KR20230059015A - System for blocking harmful site and method thereof - Google Patents

Abstract

The present invention discloses a harmful site blocking system and method. That is, in the present invention, when content including a URL address is displayed on the terminal, the server obtains a screen of the specific site based on information about the specific site corresponding to the URL address included in the corresponding content provided from the terminal, and , If a screen of a specific site obtained in advance is included among a plurality of screens included in a pre-stored blacklist, the terminal blocks access to the specific site or provides information on whether the URL address is harmful or not. It provides real-time whether or not the URL address displayed in the URL is harmful, prevents the user from accessing a harmful site without being aware of it, and thereby prevents the user's personal information from being leaked.

Description

Harmful site blocking system and method {System for blocking harmful site and method thereof}

The present invention relates to a harmful site blocking system and method, and in particular, when content including a URL address is displayed on a terminal, a server transmits information on a specific site corresponding to a URL address included in the corresponding content provided from a terminal. Based on this, the screen of the specific site is obtained, and if the screen of the specific site obtained earlier is included among the plurality of screens included in the blacklist stored in advance, access to the specific site from the terminal is blocked or It relates to a harmful site blocking system and method for providing information on harmfulness.

Harmful sites refer to sites containing information deemed necessary for deliberation, such as illegal information pursuant to Article 44-7 of the Act on the Installation and Operation of the Korea Communications Commission and harmful information to juveniles pursuant to Article 8 Paragraph 1 of the Enforcement Decree.

These harmful sites are obscene, defamatory, cause fear or anxiety, hacking, speculation, illegal trade, anti-government, terrorism, and crime. Most of them have servers abroad, so they cannot be forcibly closed. It is regulated by blocking access to

In addition, in the case of the method of blocking access to the harmful site, the URL information or DNS information of the harmful site is collected, and when the user tries to access the harmful site, the collected URL information or DNS information of the harmful site It is difficult to provide a function to block users from accessing harmful sites in a state where URL information or DNS information of harmful sites frequently changes.

Korea Registration No. 10-1808033 [Title: Method and device for blocking harmful sites using accessibility events]

An object of the present invention is to obtain a screen of a specific site based on information about a specific site corresponding to the URL address included in the corresponding content provided from the terminal in a server when content including a URL address is displayed on a terminal, and , Harmful sites that block access to a specific site from the terminal or provide information on whether the URL address is harmful if the screen of a specific site acquired earlier is included among a plurality of screens included in the pre-stored blacklist It is to provide a blocking system and method.

Another object of the present invention is to display XML data related to a specific site on the basis of information on a specific site corresponding to the URL address included in the corresponding content provided from the terminal in a server when content including a URL address is displayed on a terminal. is collected, and if XML data related to a specific site obtained earlier is included among a plurality of XML data included in a pre-stored blacklist, blocking access to a specific site from the terminal or determining whether the URL address is harmful or not. It is to provide a harmful site blocking system and method for providing information.

A harmful site blocking system according to an embodiment of the present invention includes the terminal for transmitting link information when link information is included in content displayed on the terminal; and accesses a website corresponding to the link information transmitted from the terminal, obtains a screen of the website, and determines whether the screen of the obtained website is included in a blacklist including a plurality of harmful screens previously stored in the server. and, as a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the server, the link information included in the content displayed on the terminal and the server for transmitting guide information indicating that a website corresponding to is a harmful site to the terminal, wherein the terminal receives the guide information transmitted from the server, and the terminal receives content including the link information. The server may perform a function of displaying guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while being displayed.

As an example related to the present invention, the server checks at least one of a color in the screen of the obtained website, a position or size of one or more objects, and text in the screen of the website through a character recognition function, and the confirmation Whether at least one of the color, position or size, and text of one or more objects in the screen of the website is similar to at least one of the color, position or size, and text of one or more objects in the plurality of harmful screens included in the blacklist can judge

A harmful site blocking method according to an embodiment of the present invention includes the steps of transmitting, by a terminal, link information to a server when link information is included in content displayed on a terminal; accessing, by the server, a web site corresponding to the link information transmitted from the terminal, and obtaining a screen of the web site; determining, by the server, whether the screen of the obtained web site is included in a blacklist including a plurality of harmful screens previously stored in the server; As a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the server, the link information included in the content displayed on the terminal by the server transmitting guide information indicating that the web site corresponding to is a harmful site to the terminal; Receiving, by the terminal, guide information transmitted from the server; and displaying, by the terminal, guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while the terminal is displaying content including the link information. can include

As an example related to the present invention, the step of determining whether or not the acquired web site screen is included in the blacklist includes a plurality of similarities between a plurality of harmful screens included in the blacklist and the obtained web site screen. The process of calculating each; and determining whether one or more similarities greater than or equal to a preset reference value exist among the calculated plurality of similarities.

As an example related to the present invention, the step of determining whether or not the screen of the acquired web site is included in the blacklist includes the color in the screen of the acquired web site, the position or size of one or more objects, and a text recognition function. checking at least one of the texts in the screen of the web site through the process; and at least one of colors, positions or sizes, and texts of one or more objects in a plurality of harmful screens included in the blacklist; A process of determining whether they are similar may be included.

As an example related to the present invention, in a state in which content including the link information is being displayed, displaying guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information, The link information being displayed on the terminal may be converted into a plain-text form and displayed.

