KR20230036288A - System for blocking harmful program of smart device phones based on artificial intelligence - Google Patents

Abstract

According to the present invention, a harm blocking system for a smart device through hash similarity analysis based on artificial intelligence allows all communication packets transmitted to and received from a smart device of an under-age ward to pass through a harm blocking device including a virtual network device part by installing the harm blocking device in a kernel area of the smart device to analyze and extract packet data transmitted in real time to determine whether the packet data are harmful, thereby blocking execution or connection to a harmful site or a harmful application, monitoring transmission and reception of harmful texts or preventing game addiction, and notifying a guardian. Also, the present invention has the effect of blocking various paths by determining similar hash values based on artificial intelligence and allowing the guardian to perform monitoring in real time.

Description

Harmful blocking method of smart devices through artificial intelligence-based hash similarity analysis and system performing the same

The present invention relates to a harmful smart device blocking system, and relates to a smart device harmful blocking system that can fundamentally block access to harmful sites and execution of harmful applications based on artificial intelligence.

Recently, due to the rapid and widespread spread of smart devices, smart devices have become a necessity not only for adults but also for teenagers and children (hereinafter referred to as 'minors'). Because smart devices can easily access the Internet, minors are exposed defenselessly to harmful sites and applications, and can also easily access pornography (videos or pictures) through these harmful sites and applications, causing serious problems. do.

Conventionally, there have been many technologies for blocking harmful substances in computers mainly used by minors, but recently, technologies for blocking harmful substances in mobile communication terminals including smart devices have been introduced.

However, these conventional technologies have introduced only one method, such as a method of blocking access to harmful sites, a method of accessing harmful materials, a method of blocking access to or execution of harmful applications, and a method of blocking the reception of harmful content such as pornography. In this situation, a technology for blocking access to harmful substances in an integrated manner is required.

In addition, it is easy to block access to or execution of harmful sites or applications in real time, but it is practically difficult to block harmful content in real time, and countermeasures are required.

Furthermore, existing methods of extracting the hash value of a file to be checked for harmfulness have a problem in that they cannot cope with the problem that the hash value changes due to a change in a part of the file.

Republic of Korea Patent Publication No. KR 2021-0053844 A (2021.05.12. Publication)

The present invention has been devised in view of the above, and an object of the present invention is to provide a smart device harmful blocking system that allows minors to quickly and fundamentally block various paths through which they can access harmful substances with smart devices.

In addition, an object of the present invention is to provide a method capable of responding to a change in a hash value by predicting it based on artificial intelligence.

A smart device harmful blocking system according to the present invention for achieving the above object is connected to a guardian smart device, a warded smart device including a harmful blocking device installed in the kernel area, and the guardian smart device and the warded smart device through a communication network. It includes a harmful blocking server that becomes

The harmful blocking device of the warded smart device includes a communication unit for performing communication;

a virtual network device unit for passing all communication packets transmitted and received through the communication unit and sending them to an extraction unit; Among the video, image, and audio files in the ward's smart device, the area of the file to be monitored is determined, the target file to be extracted is transmitted to the first extraction unit through the command unit, and the file to be monitored extracted from the first extraction unit is received. A harmful confirmation target file that needs to be verified is determined and transmitted to the first extraction unit through the command unit. In addition, by using the packet data extracted from the second extraction unit, a monitoring target packet that needs to be checked for harmfulness is determined and returned to the second extraction unit. Process unit to deliver to the extraction unit; And, after extracting a file to be monitored from among the files transmitted through the command unit and passing it to the process unit, receiving a harmful confirmation target file among the files to be monitored from the process unit and extracting a hash value of the harmful confirmation target file The first extraction unit, which is sent to the harmful blocking server through the communication unit, checks the header and contents of the packet data coming into the virtual network device unit, extracts them, transfers them to the process unit, and then sends the packet data to be monitored from the process unit. and an extraction unit including a second extraction unit to extract the hash value of the packet data to be monitored and send it to the harmful blocking server through the communication unit.

The harmful blocking server compares the hash value of the harmful confirmation target file transmitted through the first extraction unit with the hash value of the harmful file list stored in the database server to check whether the harmful confirmation target file is harmful, and a harmful inspection server comparing the hash value of the packet data to be monitored received through the second extractor with a hash value of a list of harmful packet data stored in the database server to check whether the packet data to be monitored is harmful; And, notification and reporting for notifying the process unit of the inspection result by the harmful inspection server through the communication unit of the harmful blocking device, and also creating a report to the guardian terminal when it is determined that the harmful file or packet data is notified. server; includes.

