs a learning function on the harmful site determination model in the form of a neural network through a plurality of screens related to the blacklist for learning, a plurality of XML data, and the like.

In addition, the server 200 receives link information transmitted from the terminal 100 , identification information of the terminal 100 , and the like.

Also, the server 200 accesses a web site corresponding to the received link information, and acquires (or captures) a screen of the web site. Here, the screen of the website is an initial screen of the website, one or more screens corresponding to one or more sub-link information linked from the initial screen, etc., and includes a color and one or more objects (for example, text , including images, etc.) and the like.

In addition, the server 200 determines (or confirms) whether the acquired (or captured) web site screen is included in the blacklist including a plurality of harmful screens previously stored in the server 200 . Here, the plurality of harmful screens included in the blacklist include screens collected from harmful sites such as obscenity, defamation, fear or anxiety, hacking, speculative, illegal trade, anti-government, terrorism, and crime.

At this time, the server 200 calculates a plurality of similarities between the plurality of harmful screens included in the blacklist and the obtained website screen, respectively, and a preset reference value (for example, 90%) among the plurality of calculated similarities. ) or more (or at least one harmful screen corresponding to the at least one similarity among the plurality of harmful screens) may be determined.

Here, the server 200 performs an analysis function on the obtained screen of the website, the color in the screen of the website, the position or size of one or more objects (including, for example, text, image, etc.), the character Check the text in the screen of the website through the recognition function, and the identified color in the screen of the corresponding website, the position or size of one or more objects, and the color in the plurality of harmful screens in which the text is included in the blacklist , it is also possible to determine whether the position or size of one or more objects, text, and the like are similar.

Also, the server 200 may determine whether the obtained web site screen is included in the white list including a plurality of other screens previously stored in the server 200 .

When the screen of the obtained website is included in the blacklist including a plurality of harmful screens pre-stored in the server 200 as a result of the determination (or the check result), the server 200 is the terminal In step 100 , guide information indicating that the website to be accessed is a harmful site is transmitted to the terminal 100 .

That is, in the determination result (or the confirmation result), when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) exists among the plurality of calculated similarities, the server 200 controls the terminal 100 determines that the website corresponding to the link address to be accessed is a harmful site, blocks access to the website corresponding to the link address from the terminal 100, and wants to access from the terminal 100 guide information indicating that a web site (or a web site corresponding to the link address) is a harmful site is transmitted to the terminal 100 .

In addition, when the obtained web site screen is not included in the white list including a plurality of other screens previously stored in the server 200 as a result of the determination (or the check result), the server 200 transmits to the terminal 100 other guide information guiding that the web site to be accessed by the terminal 100 is an unauthorized site. Here, the terminal 100 receives other guide information guiding that the website to be accessed from the terminal 100 is an unauthorized site transmitted from the server 200, and the received terminal 100 Displays (or prints) other guide information guiding that the website you want to access is an unauthorized site.

In addition, when the obtained web site screen is not included in the blacklist including a plurality of harmful screens pre-stored in the server 200 as a result of the determination (or the check result), the server 200 performs a connection (or connection) function between the terminal 100 and a website corresponding to the link information to be accessed by the terminal 100 . In this case, the server 200 may apply a redirecting function to the terminal 100 and the web site.

That is, when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) does not exist among the plurality of calculated similarities in the determination result (or the confirmation result), the server 200 controls the terminal 100 ) determines that the web site corresponding to the link address to be accessed is not a harmful site, and mediates (or manages/performs) access to the web site corresponding to the link address from the terminal 100 .

In addition, when the screen of the obtained website is included in the white list including a plurality of other screens pre-stored in the server 200 as a result of the determination (or the check result), the server 200 is It is determined that the web site corresponding to the link address to be accessed from the terminal 100 is not a harmful site, and the terminal 100 mediates (or manages / manages / do).

In addition, the server 200 receives link information transmitted from the terminal 100 , identification information of the terminal 100 , and the like.