As an example related to the present invention, as a result of the determination, when the screen of the obtained web site is not included in the blacklist including a plurality of harmful screens previously stored in the server, the server displays the screen on the terminal. transmitting, to the terminal, other guide information indicating that the web site corresponding to the link information included in the content to be accessed is not a harmful site; receiving, by the terminal, other guide information transmitted from the server; and other guide information indicating that the website corresponding to the received link information is not a harmful site, on one side of the link information, by the terminal while content including the link information is being displayed in the terminal. A displaying step may be further included.

A harmful site blocking system according to an embodiment of the present invention includes the terminal for transmitting link information when link information is included in content displayed on the terminal; and accesses a website corresponding to the link information transmitted from the terminal, collects XML data related to the website, and collects XML data related to the collected website from a blacklist including a plurality of harmful XML data previously stored in a server. It is determined whether XML data is included, and as a result of the determination, when the XML data related to the collected website is not included in the blacklist including a plurality of harmful XML data previously stored in the server, the terminal and the server for transmitting to the terminal other guide information indicating that the web site corresponding to the link information included in the displayed content is not a harmful site, and the terminal receives the other guide information transmitted from the server. And, while the content including the link information is being displayed on the terminal, an emoticon corresponding to other guide information indicating that the website corresponding to the received link information is not a harmful site is displayed on one side of the link information. It may include the server that performs a function characterized by displaying.

A harmful site blocking method according to an embodiment of the present invention includes the steps of transmitting, by a terminal, link information to a server when link information is included in content displayed on a terminal; accessing, by the server, a web site corresponding to the link information transmitted from the terminal, and collecting XML data related to the web site; determining, by the server, whether XML data related to the collected web site is included in a blacklist including a plurality of harmful XML data previously stored in the server; As a result of the determination, when the XML data related to the collected website is not included in the blacklist including a plurality of harmful XML data previously stored in the server, the server includes it in the content displayed on the terminal. transmitting, to the terminal, other guide information indicating that the web site corresponding to the linked link information is not a harmful site; receiving, by the terminal, other guide information transmitted from the server; and other guide information indicating that the website corresponding to the received link information is not a harmful site, on one side of the link information, by the terminal while content including the link information is being displayed in the terminal. A step of displaying a corresponding emoticon may be included.

As an example related to the present invention, as a result of the determination, when XML data related to the collected web site is included in a blacklist including a plurality of harmful XML data previously stored in the server, by the server, the terminal transmitting, to the terminal, guide information indicating that a web site corresponding to the link information included in content displayed on the screen is a harmful site; Receiving, by the terminal, guide information transmitted from the server; and displaying, by the terminal, guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while the terminal is displaying content including the link information. may further include.

In the present invention, when content including a URL address is displayed on a terminal, a server obtains a screen of a specific site based on information on a specific site corresponding to a URL address included in the corresponding content provided from the terminal, and If a screen of a specific site obtained earlier is included among a plurality of screens included in the stored blacklist, it is displayed on the terminal by blocking access to the specific site from the terminal or providing information on whether the URL address is harmful or not. There is an effect of providing real-time whether or not the URL address is harmful, preventing the user from accessing a harmful site without being aware of it, and thereby preventing the user's personal information from leaking.

In addition, in the present invention, when content including a URL address is displayed on a terminal, the server converts XML data related to the specific site based on information on the specific site corresponding to the URL address included in the corresponding content provided from the terminal. If XML data related to a specific site obtained earlier is included among a plurality of XML data included in the collected and pre-stored blacklist, information on blocking access to a specific site from the terminal or whether the URL address is harmful or not By providing, there is an effect of preventing the user from being exposed to risk information.

1 is a block diagram showing the configuration of a harmful site blocking system according to an embodiment of the present invention.
2 is a flowchart illustrating a method for blocking harmful sites according to a first embodiment of the present invention.
3 to 5 are diagrams illustrating examples of screen configurations of a terminal according to an embodiment of the present invention.
6 is a flowchart illustrating a method for blocking harmful sites according to a second embodiment of the present invention.
7 to 8 are diagrams illustrating examples of a screen configuration of a terminal according to an embodiment of the present invention.

It should be noted that technical terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. In addition, technical terms used in the present invention should be interpreted in terms commonly understood by those of ordinary skill in the art to which the present invention belongs, unless specifically defined otherwise in the present invention, and are excessively inclusive. It should not be interpreted in a positive sense or in an excessively reduced sense. In addition, when the technical terms used in the present invention are erroneous technical terms that do not accurately express the spirit of the present invention, they should be replaced with technical terms that those skilled in the art can correctly understand. In addition, general terms used in the present invention should be interpreted as defined in advance or according to context, and should not be interpreted in an excessively reduced sense.

Also, singular expressions used in the present invention include plural expressions unless the context clearly dictates otherwise. Terms such as "consisting of" or "comprising" in the present invention should not be construed as necessarily including all of the various elements or steps described in the invention, and some of the elements or steps may not be included. It should be construed that it may, or may further include additional components or steps.

In addition, terms including ordinal numbers such as first and second used in the present invention may be used to describe components, but components should not be limited by the terms. Terms are used only to distinguish one component from another. For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted.

In addition, in describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description will be omitted. In addition, it should be noted that the accompanying drawings are only for easily understanding the spirit of the present invention, and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

1 is a block diagram showing the configuration of a harmful site blocking system 10 according to an embodiment of the present invention.