The processing unit, when the file to be checked for harmfulness is determined to be harmful from the harmfulness inspection server, deletes the corresponding file or removes the read function, and also determines that the packet to be monitored is harmful packet data from the harmfulness inspection server. If so, the corresponding packet is blocked or monitored.

According to the present invention, a harmful blocking device including a virtual network unit is installed in the kernel area of a smart device so that all communication packets transmitted and received to and from the smart device are passed through and analyzed to rapidly analyze and extract data transmitted in real time to harmful sites. , it can determine whether it is a harmful application or a harmful message, block it, and monitor it. In addition, in the case of harmful content such as pornography, which is difficult to determine in real time, it is possible to scan and search the harmful content possessed in the smart device in real time to determine whether or not it is harmful, and to block or delete it. In addition, by extracting the hash value of the file data or packet data and comparing it with the hash value list of harmful substances stored in the database server, it is possible to quickly determine whether it is harmful or not.

Furthermore, in the case of a partial change in the hash value, a similarity with the existing hash values is analyzed through a neural network and reported together to enable a more accurate determination.

After all, according to the present invention, it is possible to fundamentally and quickly block various paths through which minors can access harmful substances with smart devices, and there is an effect that guardians can monitor in real time.

1 is a block diagram of a smart device harmful blocking system according to an embodiment of the present invention;
Figure 2a is a block configuration diagram of the harmful blocking device of Figure 1;
Figure 2b is a neural network internal configuration diagram of the extraction unit according to Figure 2a;
3 is a flowchart for explaining an operation of blocking pornography in a smart device of a smart device harmful blocking system according to an embodiment of the present invention;
4 is a flowchart for explaining an operation of blocking access to harmful sites of a smart device harmful blocking system according to an embodiment of the present invention;
5 is a flowchart for explaining an operation of blocking smishing characters of a smart device harmful blocking system according to an embodiment of the present invention;
6 is a flowchart for explaining a harmful word monitoring operation of a messenger of a smart device harmful blocking system according to an embodiment of the present invention;
7 is a flowchart illustrating a blocking operation of a harmful application of a smart device harmful blocking system according to an embodiment of the present invention.

The above objects, features and other advantages of the present invention will become more apparent by describing preferred embodiments of the present invention in detail with reference to the accompanying drawings. Hereinafter, a smart device harmful blocking system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Referring to Figure 1, the smart device harmful blocking system according to an embodiment of the present invention includes a warded smart device 110, a guardian smart device 110 and a harmful blocking server 130.

The warded smart device 110 corresponds to a smart device possessed by a warded child such as a child or youth subject to management, and the guardian smart device 110 is a smart device owned by a parent, a guardian, etc. to manage the warded person. applies to Here, the smart device used in the present invention refers to an intelligent terminal to which computer support functions such as Internet communication and information search are added to a mobile phone, and includes a smart pad (tablet PC) having a mobile phone function in addition to a normal smart device. can be interpreted as a concept. However, in the case of a general PC (Personal Computer), IP TV (Internet Protocol Television), notebook-sized personal computer, etc. without a mobile phone function, it can be interpreted as not corresponding to a smart device.

The harmful blocking server 130 is connected to the guardian smart device 110 and the warded smart device 110 through the communication network 140, authentication and management of harmful blocking service, storage and management of various information, and warded smart device 110 ) In the case of detecting harmful substances or accessing harmful sites, it serves to notify the guardian smart device 110. Specifically, the harmful blocking server 130 is the authentication and management server 132, harmful inspection server 134 , notification and reporting server 136 and database server 138.

The authentication and management server 132 sends a management request for the warded smart device 110 registered by matching with the guardian smart device 110 in advance according to access through the communication network 140 of the guardian smart device 110. Receive. In addition, the authentication and management server 132 performs authentication on the warded smart device 110 via the communication network ( ). Authentication can be performed by authentication methods such as OTP, public certificate, terminal number, SMS, etc., which are normal authentication methods, for the purpose of eliminating indiscriminate hacking of the ward's terminal () and interference with inappropriate users. Information on various authentication and management performed by the authentication and management server 132 is stored in the database server 138 .