In addition, the server 200 accesses a web site corresponding to the received link information, and collects one or more XML data related to the web site. Here, the XML data (or XML metadata) includes a header, an IP address, and the like related to a corresponding web site. In this case, the server 200 may collect XML data related to the web site corresponding to the link information by using a preset browser API (or XML data collection API).

Also, the server 200 determines (or checks) whether XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in advance in the server 200 . Here, the plurality of harmful XML data included in the blacklist includes XML data collected from harmful sites such as obscenity, defamation, fear or anxiety, hacking, speculative, illegal trade, anti-government, terrorism, and crime.

In this case, the server 200 calculates a plurality of similarities between the plurality of harmful XML data included in the blacklist and the XML data related to the collected web site, respectively, and sets other preset reference values ( For example, it may be determined whether one or more similarities (or one or more harmful XML data corresponding to the one or more similarities among the plurality of harmful XML data) exist.

Here, the server 200 performs an analysis function on the XML data related to the collected web site, and checks one or more components (including, for example, a header, an IP address, etc.) included in the XML data, It may be determined whether the at least one identified component is similar to a plurality of harmful XML data included in the blacklist.

Also, the server 200 may determine whether the collected XML data of the web site is included in the white list including a plurality of different XML data stored in advance in the server 200 .

When the determination result (or the confirmation result) indicates that XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data previously stored in the server 200, the server 200 transmits to the terminal 100 guide information indicating that the website to be accessed by the terminal 100 is a harmful site.

That is, in the determination result (or the confirmation result), when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) exists among the plurality of calculated similarities, the server 200 controls the terminal 100 determines that the website corresponding to the link address to be accessed is a harmful site, blocks access to the website corresponding to the link address from the terminal 100, and wants to access from the terminal 100 guide information indicating that a web site (or a web site corresponding to the link address) is a harmful site is transmitted to the terminal 100 .

In addition, when the XML data of the collected web site is not included in the white list including the determination result (or the confirmation result), a plurality of other XML data pre-stored in the server 200, the server ( 200) transmits to the terminal 100 other guide information guiding that the web site to be accessed by the terminal 100 is an unauthorized site. Here, the terminal 100 receives other guide information guiding that the website to be accessed from the terminal 100 is an unauthorized site transmitted from the server 200, and the received terminal 100 Displays (or prints) other guide information guiding that the website you want to access is an unauthorized site.

In addition, when the determination result (or the confirmation result), the XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data pre-stored in the server 200 , the server 200 performs a function of accessing (or connecting) between the terminal 100 and a website corresponding to link information to be accessed by the terminal 100 . In this case, the server 200 may apply a redirecting function to the terminal 100 and the web site.

That is, when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) does not exist among the plurality of calculated similarities in the determination result (or the confirmation result), the server 200 controls the terminal 100 ) determines that the web site corresponding to the link address to be accessed is not a harmful site, and mediates (or manages/performs) access to the web site corresponding to the link address from the terminal 100 .

In addition, when the XML data of the collected web site is included in the white list including a plurality of other XML data pre-stored in the server 200 as a result of the determination (or the verification result), the server 200 ) determines that the website corresponding to the link address to be accessed from the terminal 100 is not a harmful site, and mediates (or management/execution).

In addition, the XML data of the collected web site is included in the white list including a plurality of other XML data stored in the server 200 in advance, and the web site address related to the other XML data included in the white list (or URL) and the web site address related to the XML data of the collected web site are different, the server 200 determines that the web site related to the XML data impersonates the original web site (or a phishing site/harmful site) ), block access to the website corresponding to the link address from the terminal 100, and the website to be accessed from the terminal 100 (or the website corresponding to the link address) Guide information indicating that the site is harmful is transmitted to the terminal 100 . At this time, the server 200 includes a plurality of XML data and website addresses (or link addresses) of courier companies, public institutions, and famous web and app services (eg, *.samsung.com/*, *.cj.com/ *, etc.) can be managed in the form of the above white list.