As shown in FIG. 1, the harmful site blocking system 10 is composed of a terminal 100 and a server 200. Not all of the components of the harmful site blocking system 10 shown in FIG. 1 are essential components, and the harmful site blocking system 10 may be implemented by more components than those shown in FIG. 1, The harmful site blocking system 10 may be implemented with fewer components.

The terminal 100 includes a smart phone, a portable terminal, a mobile terminal, a foldable terminal, a personal digital assistant (PDA), and a portable multimedia device (PMP). Player terminal, telematics terminal, navigation terminal, personal computer, notebook computer, slate PC, tablet PC, ultrabook, wearable device Device, for example, watch type terminal (Smartwatch), glass type terminal (Smart Glass), HMD (Head Mounted Display), etc.), Wibro terminal, IPTV (Internet Protocol Television) terminal, smart TV, digital broadcasting It can be applied to various terminals such as terminals, audio video navigation (AVN) terminals, audio/video (A/V) systems, flexible terminals, digital signage devices, and the like.

The server 200 may be implemented in the form of a web server, database server, or proxy server. In addition, one or more of a network load balancing mechanism and various software enabling the corresponding server 200 to operate on the Internet or other networks may be installed in the server 200, which may be implemented as a computerized system. can Also, the network can be an http network, a private line, an intranet or any other network. Furthermore, the connection between the terminal 100 and the server 200 may be connected through a secure network so that data is not attacked by any hacker or other third party. In addition, the server 200 may include a plurality of database servers, and these database servers may be implemented in a manner that is separately connected to the server 200 through any type of network connection including a distributed database server architecture. there is.

Each of the terminal 100 and the server 200 includes a communication unit (not shown) for performing communication functions with other terminals, a storage unit (not shown) for storing various information and programs (or applications), and various A display unit (not shown) for displaying information and program execution results, an audio output unit (not shown) for outputting audio information corresponding to the various information and program execution results, and controlling various components and functions of each terminal. It may include a control unit (not shown) and the like.

The terminal 100 communicates with the server 200, a hosting server (not shown) that runs an arbitrary website, and other terminals (not shown) that share content (or information/data). Here, the terminal 100 has a function of accessing a website provided by the hosting server through a dedicated app (or dedicated website) provided by the server 200, and sharing (or transmitting/receiving) content with the other terminals. It may be a terminal possessed by a general user for receiving functions such as

In addition, the terminal 100 is a general user for receiving a website access function, content sharing function, etc. through a dedicated app and/or website provided by the server 200 by interworking with the server 200. Sign up as a member and register personal information in the server 200. At this time, the personal information includes ID, e-mail address, password (or password), name, gender, date of birth, contact information, address (or address information), and the like.

In addition, the terminal 100 may register as a user in the server 200 using SNS account information or other site account information to which the user of the terminal 100 has joined. Here, the SNS account may be information related to Facebook, Twitter, Instagram, Kakao Story, Naver Blog, and the like. In addition, the account of the other site may be information related to YouTube, Kakao, Naver, and the like.

In addition, when performing the membership sign-up process, the terminal 100 must complete the authentication function through a user authentication means (eg, mobile phone, credit card, i-PIN, etc.) to properly perform the member sign-up process for the server 200. can be completed

In addition, after membership registration is completed, the terminal 100 downloads a dedicated app (or application/application program/specific app) provided from the server 200 in order to use the service provided by the server 200. It is installed in the terminal 100. In this case, the dedicated app may be an app for performing a website access function, a content sharing function, and the like.

In addition, after membership registration is completed, the terminal 100 may display a discount coupon provided from the server 200 through a corresponding dedicated app. In this case, the discount coupon may be a discount coupon that includes discount information of a certain rate when performing a website access function, content sharing function, etc. provided by the corresponding server 200 .

In addition, the terminal 100 receives content provided (or transmitted) from another external terminal (not shown). Here, the content is composed of a text message, e-mail, KakaoTalk message, social network service message, etc., and text, image, video, link information (or URL address / information / shortened URL address / website address), etc. include

Also, the terminal 100 displays the received content. At this time, the terminal 00 may display the content being stored in the corresponding terminal 100 .

In addition, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 displays the link information included in the corresponding content in a background state. , and transmits identification information of the terminal 100 to the server 200. Here, the identification information of the terminal 100 includes MDN (Mobile Directory Number), mobile IP, mobile MAC, Sim (subscriber identity module: subscriber identity module) card-specific information, serial number, and the like.

That is, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 is provided by the corresponding server 200 in a background state. While the dedicated app is running, the link information and identification information of the terminal 100 are transmitted to the server 200 through the dedicated app running in the background state.

In addition, as a result of determining whether the corresponding link information is harmful in the server 200, when it is determined that the website corresponding to the corresponding link information is harmful, the terminal 100 responds to the previously transmitted link information to the server 200. Guide information indicating that a website corresponding to the link information included in the content displayed on the corresponding terminal 100 transmitted from 200 is a harmful site is received.

Further, while content including the corresponding link information is being displayed, the terminal 100 displays (or outputs) guide information indicating that the website corresponding to the received link information is a harmful site on one side of the link information. )do. At this time, the terminal 100 may display guide information indicating that the website corresponding to the received link information is a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble.