The database server 138 is a data server in which various types of information are stored and managed, and the database is updated in real time or randomly. On the other hand, the database server 138 stores file information about various pornography subject to blocking, information about harmful sites, information about harmful applications, and information about harmful characters.

According to a preferred embodiment of the present invention, various pornography files, harmful sites, harmful applications, and harmful messages (characters including language such as profanity, obscene language, and bullying) stored in the database server 138 may be hash values. A hash value is a value derived by a hash function for certain data and may be used as information for identifying data. Accordingly, the database server 138 stores hash values of pornography files, hash values of harmful sites, hash values of harmful text contents, hash values of registration information of harmful applications, and the like.

The harmfulness inspection server 134 receives a hash value among information transmitted from the warded smart device 110 through the communication network 140 and compares it with the hash value of the harmful information stored in the database server 138 to determine if it is harmful or not. is confirmed, and the result thereof is transmitted to the warded smart device 110 and stored in the database server 138.

The notification and reporting server 136 notifies the guardian smart device 110 when it is determined to be harmful by the harmful inspection server 134, transmits a report therefor, and stores the result in the database server 138. do.

As a method of reporting, it is transmitted as SMS or MMS to the guardian smart device 110, or a separate application can be installed in the guardian terminal, so that the report can be made to this application. The guardian smart device 110 can check the state of the ward terminal through this, and can also change the setting state.

Referring to FIG. 2A, the harmful blocking device 200 is installed in the warded smart device 110. According to a preferred embodiment of the present invention, the harmful blocking device 200 is installed in the kernel area of the smart device and operates.

In general smart devices, various hardware (eg mobile communication module, CPU, memory, display, keypad, GPS receiving module) is mounted on the lowest layer, OS (Operating system) is mounted on the middle layer, the operating system layer, and the highest The application layer, which is a layer, is loaded with various applications that are driven based on the OS. The OS is a smart device kernel that generally performs terminal resource allocation and process control for various hardware and various software mounted on the smart device, and an application that is driven based on itself (OS) for access to the smart device kernel. It consists of various smart device application programming interfaces (APIs) provided to, and the harmful blocking device 200 is installed in the smart device kernel.

The harmful blocking device 200 performs a function of controlling a communication unit 210 that performs a communication-related function, a virtual device unit 220 that performs a proxy or VPN function, and each component of the harmful blocking device 200. A process unit 230 that performs a function, a command unit 240 that performs a function of executing a command as a result of processing by the process unit 230, and a file detection and extracting data such as contents and hash values of packet data. It includes an extraction unit 250 that performs a function.

The process unit 230 determines the area of the file to be monitored among the video, image, and audio files in the ward's smart device and delivers the target file to be extracted to the first extraction unit 252 through the command unit 240, 1 The file to be monitored extracted from the extraction unit 252 is received, and a harmful confirmation target file that needs to be checked for harmfulness is determined and transmitted to the first extraction unit 252 through the command unit 240.

In addition, the process unit 230 uses the packet data extracted from the second extraction unit 254 to organize them into a list, determines packets to be monitored that need to be checked for harmfulness, and sends them back to the second extraction unit 254. will be conveyed Here, the packet to be monitored is to check whether the packet corresponds to a site URL, streaming data information, message information, or the like.

Further, the processing unit 230 deletes the corresponding file or removes the read function when the harmful confirmation target file is determined to be harmful from the harmful inspection server 134 . In addition, the processing unit 230 blocks or reports the packet when the packet to be monitored is determined to be a harmful packet (including harmful site, harmful application access, and harmful message contents) from the harmful inspection server 134 .

The extraction unit 250 includes a first extraction unit 252 for detecting files and extracting hash values of files, and a second extraction unit 254 for extracting related information and hash values of packet data. In this way, according to an embodiment of the present invention, file and packet data are detected, their hash values are extracted, and whether they are harmful is determined by comparing them with the hash values of the grounds for harmful determination stored in the database, thereby real-time and quickly It has the advantage of being able to determine whether it is harmful or not.

In the past, since it is a video, information such as a specific video or image of the image file itself is identified and compared to determine whether it is harmful or not, or information on the title, genre, and supplier of the video or image is identified and compared to determine whether it is harmful or not. However, in this case, there are problems in that the judgment takes a long time or the judgment result is inaccurate.