For example, in recent years, text messages impersonating a courier company are increasingly being sent, and the terminal 100 is induced to access a website of the same type as the courier company through a text message, and the terminal 100 from the accessed website ), the damage of collecting personal information (eg, name, phone number, etc.) according to user input is increasing.

Therefore, the server 200 according to the embodiment of the present invention not only compares information included in the whitelist and information (eg, XML data) collected from a web site to be accessed by the terminal 100, but also It is possible to additionally check whether the web site to be accessed by the terminal 100 is the original site.

In addition, the server 200 is based on the harmful site information identified as a harmful site in relation to the screen of the web site corresponding to the obtained link information, XML data related to the web site corresponding to the collected link information, and the like. to perform machine learning, and generate corresponding information according to the corresponding link information based on the machine learning result. Here, the corresponding information (or corresponding information according to the corresponding link information) includes information indicating whether a website related to the corresponding link information is a harmful site, harmful information in the case of a harmful site, a degree of risk (or risk level), and the like.

That is, the server 200 uses a screen of a web site corresponding to the obtained link information, XML data related to a web site corresponding to the collected link information, etc. as an input value of a preset harmful site determination model. It performs machine learning (or artificial intelligence/deep learning) and generates corresponding information according to the link information based on the machine learning result (or artificial intelligence result/deep learning result).

In addition, the server 200 manages access (eg, blocking access, maintaining a connection, etc.) from the terminal 100 to a website corresponding to the link information based on the generated corresponding information.

In this way, when the terminal attempts to access a specific site, a screen of the specific site is obtained based on information about the specific site obtained from the terminal, and a previously obtained specific site from among a plurality of screens included in the pre-stored blacklist is obtained. When a screen of a site is included, access to a specific site from the corresponding terminal may be blocked.

In addition, when the terminal attempts to access a specific site as described above, XML data related to the specific site is collected based on the information on the specific site obtained from the terminal, and a plurality of XML data included in the pre-stored blacklist is collected. Among them, if the previously obtained XML data related to a specific site is included, access to the specific site from the corresponding terminal may be blocked.

Hereinafter, a method for blocking harmful sites according to the present invention will be described in detail with reference to FIGS. 1 to 4 .

2 is a flowchart illustrating a method for blocking harmful sites according to the first embodiment of the present invention.

First, when the corresponding link information is selected from among contents (eg, including text, images, etc.) including link information (or URL information/website address) displayed on the terminal 100, the terminal 100 is the The selected link information and identification information of the terminal 100 are transmitted to the server 200 . Here, the identification information of the terminal 100 includes MDN, mobile IP, mobile MAC, Sim (subscriber identification module) card unique information, serial number, and the like.

That is, when the corresponding link information is selected from among the contents (eg, including text, image, etc.) including link information displayed on the terminal 100, the terminal 100 is displayed on the website corresponding to the corresponding link information. In order to access, the corresponding link information (or content including the corresponding link information), identification information of the terminal 100, and the like are transmitted to the server 200 . At this time, the terminal 100 transmits the link information, identification information of the terminal 100, etc. through the dedicated app running in the background state while the dedicated app provided from the server 200 is running in the background state. It can be transmitted to the server 200 .

For example, as shown in FIG. 3 , when the first link information (eg, https://test.kr/123AbCde) in the form of a shortened URL is selected from among the first contents displayed on the first terminal 100 . , the first terminal transmits the selected first link information, identification information of the first terminal, and the like to the server 200 (S210).

Thereafter, the server 200 receives link information transmitted from the terminal 100 , identification information of the terminal 100 , and the like.

Also, the server 200 accesses a web site corresponding to the received link information, and acquires (or captures) a screen of the web site. Here, the screen of the website is an initial screen of the website, one or more screens corresponding to one or more sub-link information linked from the initial screen, etc., and includes a color and one or more objects (for example, text , including images, etc.) and the like.

For example, the server 200 receives first link information (eg, https://test.kr/123AbCde) transmitted from the first terminal, identification information of the first terminal, and the like.