In addition, even if the terminal 100 selects (or clicks) the corresponding link information, it modifies (or converts) the corresponding link information into a plain-text form so that it is not accessed to the website corresponding to the corresponding link information. to indicate At this time, the terminal 100 permanently deletes (or spam-processes) the content including the corresponding link information in the corresponding terminal 100, and provides information on another terminal (not shown) that provided the content (e.g., phone number). numbers, e-mail addresses, messenger account information, etc.) may be spammed (or blinded).

In addition, as a result of determining whether the link information is harmful in the server 200, when it is determined that the website corresponding to the link information is not harmful, the terminal 100 responds to the previously transmitted link information, etc. Other guide information indicating that the web site corresponding to the link information included in the content displayed on the corresponding terminal 100 transmitted from the server 200 is not a harmful site is received.

In addition, while content including the corresponding link information is being displayed, the terminal 100 displays other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. (or output). At this time, the terminal 100 may display other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble. In addition, while the content including the corresponding link information is being displayed, the terminal 100 responds to other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. emoticon (or icon/AR emoticon/AR icon) may be displayed.

In an embodiment of the present invention, when the content including the link information is displayed in the terminal 100, displaying the link information in a state in which a hyperlink function is applied has been described, but is not limited thereto, and the terminal ( 100) converts the corresponding link information into plain text when displaying content including the link information, and displays other guide information from the server 200 indicating that the website corresponding to the link information is not a harmful site. In the case of receiving the hyperlink function, the link information in the form of plain text being displayed on the terminal 100 is displayed on the terminal 100 so that the user of the terminal 100 can access the web site corresponding to the corresponding link information by the hyperlink function. may be applied, and content including link information to which the hyperlink function is applied may be displayed.

In addition, in order to access a website corresponding to the corresponding link information, when the link information included in the content being displayed on the terminal 100 is selected, the terminal 100 is directed to the website corresponding to the corresponding link information. connect At this time, the terminal 100 may access the website corresponding to the link information through the mediation of the server 200 for safe access.

In an embodiment of the present invention, the terminal 100 can perform various functions provided by the server 200 in the form of a dedicated app or a website (including, for example, a website access function, a content sharing function, etc.) .

The server 200 communicates with the terminal 100, the hosting server, and the other terminals.

In addition, the server 200 performs a membership sign-up procedure for users of the terminal 100 and the like.

In addition, the server 200 registers personal information related to the user of the terminal 100 and the like. At this time, the server 200 may register (or manage) the corresponding personal information in a DB server (not shown).

In addition, the server 200 performs a member management function for users such as the terminal 100 .

In addition, the server 200 provides a dedicated app and/or website that provides a website access function, content sharing function, etc. to the terminal 100 and the like.

In addition, the server 200 provides a bulletin board function for announcements, events, and the like.

In addition, the server 200 identifies a harmful site as a harmful site in relation to a specific screen related to specific raw data, specific XML data, etc. for a harmful site determination model through a plurality of screens related to a preset blacklist for learning, a plurality of XML data, etc. It performs a learning function for harmful site contents. At this time, the server 200 stores raw data in parallel and distributedly, and unstructured data included in the stored raw data (or including a plurality of screens related to a blacklist for learning, a plurality of XML data, etc.), a structured ( Structured data and semi-structured data are refined, pre-processing is performed including classification as meta data, analysis including data mining is performed on the pre-processed data, and at least one type of machine is used. Based on learning, learning, training, and testing can be performed to build big data. At this time, at least one type of machine learning includes supervised learning, semi-supervised learning, unsupervised learning, reinforcement learning, and deep reinforcement learning. It may consist of any one or a combination of at least one of them.

That is, the server 200 performs a learning function on the harmful site determination model in the form of a neural network through a plurality of screens and a plurality of XML data related to the learning blacklist.

In addition, the server 200 receives link information transmitted from the terminal 100, identification information of the terminal 100, and the like.

In addition, the server 200 accesses the website corresponding to the received link information and obtains (or captures) a screen of the website. Here, the screen of the website is composed of an initial screen of the corresponding website, one or more screens respectively corresponding to one or more sub-link information linked from the corresponding initial screen, and a color in the initial screen, one or more objects (for example, For example, text, images, etc.) and the like.

In addition, the server 200 determines (or checks) whether the screen of the acquired (or captured) website is included in the blacklist including a plurality of harmful screens previously stored in the corresponding server 200. Here, the plurality of harmful screens included in the blacklist include screens collected from harmful sites such as obscenity, defamation, drugs, causing fear or anxiety, hacking, speculation, illegal transactions, anti-government, terrorism, and crime.

At this time, the server 200 calculates a plurality of similarities between a plurality of harmful screens included in the blacklist and the obtained web site screen, respectively, and sets a preset reference value (for example, 90%) among the calculated plurality of similarities. ) or more (or one or more harmful screens corresponding to the one or more similarities among the plurality of harmful screens) may be determined.

Here, the server 200 performs an analysis function on the screen of the acquired web site, such as color in the screen of the web site, position or size of one or more objects (eg, text, image, etc.), text, and the like. The text in the screen of the website is checked through the recognition function, and the color in the screen of the website, the position or size of one or more objects, the text, etc. are the colors in the plurality of harmful screens included in the blacklist. , it may be determined whether the location or size of one or more objects, text, etc. are similar.

In addition, the server 200 may determine whether the obtained web site screen is included in a white list including a plurality of other screens previously stored in the corresponding server 200 .