The first extraction unit 252 extracts a file to be monitored from among video, image, and audio files delivered from the processing unit 230 through the command unit 240 and transfers the file to the processing unit 230 . In addition, a harmful confirmation target file among the monitoring target files is received from the process unit 230, and a hash value of the harmful confirmation target file is extracted and sent to the harmful blocking server 130 through the communication unit 210.

The second extraction unit 254 extracts packet data coming into the virtual network device unit 220 and extracts necessary data (eg website access information, text message information, application execution information, etc.) After delivery to the processing unit 230, packet data to be monitored is received from the processing unit 230, and a hash value of the packet data to be monitored is extracted and sent to the harmful blocking server 130 through the communication unit.

Packet data is divided into header and data areas. The header of the packet contains information about the sending/receiving IP information value and the transmission method. If this is analyzed, it is possible to check what kind of IP the smart device is sending and receiving. Therefore, the extraction unit (second extraction unit) analyzes this and extracts the hash value after confirming whether the transmission method is a web page, stream data, or text message.

On the other hand, in the case of a smart device, there are two built-in antennas, that is, an antenna for Wi-Fi and an antenna for checking 3G and 4G, and calls or text messages are transmitted and received there. At this time, the data of the text message is checked. On the other hand, in order to check the contents of a message, it is possible to check the data only by looking at the data. In the case of accessing a website, it is possible to analyze only the header to check information about where it came from (what IP it is accessed from), but to check the contents, it is necessary to analyze the data. .

Furthermore, referring to FIG. 2B, the harmful blocking device 200 is installed in the warded smart device 110. According to a preferred embodiment of the present invention, the harmful blocking device 200 is installed in the kernel area of the smart device based on artificial intelligence. and it works

For example, in this embodiment, the first extraction unit primarily determines the degree of similarity with the hash value determined as existing harmful information using the extracted hash value, and it is also possible to send it to the harmful blocking server 130 together. .

To this end, the first extractor may include a neural network for determining similarities between different hash values.

Specifically, the neural network may be configured to determine the similarity between hash values of different extracted parts of files having the same execution result. That is, the internal neural network is trained in a direction in which the loss between the first hash value and the second hash value string, which are partially different, is reduced, and the learned neural network determines the similarity of the hash value itself.

This configuration may also be applied to the hash of the data packet of the second extractor.

Hereinafter, specific operations of the smart device harmful blocking system according to an embodiment of the present invention having the above configuration will be described.

First, with reference to FIG. 3, an operation of blocking the execution of harmful content such as pornography by searching video, image, and audio files stored in a ward's smart device in real time will be described.

Unlike a computer, a storage path of a file is determined in a smart device, and the process unit 230 of the harmful blocking device 200 monitors such a storage path in real time.

When the real-time monitoring mode is executed (S301), first, data held in the current warded smart device 110 is checked and the latest version information is checked. If it is not the latest version, the process unit 230 updates the comparison data (S302). It checks the current network status to check whether it is a Wifi mode or a carrier mode (3G, 4G, etc.), and compares the data only in the Wifi mode. It is desirable to update.

When the comparison data is updated, the process unit 230 stores it in the database server 138 of the harmful blocking server 130 through the communication unit 210, leaving a log of when the latest update was performed, and the guardian smart device ( 110) to enable confirmation.

When the real-time monitoring mode (S301) is executed, the process unit 230 commands the command unit 240 to scan. At this time, all video, image, and voice data files are scanned based on registered applications as monitoring target files. will do The command unit 240 passes the file to be monitored to the extraction unit 250 (first extraction unit), and the extraction unit 250 extracts the file to be monitored (S303). The extraction unit 250 extracts each installed application path, and if there is video, image, or audio data of the corresponding path, it extracts it as a hash value of data that can be compared.

The process unit 230 makes a list of files to be monitored extracted from the extraction unit (S304) and compares and reviews them with the previously created list (S305). Here, the process unit 230 makes a list of the initially scanned contents, and when adding the list of objects to be monitored thereafter, compares them with the previous list and extracts only the changed contents, so that the added contents during the real-time monitoring operation If there is, update it and check it.

If it matches the previous list, the process unit 230 creates a real-time monitoring mode schedule to proceed next (S306), and sets a comparison list and time for the next operation.

If the previous list does not match, the processing unit 230 checks the addition and deletion information (S307). If all of the lists are the same and only deleted, a real-time monitoring mode schedule to proceed next is created (S306).