Also, the server 200 accesses a first website corresponding to the first link information according to the received first link information, and acquires a first screen of the first website (S220).

Thereafter, the server 200 determines (or confirms) whether a screen of the obtained (or captured) web site is included in the blacklist including a plurality of harmful screens previously stored in the server 200 . Here, the plurality of harmful screens included in the blacklist include screens collected from harmful sites such as obscenity, defamation, fear or anxiety, hacking, speculative, illegal trade, anti-government, terrorism, and crime.

At this time, the server 200 calculates a plurality of similarities between the plurality of harmful screens included in the blacklist and the obtained website screen, respectively, and a preset reference value (for example, 90%) among the plurality of calculated similarities. ) or more (or at least one harmful screen corresponding to the at least one similarity among the plurality of harmful screens) may be determined.

Here, the server 200 performs an analysis function on the obtained screen of the website, the color in the screen of the website, the position or size of one or more objects (including, for example, text, image, etc.), the character Check the text in the screen of the website through the recognition function, and the identified color in the screen of the corresponding website, the position or size of one or more objects, and the color in the plurality of harmful screens in which the text is included in the blacklist , it is also possible to determine whether the position or size of one or more objects, text, and the like are similar.

For example, the server 200 calculates the first to 100,000 similarities between the first to 100,000 harmful screens stored in advance in the server 200 and the obtained first screen, respectively, and the calculated second It is determined whether there is at least one harmful screen corresponding to a similarity greater than or equal to a preset reference value (eg, 90%) among the first to 100,000th similarities ( S230 ).

When the screen of the obtained website is included in the blacklist including a plurality of harmful screens pre-stored in the server 200 as a result of the determination (or the check result), the server 200 is the terminal In step 100 , guide information indicating that the website to be accessed is a harmful site is transmitted to the terminal 100 .

That is, in the determination result (or the confirmation result), when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) exists among the plurality of calculated similarities, the server 200 controls the terminal 100 determines that the website corresponding to the link address to be accessed is a harmful site, blocks access to the website corresponding to the link address from the terminal 100, and wants to access from the terminal 100 guide information indicating that a web site (or a web site corresponding to the link address) is a harmful site is transmitted to the terminal 100 .

For example, when there is an 888th degree of similarity greater than or equal to the preset reference value (for example, 90%) from among the calculated first to 100000 similarities, the server 200 sends a first website ( Block the first terminal's access to (eg, a hacking site) and indicate that the first website corresponding to the first link information to be accessed by the first terminal is a harmful site (eg, a hacking site) The notification information is transmitted to the first terminal (S240).

Thereafter, the terminal 100 receives guide information indicating that the website to be accessed from the terminal 100 is a harmful site, transmitted from the server 200 in response to the previously transmitted link information, and the like, and the received The terminal 100 displays (or outputs) guide information indicating that the web site to be accessed is a harmful site.

In addition, the terminal 100 ends the access process to the website corresponding to the link information. At this time, the terminal 100 permanently deletes the content including the link information from the terminal 100 (or spam processing), and information (eg, a phone call) of another terminal (not shown) that provided the content. You can also spam (or blindly process numbers, email addresses, messenger account information, etc.).

For example, the first terminal receives the first notification information transmitted from the server 200 in response to the previously transmitted first link information, and displays the received first notification information.

In addition, the first terminal ends the access process to the first website corresponding to the first link information, and deletes the first content displayed on the first terminal (S250).

In addition, when the obtained web site screen is not included in the blacklist including a plurality of harmful screens pre-stored in the server 200 as a result of the determination (or the check result), the server 200 performs a connection (or connection) function between the terminal 100 and a website corresponding to the link information to be accessed by the terminal 100 . In this case, the server 200 may apply a redirecting function to the terminal 100 and the web site.

That is, when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) does not exist among the plurality of calculated similarities in the determination result (or the confirmation result), the server 200 controls the terminal 100 ) determines that the web site corresponding to the link address to be accessed is not a harmful site, and mediates (or manages/performs) access to the web site corresponding to the link address from the terminal 100 .