As a result of the determination (or as a result of the confirmation), when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the corresponding server 200, the server 200 sends the terminal Transmits guide information indicating that the website corresponding to the link information included in the content displayed at 100 is a harmful site (or guide information indicating that the website related to the link information is a harmful site) to the terminal 100 do.

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) exists among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 Guidance information indicating that the website corresponding to the link information included in the content being displayed is a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site. is transmitted to the terminal 100.

In addition, as a result of the determination (or the result of the confirmation), when the screen of the obtained web site is not included in the whitelist including a plurality of other screens previously stored in the corresponding server 200, the server 200 transmits to the terminal 100 other guide information notifying that the web site corresponding to the link information included in the content displayed on the terminal 100 is an unauthorized site. Here, the terminal 100 receives other guide information for guiding that it is a website corresponding to the link information included in the content displayed on the terminal 100 transmitted from the server 200, and the received Other guide information indicating that the web site corresponds to the link information included in the content displayed on the terminal 100 is displayed (or output).

In addition, when the screen of the obtained website is not included in the blacklist including a plurality of harmful screens previously stored in the server 200 as a result of the determination (or the result of the confirmation), the server 200 Other guide information indicating that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site (or other guide information indicating that the website related to the link information is not a harmful site) ) is transmitted to the terminal 100.

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) do not exist among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 ) determines that the website corresponding to the link information included in the content being displayed is not a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site. Transmits other guide information indicating the to the terminal (100).

In addition, as a result of the determination (or the result of the confirmation), when the screen of the obtained website is included in the whitelist including a plurality of other screens previously stored in the corresponding server 200, the server 200 It is determined that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 Other guide information indicating that the site is not harmful is transmitted to the terminal 100 .

In addition, the server 200 receives link information transmitted from the terminal 100, identification information of the terminal 100, and the like.

In addition, the server 200 accesses a web site corresponding to the received link information and collects one or more XML data related to the web site. Here, the XML data (or XML metadata) includes a header, an IP address, and the like related to a corresponding website. At this time, the server 200 may collect XML data related to the web site corresponding to the link information using a preset browser API (or XML data collection API).

In addition, the server 200 determines (or checks) whether XML data related to the collected web site is included in a blacklist including a plurality of harmful XML data previously stored in the corresponding server 200 . Here, the plurality of harmful XML data included in the blacklist includes XML data collected from harmful sites such as obscenity, defamation, drugs, causing fear or anxiety, hacking, speculation, illegal transactions, anti-government, terrorism, and crime. .

At this time, the server 200 calculates a plurality of similarities between the plurality of harmful XML data included in the blacklist and the XML data related to the collected website, respectively, and sets another reference value ( For example, it may be determined whether one or more similarities (or one or more harmful XML data corresponding to the one or more similarities among the plurality of harmful XML data) having a similarity of 90% or more exist.

Here, the server 200 performs an analysis function on the XML data related to the collected web site, and checks one or more components (eg, including a header, an IP address, etc.) included in the XML data, It may be determined whether the identified one or more components are similar to a plurality of harmful XML data included in the blacklist.

In addition, the server 200 may determine whether the collected XML data of the web site is included in a whitelist including a plurality of other XML data previously stored in the corresponding server 200 .

As a result of the determination (or the result of the confirmation), when the XML data related to the collected website is included in the blacklist including a plurality of harmful XML data previously stored in the corresponding server 200, the server 200 sends guide information indicating that a website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site (or guide information indicating that a website related to the link information is a harmful site) to the terminal 100 ) is sent to

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) exists among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 Guidance information indicating that the website corresponding to the link information included in the content being displayed is a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site. is transmitted to the terminal 100.

In addition, when the XML data of the collected web site is not included in the whitelist including a plurality of other XML data previously stored in the server 200 as a result of the determination (or the result of the confirmation), the server ( 200) transmits to the terminal 100 other guide information notifying that the web site corresponding to the link information included in the content being displayed on the terminal 100 is an unauthorized site. Here, the terminal 100 receives other guide information for guiding that the website corresponding to the link information included in the content being displayed on the terminal 100 transmitted from the server 200 is an unauthorized site, and , Displays (or outputs) other guide information indicating that the web site corresponding to the link information included in the content being displayed in the received terminal 100 is an unauthorized site.

In addition, when the XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data previously stored in the server 200 as a result of the determination (or the result of the confirmation), the server 200 200 is other guidance information indicating that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site (or indicating that the website related to the link information is not a harmful site). other guide information) is transmitted to the terminal 100 .

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) do not exist among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 ) determines that the website corresponding to the link information included in the content being displayed is not a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site. Transmits other guide information indicating the to the terminal (100).

In addition, when the XML data of the collected web site is included in the whitelist including a plurality of other XML data pre-stored in the server 200 as a result of the determination (or the result of the confirmation), the server 200 ) determines that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site, and determines that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site. Other guide information indicating that the site is not a harmful site is transmitted to the terminal 100 .