On the other hand, when there is content added from the list, the process unit 230 transfers the information of the file to the extraction unit 250 through the command unit 240, and the extraction unit 250 (first extraction unit) that receives the information ) extracts the hash value of the file and delivers the extracted hash value to the harmful blocking server 130 through the communication unit 210 (S308).

At this time, the processing of the process unit 230 is different according to the attribute of the file. That is, for a video, image, or audio file, the hash value of a simple file is extracted, but in the case of a compressed file, the processing unit 230 extracts the hash value of each file by decompressing the compressed file.

The harmful inspection server 134 of the harmful blocking server 130 that has received the hash value through the extraction unit 250 transmits the extracted hash value and the hash value of the pornographic file stored in the database server 138 or obscene content. It compares and searches for hash values of files that have not been checked and determines whether or not they are harmful (S309).

The notification and reporting server 136 of the harmful blocking server 130 notifies the process unit 230 of the inspection result through the communication unit 210 of the harmful blocking device 200. If the file is determined to be harmful, the process unit ( 230) deletes the detected corresponding file or removes the read function so that the ward does not load the corresponding file (S310).

After that, the process unit 230 makes a list of processing results and transmits them to the harmful blocking server 130 through the communication unit 210 (S320).

The harmful blocking server 130 stores the received processing result list in the database server 138, and the notification and reporting server 136 creates a report on the processing result list. The result is transmitted to the guardian smart device 110 so that the guardian can check (S330).

Hereinafter, with reference to FIGS. 4 to 7 , operations such as blocking access to harmful sites, blocking execution of harmful applications, monitoring harmful messages, etc. of the smart device harmful blocking system according to an embodiment of the present invention will be described.

Since all communication packets pass through the virtual network device unit 220 by the virtual network device unit 220 of the harmful blocking device 200, it is possible to monitor data connected to a communication network including the Internet in real time. By analyzing and extracting data, it is possible to know whether a website is accessed, an application is executed, or a text message is sent or received.

Referring to FIG. 4 , an operation of blocking access to harmful sites (applications) by a warded smart device will be described.

When the monitoring mode is executed (S401), the virtual network device unit 220 transfers incoming packet data to the extraction unit 250 (second extraction unit), and the extraction unit 250 transmits the header of the transmitted packet data. (Header) value is checked to extract data on website access (S402). Since the header value of the packet contains transmission/reception IP information value and information on the transmission method, it is possible to check which content is being exchanged by which IP in the smart device by analyzing it. Therefore, according to the present invention, it is possible to determine whether a transmission method is a web page, stream data, or text message by analyzing the header value of the packet.

The processing unit 230 creates a list of access times, sites, and brief contents using the extracted data (S403). The processing unit 230 checks whether or not the packet is a target packet based on the created list (S404). Here, the monitoring target packet means a site URL information, streaming data information, and message information.

In the case of a packet to be monitored, that is, if it corresponds to site URL information, the process unit 230 transfers the corresponding data to the extraction unit 250 through the command unit 240, and the extraction unit 250 receives the packet data A hash value of is extracted, and the extracted hash value is transmitted to the harmful blocking server 130 through the communication unit 210 (S405).

Upon receiving this, the harmful inspection server 134 of the harmful blocking server 130 transmits the extracted hash value and the hash value of the harmful site data stored in the database server 138 or the hash value of the non-harmful site data, etc. It is compared and searched to check whether or not it is a harmful site (S407).

The notification and reporting server 136 of the harmful blocking server 130 notifies the process unit 230 of the inspection result through the communication unit 210 of the harmful blocking device 200. If the site is determined to be harmful, the process unit ( 230) blocks access to the site by blocking the corresponding traffic (S408), and then calls a guide message so that the user (protected person) can know (S409), and upon completion, writes a log and transmits the created log to the communication unit 210. Through this, it is delivered to the harmful blocking server 130 (S410).

The harmful blocking server 130 stores the received processing result log in the database server 138, and the notification and reporting server 136 creates a report on the processing result list and transmits it to the guardian smart device 110 so that the guardian so that it can be confirmed (S412).

Next, with reference to FIG. 5, an operation of blocking smishing characters will be described.

When the monitoring mode is executed (S501), the virtual network device unit 220 transfers incoming packet data to the extraction unit 250 (second extraction unit), and the extraction unit 250 checks the transmitted packet data. In this way, data for packets related to SMS or MMS text (hereinafter referred to as 'SMS text') is extracted (S502).