For example, when there is no similarity greater than or equal to the preset reference value (for example, 90%) among the calculated first to 100,000 similarities, the server 200 configures the first web corresponding to the first link information. The access of the first terminal to the site is managed (S260).

4 is a flowchart illustrating a method for blocking harmful sites according to a second embodiment of the present invention.

First, when the corresponding link information is selected from among contents (eg, including text, images, etc.) including link information (or URL information/website address) displayed on the terminal 100, the terminal 100 is the The selected link information and identification information of the terminal 100 are transmitted to the server 200 . Here, the identification information of the terminal 100 includes MDN, mobile IP, mobile MAC, Sim (subscriber identification module) card unique information, serial number, and the like.

That is, when the corresponding link information is selected from among the contents (eg, including text, image, etc.) including link information displayed on the terminal 100, the terminal 100 is displayed on the website corresponding to the corresponding link information. In order to access, the corresponding link information (or content including the corresponding link information), identification information of the terminal 100, and the like are transmitted to the server 200 . At this time, the terminal 100 transmits the link information, identification information of the terminal 100, etc. through the dedicated app running in the background state while the dedicated app provided from the server 200 is running in the background state. It can be transmitted to the server 200 .

For example, when second link information in the form of a shortened URL (eg, https://test.kr/987ZxCvB) is selected from among the second contents displayed on the second terminal 200 , the second terminal selects the selected The second link information, identification information of the second terminal, and the like are transmitted to the server 200 (S410).

Thereafter, the server 200 receives link information transmitted from the terminal 100 , identification information of the terminal 100 , and the like.

In addition, the server 200 accesses a web site corresponding to the received link information, and collects one or more XML data related to the web site. Here, the XML data (or XML metadata) includes a header, an IP address, and the like related to a corresponding web site. In this case, the server 200 may collect XML data related to the web site corresponding to the link information by using a preset browser API (or XML data collection API).

For example, the server 200 receives second link information (eg, https://test.kr/987ZxCvB) transmitted from the second terminal, identification information of the second terminal, and the like.

Also, the server 200 accesses a second website corresponding to the second link information according to the received second link information, and collects second XML data related to the second website (S420). .

Thereafter, the server 200 determines (or checks) whether XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in advance in the server 200 . Here, the plurality of harmful XML data included in the blacklist includes XML data collected from harmful sites such as obscenity, defamation, fear or anxiety, hacking, speculative, illegal trade, anti-government, terrorism, and crime.

In this case, the server 200 calculates a plurality of similarities between the plurality of harmful XML data included in the blacklist and the XML data related to the collected web site, respectively, and sets other preset reference values ( For example, it may be determined whether one or more similarities (or one or more harmful XML data corresponding to the one or more similarities among the plurality of harmful XML data) exist.

Here, the server 200 performs an analysis function on the XML data related to the collected web site, and checks one or more components (including, for example, a header, an IP address, etc.) included in the XML data, It may be determined whether the at least one identified component is similar to a plurality of harmful XML data included in the blacklist.

For example, the server 200 calculates first to 250000 similarities between the first to 250000 harmful XML data stored in advance in the server 200 and the collected second XML data, respectively, and It is determined whether there is at least one harmful XML data corresponding to a degree of similarity greater than or equal to another preset reference value (eg, 90%) among the calculated first to 250000 similarities ( S430 ).

When the determination result (or the confirmation result) indicates that XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data previously stored in the server 200, the server 200 transmits to the terminal 100 guide information indicating that the website to be accessed by the terminal 100 is a harmful site.

That is, in the determination result (or the confirmation result), when at least one degree of similarity greater than or equal to the preset reference value (for example, 90%) exists among the plurality of calculated similarities, the server 200 controls the terminal 100 determines that the website corresponding to the link address to be accessed is a harmful site, blocks access to the website corresponding to the link address from the terminal 100, and wants to access from the terminal 100 guide information indicating that a web site (or a web site corresponding to the link address) is a harmful site is transmitted to the terminal 100 .