In addition, the XML data of the collected website is included in the whitelist including a plurality of other XML data previously stored in the server 200, and the website address related to the other XML data included in the whitelist. (or URL) and the website address related to the XML data of the collected website are different, the server 200 determines that the website related to the XML data is a site that masquerades as the original website (or a phishing site/harmful site). ), blocking access to the website corresponding to the link address in the terminal 100, and the website corresponding to the link information included in the content displayed on the terminal 100 (or the website corresponding to the link information) Guide information indicating that the website corresponding to the link address) is a harmful site is transmitted to the terminal 100 . At this time, the server 200 provides a plurality of XML data and website addresses (or link addresses) of courier companies, public institutions, and famous web and app services (for example, *.samsung.com/*, *.cj.com/ *, etc.) can be managed in the form of the white list.

For example, as the number of text messages impersonating a courier company is increasing recently, the terminal 100 is induced to access a website of the same type as the courier company through a text message, etc. ) The damage of collecting personal information (including names, phone numbers, etc.) according to user input is increasing.

Therefore, the server 200 according to an embodiment of the present invention not only compares the information included in the whitelist with the information (eg XML data) collected from the web site to be accessed by the terminal 100, but also It is possible to additionally check whether the web site to be accessed by the terminal 100 is the original site.

In addition, the server 200 is based on harmful site information identified as a harmful site in relation to the screen of the web site corresponding to the obtained link information and XML data related to the web site corresponding to the collected link information. Machine learning is performed with , and corresponding information according to the corresponding link information is generated based on the machine learning result. Here, the correspondence information (or correspondence information according to the corresponding link information) includes information indicating whether the website related to the corresponding link information is harmful, harmful information if the website is harmful, and risk level (or risk level).

That is, the server 200 takes the screen of the web site corresponding to the acquired link information, the XML data related to the web site corresponding to the collected link information, and the like as input values of a preset harmful site determination model. Machine learning (or artificial intelligence/deep learning) is performed, and based on the machine learning result (or artificial intelligence result/deep learning result), corresponding information according to the corresponding link information is generated.

In addition, the server 200 manages access to the web site corresponding to the link information in the terminal 100 based on the generated correspondence information (eg, blocking access, maintaining connection, etc.).

As such, when content including a URL address is displayed on the terminal, the server acquires the screen of the specific site based on information on the specific site corresponding to the URL address included in the corresponding content provided from the terminal, and If a previously obtained screen of a specific site is included among a plurality of screens included in the stored blacklist, access to the specific site from the terminal may be blocked or information on whether the URL address is harmful may be provided.

In addition, in this way, when content including a URL address is displayed on the terminal, the server transmits XML data related to the specific site based on information on the specific site corresponding to the URL address included in the corresponding content provided from the terminal. If XML data related to a specific site obtained earlier is included among a plurality of XML data included in the collected and pre-stored blacklist, information on blocking access to a specific site from the terminal or whether the URL address is harmful or not can provide.

Hereinafter, a method for blocking harmful sites according to the present invention will be described in detail with reference to FIGS. 1 to 8 .

2 is a flowchart illustrating a method for blocking harmful sites according to a first embodiment of the present invention.

First, the terminal 100 receives content provided (or transmitted) from another external terminal (not shown). Here, the content is composed of a text message, e-mail, KakaoTalk message, social network service message, etc., and text, image, video, link information (or URL address / information / shortened URL address / website address), etc. include

Also, the terminal 100 displays the received content. At this time, the terminal 00 may display the content being stored in the corresponding terminal 100 .

For example, the first terminal 100 receives first content in the form of a text message transmitted from another terminal (not shown).

Also, as shown in FIG. 3 , the first terminal displays the first content 300 including the received first link information (eg https://test.kr/12345abcde). At this time, as shown in FIG. 3, the first terminal displays the first link information 310 to which the 'a tag' in the HTML language is applied according to the hyperlink function (S210).

Subsequently, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 displays the link information included in the corresponding content in a background state. , and transmits identification information of the terminal 100 to the server 200. Here, the identification information of the terminal 100 includes MDN, mobile IP, mobile MAC, Sim (subscriber identification module) card-specific information, serial number, and the like.

That is, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 is provided by the corresponding server 200 in a background state. While the dedicated app is running, the link information and identification information of the terminal 100 are transmitted to the server 200 through the dedicated app running in the background state.

For example, when the first link information 310 is included in the first content 300 displayed on the first terminal, the first terminal provides information to the server 200 running in a background state. The first link information and the identification information of the first terminal are transmitted to the server 200 through a two-link app, which is a dedicated app (S220).

Thereafter, the server 200 receives link information transmitted from the terminal 100, identification information of the terminal 100, and the like.

In addition, the server 200 accesses the website corresponding to the received link information and obtains (or captures) a screen of the website. Here, the screen of the website is composed of an initial screen of the corresponding website, one or more screens respectively corresponding to one or more sub-link information linked from the corresponding initial screen, and a color in the initial screen, one or more objects (for example, For example, text, images, etc.) and the like.

For example, the server 200 receives first link information (eg, https://test.kr/12345abcde) transmitted from the first terminal, identification information of the first terminal, and the like.

In addition, the server 200 accesses the first website corresponding to the first link information according to the received first link information and acquires the first screen of the first website (S230).

Thereafter, the server 200 determines (or checks) whether the obtained (or captured) screen of the website is included in the blacklist including a plurality of harmful screens previously stored in the corresponding server 200. Here, the plurality of harmful screens included in the blacklist include screens collected from harmful sites such as obscenity, defamation, drugs, causing fear or anxiety, hacking, speculation, illegal transactions, anti-government, terrorism, and crime.