Usually, in the case of a smart device, there are two built-in antennas, that is, an antenna for Wi-Fi and an antenna for checking 3G and 4G (LTE). Here, a phone call or text message ('SMS text') is transmitted and received, and at this time, the extraction unit checks the data of the text message. In the case of 3G and LTE, packet contents include, for example, the other party's contact information and message contents, such as 010-XXXX-XXXX / Ring (phone data) 010-XXXX-XXXX / SMS (message data). Here, it distinguishes whether it is a regular call or an SMS text message.

On the other hand, packet data is divided into header and data. As in the embodiment of FIG. 4, in the case of accessing a website, if you simply check the information from where it came from, you can analyze it by checking only the header, but you need to check the data to check the contents. .

The processing unit 230 creates a list of contents such as contacts, message contents, and images using the extracted data (S503). The processing unit 230 checks whether or not the packet is a target packet based on the created list (S504).

If the packet to be monitored corresponds to a text message, the process unit 230 normalizes the data (S505), classifies the contents, and checks whether or not it is registered as spam. That is, the process unit 230 normalizes the data. It is checked whether or not the URL is in the received data (S506).

Packets do not come in a row, but come in randomly and are received. Therefore, when sending certain data, there may be several packets instead of one. In order to extract the comparison target information, it is difficult to classify it into one packet, and even comparable data must be collected. Therefore, it is necessary to group and separate identical packets, which is called data normalization.

When the URL is confirmed, the process unit 230 transmits the corresponding data to the extraction unit 250 through the command unit 240, and the extraction unit 250 that receives this extracts the hash value of the URL data and extracts the extracted The hash value is transmitted to the harmful blocking server 130 through the communication unit 210 (S507).

Upon receiving this, the harmful inspection server 134 of the harmful blocking server 130 determines the extracted hash value and the hash value of the harmful URL (site) data stored in the database server 138 or the non-harmful site data. The hash value is compared and searched to determine whether it is harmful (S508).

The notification and reporting server 136 of the harmful blocking server 130 notifies the processing unit 230 of the inspection result through the communication unit 210 of the harmful blocking device 200, when the corresponding URL is determined to be a harmful site. The processing unit 230 processes the SMS text to be moved to a separate spam storage (S509). And the process unit 230 calls a guide phrase so that the user (protected person) can know about the content (S510).

Meanwhile, even if the corresponding URL is not confirmed as a harmful site, the process unit 230 calls a guide phrase to the user (protected person) to access the corresponding site upon consent (S510).

Referring to FIG. 6, an operation of monitoring harmful words in messenger text will be described.

When the monitoring mode is executed (S601), the virtual network device unit 220 transfers incoming packet data to the extractor 250, and the extractor 250 uses the messenger application (e.g., Kakao Talk) in the transmitted packets. , line, tweeter, telegram, etc.) data for text-related packets are extracted (S602).

The process unit 230 creates a list of content information such as contacts, message content, and images using the extracted data (S603). The processing unit 230 checks whether the packet is a target packet based on the created list (S604), and distinguishes whether the packet is a messenger text message.

In the case of a packet to be monitored, the processing unit 230 normalizes the data (S605) and separates the contents.

Here, messenger applications such as KakaoTalk and Line are sent from the main server of the messenger application, so there is no IP change. If the IP information in the header of the packet is identified as the messenger information, it is separately classified and the data is monitored.

The processing unit 230 transfers the corresponding data to the extraction unit 250 through the command unit 240, and the extraction unit 250 that receives the received extracts the hash value of the text data and converts the extracted hash value to the communication unit ( 210) to the harmful blocking server 130 (S606).

Upon receiving this, the harmful inspection server 134 of the harmful blocking server 130 transmits the extracted hash value and the harmful word (for example, a specific word such as obscenity or bullying) data stored in the database server 138. The hash value of is compared and searched to check whether it is harmful (S607).

The notification and reporting server 136 of the harmful blocking server 130 notifies the processing unit 230 of the inspection result through the communication unit 210 of the harmful blocking device 200, and a log is created when harmful words are checked. (S608).

The process unit 230 transfers the created log to the harmful blocking server 130 through the communication unit 210 (S609). The harmful blocking server 130 stores the received processing result log in the database server 138, and the notification and reporting server 136 creates a report on the processing result list and transmits it to the guardian smart device 110 so that the guardian so that it can be confirmed (S610).