For example, when there is an 8520th degree of similarity greater than or equal to the preset reference value (for example, 90%) among the calculated first to 250000 similarities, the server 200 sends a second website ( Block the second terminal's access to (for example, an obscene site), and a second indicating that the second website corresponding to the second link information to be accessed by the second terminal is a harmful site (for example, an obscene site) The notification information is transmitted to the second terminal (S440).

Thereafter, the terminal 100 receives guide information indicating that the website to be accessed from the terminal 100 is a harmful site, transmitted from the server 200 in response to the previously transmitted link information, and the like, and the received The terminal 100 displays (or outputs) guide information indicating that the web site to be accessed is a harmful site.

In addition, the terminal 100 ends the access process to the website corresponding to the link information. In this case, the terminal 100 permanently deletes the content including the link information (or spam processing) in the terminal 100, and information (eg, a phone call) of another terminal (not shown) that provided the content. You can also spam (or blindly process numbers, email addresses, messenger account information, etc.).

For example, the second terminal receives the second notification information transmitted from the server 200 in response to the previously transmitted second link information, and displays the received second notification information.

In addition, the second terminal terminates the access process to the second website corresponding to the second link information, and deletes the second content displayed on the second terminal (S450).

In addition, when the determination result (or the confirmation result), the XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data pre-stored in the server 200 , the server 200 performs a function of accessing (or connecting) between the terminal 100 and a website corresponding to link information to be accessed by the terminal 100 . In this case, the server 200 may apply a redirecting function to the terminal 100 and the web site.

That is, when at least one similarity greater than or equal to the preset reference value (for example, 90%) does not exist among the plurality of calculated similarities in the determination result (or the confirmation result), the server 200 controls the terminal 100 ) determines that the web site corresponding to the link address to be accessed is not a harmful site, and mediates (or manages/performs) access to the web site corresponding to the link address from the terminal 100 .

For example, when there is no similarity greater than or equal to the preset reference value (for example, 90%) among the calculated first to 250000 similarities, the server 200 configures the second web corresponding to the second link information. The connection of the second terminal to the site is managed (S460).

As described above, in the embodiment of the present invention, when a terminal attempts to access a specific site, a screen of the specific site is obtained based on information about the specific site obtained from the terminal, and is included in a pre-stored blacklist. When a screen of a specific site obtained previously is included among the plurality of screens that have been obtained, access to the specific site from the corresponding terminal is blocked, thereby preventing leakage of user's personal information.

In addition, as described above, in an embodiment of the present invention, when a terminal attempts to access a specific site, XML data related to the specific site is collected based on information about the specific site obtained from the terminal, and stored in advance When XML data related to a specific site obtained earlier is included among a plurality of XML data included in the blacklist, access to the specific site from the corresponding terminal is blocked, thereby preventing the user from being exposed to risk information.

Those of ordinary skill in the art to which the present invention pertains may modify and modify the above-described contents without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

10: harmful site blocking system 100: terminal
200: server

Claims (10)