At this time, the server 200 calculates a plurality of similarities between a plurality of harmful screens included in the blacklist and the obtained web site screen, respectively, and sets a preset reference value (for example, 90%) among the calculated plurality of similarities. ) or more (or one or more harmful screens corresponding to the one or more similarities among the plurality of harmful screens) may be determined.

Here, the server 200 performs an analysis function on the screen of the acquired web site, such as color in the screen of the web site, position or size of one or more objects (eg, text, image, etc.), text, and the like. The text in the screen of the website is checked through the recognition function, and the color in the screen of the website, the position or size of one or more objects, the text, etc. are the colors in the plurality of harmful screens included in the blacklist. , it may be determined whether the location or size of one or more objects, text, etc. are similar.

For example, the server 200 calculates the first to 100,000 similarities between the first to 100,000 harmful screens previously stored in the server 200 and the obtained first screen, respectively, and calculates the calculated It is determined whether there are one or more harmful screens corresponding to a similarity higher than a preset reference value (for example, 90%) among the 1 similarity to the 100,000th similarity (S240).

As a result of the determination (or as a result of the confirmation), when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the corresponding server 200, the server 200 sends the terminal Transmits guide information indicating that the website corresponding to the link information included in the content displayed at 100 is a harmful site (or guide information indicating that the website related to the link information is a harmful site) to the terminal 100 do.

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) exist among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 Guide information indicating that the website corresponding to the link information included in the content being displayed is a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site. is transmitted to the terminal 100.

For example, when the 7777th similarity greater than or equal to the preset reference value (for example, 90%) exists among the calculated 1st similarity to 100000th similarity, the server 200 determines the first content being displayed on the first terminal. First notification information indicating that the first web site corresponding to the included first link information is a harmful site (for example, a hacking site) is transmitted to the first terminal (S250).

Thereafter, the terminal 100 responds to the previously transmitted link information, etc., and informs indicating that the website corresponding to the link information included in the content displayed on the corresponding terminal 100 transmitted from the server 200 is a harmful site. Receive information.

Further, while content including the corresponding link information is being displayed, the terminal 100 displays (or outputs) guide information indicating that the website corresponding to the received link information is a harmful site on one side of the link information. )do. At this time, the terminal 100 may display guide information indicating that the website corresponding to the received link information is a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble.

In addition, even if the terminal 100 selects (or clicks) the corresponding link information, it modifies (or converts) the corresponding link information into a plain-text form so that it is not accessed to a website corresponding to the corresponding link information. to indicate At this time, the terminal 100 permanently deletes (or spam-processes) the content including the corresponding link information in the corresponding terminal 100, and provides information on another terminal (not shown) that provided the content (e.g., phone number). numbers, e-mail addresses, messenger account information, etc.) may be spammed (or blinded).

For example, the first terminal receives first notification information transmitted from the server 200 in response to previously transmitted first link information.

In addition, as shown in FIG. 4, while the first content including the first link information is being displayed, the first terminal displays the received first website as a harmful site on one side of the corresponding first link information. (For example, a hacking site) is displayed in the form of a speech bubble. At this time, as shown in FIG. 4, the first terminal converts the first link information to which the 'a tag' in the HTML language is applied according to the hyperlink function in FIG. The first link information (or the first link information converted into plain text) 420 is displayed in a state in which application of 'tag' is released (S260).

In addition, when the screen of the obtained website is not included in the blacklist including a plurality of harmful screens previously stored in the server 200 as a result of the determination (or the result of the confirmation), the server 200 Other guide information indicating that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site (or other guide information indicating that the website related to the link information is not a harmful site) ) is transmitted to the terminal 100.

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) do not exist among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 ) determines that the website corresponding to the link information included in the content being displayed is not a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site. Transmits other guide information indicating the to the terminal (100).

For example, when there is no similarity higher than the preset reference value (for example, 90%) among the calculated first to 100,000 similarities, the server 200 provides the first content being displayed on the first terminal. Second notification information indicating that the first web site corresponding to the included first link information is not a harmful site is transmitted to the first terminal (S270).

Thereafter, the terminal 100 responds to the previously transmitted link information to indicate that the website corresponding to the link information included in the content transmitted from the server 200 and displayed on the terminal 100 is not a harmful site. Receive other guidance information indicating

In addition, while content including the corresponding link information is being displayed, the terminal 100 displays other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. (or output). At this time, the terminal 100 may display other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble. In addition, while the content including the corresponding link information is being displayed, the terminal 100 responds to other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. emoticon (or icon/AR emoticon/AR icon) may be displayed.

In addition, in order to access a website corresponding to the corresponding link information, when the link information included in the content being displayed on the terminal 100 is selected, the terminal 100 is directed to the website corresponding to the corresponding link information. connect At this time, the terminal 100 may access the website corresponding to the link information through the mediation of the server 200 for safe access.

For example, the first terminal receives second notification information transmitted from the server 200 in response to previously transmitted first link information.

In addition, as shown in FIG. 5, the first terminal corresponds to the received first link information on one side of the first link information while the first content including the first link information is being displayed. A preset safe emoticon 510 is displayed in response to the second notification information indicating that the first website that is playing is not a harmful site. At this time, as shown in FIG. 5, the first terminal displays the first link information 520 to which the 'a tag' in the HTML language is applied according to the hyperlink function in FIG. 3 (S280).