Referring to FIG. 7 , an operation of blocking harmful applications, particularly game applications, and preventing addiction will be described.

When the monitoring mode is executed (S701) and application execution is detected (S702), the process unit 230 commands the command unit 240 to scan corresponding application information, and the command unit 240 sends an application to be monitored to scan. In the information, the registration code information for knowing the game properties of the application is passed to the extraction unit 250, and the extraction unit 250 extracts the hash value of the registration code data of the application to be monitored, and the communication unit ( 210) to the harmful blocking server 130 (S703).

Upon receiving this, the harmful inspection server 134 of the harmful blocking server 130 compares and searches the extracted hash value with the hash value of the game registration code data stored in the database server 138, so that the corresponding application is a game. It is checked whether or not it is recognized (S704).

The notification and reporting server 136 of the harmful blocking server 130 notifies the process unit 230 of the inspection result through the communication unit 210 of the harmful blocking device 200. 230 retrieves and compares the previous cumulative use time stored in the database server 138 of the harmful blocking server 130 for a set time (eg, daily or monthly) to check whether the limited time has passed (S705).

If the limited time has not elapsed, the process unit 230 allows the execution of the application, writes a usage monitoring log, records the start and end times, transmits them to the database server 138 in real time, and monitors the limited time in real time. Compare with (S707).

When the time limit is exceeded, the process unit 230 calls a guide message so that the user (protected person) can know (S708), and forcibly terminates or blocks the corresponding application (S709).

Thereafter, the process unit 230 creates a processing result log and transmits the created log to the harmful blocking server 130 through the communication unit 210 (S710), and the harmful blocking server 130 transmits the received processing result log. Stored in the database server 138, the notification and reporting server 136 creates a report on the processing result list and transmits it to the guardian smart device 110 so that the guardian can check (S711).

As described above, according to the smart device harmful blocking system according to an embodiment of the present invention, a harmful blocking device including a virtual network device is installed in the kernel area of the smart device so that all communication packets transmitted and received to the smart device pass through, so that they are transmitted in real time. It analyzes and extracts the data to determine whether or not it is harmful and blocks it, and at the same time, the guardian is notified. In addition, harmful content (video, image, voice) such as pornography held in the smart device can be scanned and searched in real time to determine whether it is harmful, block it, and notify the guardian at the same time. After all, it is possible to fundamentally block various paths through which minors can access harmful substances with smart devices, and there is an advantage in that guardians can monitor them in real time.

Although preferred embodiments of the present invention have been described above, the present invention is not limited to the specific embodiments described above. That is, those skilled in the art to which the present invention pertains can make many changes and modifications to the present invention without departing from the spirit and scope of the appended claims, and all such appropriate changes and modifications Equivalents should also be considered as falling within the scope of this invention.

Claims (1)

a communication unit that performs communication;
a virtual network device unit for passing communication packets transmitted and received through the communication unit and sending them to an extraction unit;
A process unit that determines the area of the file to be monitored among the video, image, and audio files in the ward's smart device, determines the target file to be extracted or the packet to be monitored that needs to be checked for harmfulness using the extracted packet data, and delivers it to the second extraction unit; and,
A first extraction unit that receives a file to be checked for harmfulness among the files to be monitored, extracts a hash value of the file to be checked for harmfulness, and sends it to the harmful blocking server through a communication unit; ) and a second extraction unit that verifies and extracts the content and transmits it to the process unit, receives packet data to be monitored from the process unit, extracts a hash value of the packet data to be monitored, and sends it to the harmful blocking server through the communication unit. Including; an extraction unit comprising,
The first or second extractor has a first hash value extracted using a neural network trained to determine the similarity of hash values through a series of inputs of other hash values extracted from a plurality of harmful confirmation target files having the same result. Determine the degree of similarity with the pre-stored second hash value, send the second hash value having a similarity equal to or greater than a threshold to the harmful blocking server,
The harmful blocking server,
Compares the first hash value and the second hash value of the file to be checked for harmfulness received through the first extraction unit and the hash value of the list of harmful files stored in the database server to determine whether the file to be checked for harmfulness is harmful or not. And also comparing the hash value of the packet data to be monitored transmitted through the second extractor with the hash value of the harmful packet data list stored in the database server to check whether the packet data to be monitored is harmful. Smart device harmful blocking system through AI-based hash similarity analysis.

Images