a terminal for transmitting the selected link information when the link information included in the content is selected; and
Accessing a website corresponding to the link information transmitted from the terminal, acquiring a screen of the website, and whether the acquired screen of the website is included in the blacklist including a plurality of harmful screens stored in advance in the server and, as a result of the determination, when the screen of the obtained website is not included in the blacklist including a plurality of harmful screens stored in advance in the server, the terminal and the link information to be accessed from the terminal and the server performing a connection function between corresponding websites,
The server is
A plurality of harmful substances including the obtained color in the screen of the website and the location or size of one or more objects, the color in the screen of the identified website, and the location or size of one or more objects included in the blacklist Determines whether the color in the screen is similar to the position or size of one or more objects,
As a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens stored in advance in the server, the server provides the link address corresponding to the link address to be accessed from the terminal. It is determined that the website is a harmful site, and the terminal blocks access to the website corresponding to the link address, and transmits guide information indicating that the website to be accessed from the terminal is a harmful site to the terminal, ,
The terminal is
Displaying guide information transmitted from the server, permanently deleting content including the link information, and spamming information of other terminals that provided the content. delete accessing, by a server, a web site corresponding to the link information transmitted from the terminal to obtain a screen of the web site;
determining, by the server, whether a screen of the obtained website is included in a blacklist including a plurality of harmful screens previously stored in the server;
As a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens stored in advance in the server, the server provides the link address corresponding to the link address to be accessed from the terminal. It is determined that the website is a harmful site, blocks access to the website corresponding to the link address from the terminal, and transmits guide information indicating that the website to be accessed from the terminal is a harmful site to the terminal step; and
Displaying, by the terminal, guide information transmitted from the server,
The step of determining whether a screen of the obtained website is included in the blacklist comprises:
a process of confirming a color in the screen of the obtained website and a location or size of one or more objects; and
a process of determining whether the color in the screen of the identified website and the location or size of one or more objects are similar to the color in a plurality of harmful screens included in the blacklist and the location or size of one or more objects and
The terminal is
The method for blocking harmful sites, characterized in that displaying the guide information, permanently deleting the content including the link information, and spamming information of other terminals that provided the content. 4. The method of claim 3,
The step of determining whether a screen of the obtained website is included in the blacklist comprises:
calculating a plurality of similarities between the plurality of harmful screens included in the blacklist and the obtained website screens, respectively; and
and determining whether one or more similarities greater than or equal to a preset reference value exist among the plurality of calculated similarities. delete 4. The method of claim 3,
As a result of the determination, when the obtained web site screen is not included in the blacklist including a plurality of harmful screens stored in the server in advance, the server provides link information to be accessed from the terminal and the terminal. Harmful site blocking method, characterized in that it further comprises the step of performing a connection function between the corresponding web sites. a terminal for transmitting the selected link information when the link information included in the content is selected; and
Accessing a website corresponding to the link information transmitted from the terminal, collecting XML data related to the website, and XML related to the collected website from a blacklist including a plurality of harmful XML data stored in advance in a server It is determined whether data is included, and as a result of the determination, when XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in advance in the server, the terminal wants to access Guidance indicating that the website corresponding to the link address is a harmful site, blocking access to the website corresponding to the link address from the terminal, and indicating that the website to be accessed from the terminal is a harmful site Including the server for transmitting information to the terminal,
The server is
determining whether the link address is a harmful site by comparing the header and IP address included in the collected XML data with the header and IP address included in the blacklist;
The terminal is
Displaying guide information transmitted from the server, permanently deleting content including the link information, and spamming information of other terminals that provided the content. accessing, by a server, a web site corresponding to link information transmitted from a terminal, and collecting XML data related to the web site;
determining, by the server, whether XML data related to the collected web site is included in a blacklist including a plurality of harmful XML data stored in the server in advance;
As a result of the determination, when the XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data stored in the server in advance, the server attempts to access the terminal and the terminal performing a connection function between web sites corresponding to the link information;
As a result of the determination, when the XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data stored in the server in advance, the link address to be accessed from the terminal by the server It is determined that the web site corresponding to the is a harmful site, the terminal blocks access to the web site corresponding to the link address, and provides guide information indicating that the web site to be accessed from the terminal is a harmful site to the terminal sending to; and
Displaying, by the terminal, guide information transmitted from the server,
The server is
determining whether the link address is a harmful site by comparing the header and IP address included in the collected XML data with the header and IP address included in the blacklist;
The terminal is
A method for blocking harmful sites comprising displaying guide information transmitted from the server, permanently deleting content including the link information, and spamming information of other terminals that provided the content. 9. The method of claim 8,
The step of determining whether XML data related to the collected web site is included in the blacklist comprises:
checking one or more components included in the XML data related to the collected web site; and
and determining whether the at least one identified component is similar to a plurality of harmful XML data included in the blacklist. delete

Images