6 is a flowchart illustrating a method for blocking harmful sites according to a second embodiment of the present invention.

First, the terminal 100 receives content provided (or transmitted) from another external terminal (not shown). Here, the content is composed of a text message, e-mail, KakaoTalk message, social network service message, etc., and text, image, video, link information (or URL address / information / shortened URL address / website address), etc. include

Also, the terminal 100 displays the received content. At this time, the terminal 00 may display the content being stored in the corresponding terminal 100 .

For example, the second terminal 100 receives second content in the form of a text message transmitted from another terminal (not shown).

In addition, the second terminal displays the second content including the received second link information (eg https://test.kr/9876zyx). At this time, the second terminal displays the second link information to which the 'a tag' in the HTML language is applied according to the hyperlink function (S610).

Subsequently, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 displays the link information included in the corresponding content in a background state. , and transmits identification information of the terminal 100 to the server 200. Here, the identification information of the terminal 100 includes MDN, mobile IP, mobile MAC, Sim (subscriber identification module) card-specific information, serial number, and the like.

That is, when link information (or URL address/information/shortened URL address/website address) is included in the content displayed on the terminal 100, the terminal 100 is provided by the corresponding server 200 in a background state. While the dedicated app is running, the link information and identification information of the terminal 100 are transmitted to the server 200 through the dedicated app running in the background state.

For example, when the second link information is included in the second content displayed on the second terminal, the second terminal provides a two-link app, which is a dedicated app provided to the server 200 running in a background state. The second link information, identification information of the second terminal, and the like are transmitted to the server 200 (S620).

Thereafter, the server 200 receives link information transmitted from the terminal 100, identification information of the terminal 100, and the like.

In addition, the server 200 accesses a web site corresponding to the received link information and collects one or more XML data related to the web site. Here, the XML data (or XML metadata) includes a header, an IP address, and the like related to a corresponding website. At this time, the server 200 may collect XML data related to the web site corresponding to the link information using a preset browser API (or XML data collection API).

For example, the server 200 receives second link information (eg, https://test.kr/9876zyx) transmitted from the second terminal, identification information of the second terminal, and the like.

In addition, the server 200 accesses the second website corresponding to the second link information according to the received second link information, and collects second XML data related to the second website (S630). .

Thereafter, the server 200 determines (or checks) whether XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data previously stored in the corresponding server 200 . Here, the plurality of harmful XML data included in the blacklist includes XML data collected from harmful sites such as obscenity, defamation, drugs, causing fear or anxiety, hacking, speculation, illegal transactions, anti-government, terrorism, and crime. .

At this time, the server 200 calculates a plurality of similarities between the plurality of harmful XML data included in the blacklist and the XML data related to the collected website, respectively, and sets another reference value ( For example, it may be determined whether one or more similarities (or one or more harmful XML data corresponding to the one or more similarities among the plurality of harmful XML data) having a similarity of 90% or more exist.

Here, the server 200 performs an analysis function on the XML data related to the collected web site, and checks one or more components (eg, including a header, an IP address, etc.) included in the XML data, It may be determined whether the identified one or more components are similar to a plurality of harmful XML data included in the blacklist.

For example, the server 200 calculates the first to 300,000 similarities between the first to 300,000 harmful XML data previously stored in the corresponding server 200 and the collected second XML data, respectively. It is determined whether there is one or more harmful XML data corresponding to a similarity higher than another preset reference value (for example, 90%) among the calculated first to 300,000 similarities (S640).

As a result of the determination (or the result of the confirmation), when the XML data related to the collected website is included in the blacklist including a plurality of harmful XML data previously stored in the corresponding server 200, the server 200 sends guide information indicating that a website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site (or guide information indicating that a website related to the link information is a harmful site) to the terminal 100 ) is sent to

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) exists among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 Guidance information indicating that the website corresponding to the link information included in the content being displayed is a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is a harmful site. is transmitted to the terminal 100.

For example, when a 2580th similarity greater than or equal to the preset reference value (for example, 90%) exists among the calculated 1st similarity to 300000th similarity, the server 200 provides the second content being displayed on the second terminal. Eleventh notification information indicating that the second web site corresponding to the included second link information is a harmful site (for example, a pornographic site) is transmitted to the second terminal (S650).

Thereafter, the terminal 100 responds to the previously transmitted link information, etc., and informs indicating that the website corresponding to the link information included in the content displayed on the corresponding terminal 100 transmitted from the server 200 is a harmful site. Receive information.

Further, while content including the corresponding link information is being displayed, the terminal 100 displays (or outputs) guide information indicating that the website corresponding to the received link information is a harmful site on one side of the link information. )do. At this time, the terminal 100 may display guide information indicating that the website corresponding to the received link information is a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble.

In addition, even if the terminal 100 selects (or clicks) the corresponding link information, it modifies (or converts) the corresponding link information into a plain-text form so that it is not accessed to the website corresponding to the corresponding link information. to indicate At this time, the terminal 100 permanently deletes (or spam-processes) the content including the corresponding link information in the corresponding terminal 100, and provides information on another terminal (not shown) that provided the content (e.g., phone number). numbers, e-mail addresses, messenger account information, etc.) may be spammed (or blinded).

For example, the second terminal receives eleventh notification information transmitted from the server 200 in response to previously transmitted second link information.

In addition, as shown in FIG. 7, while the second content including the second link information is being displayed, the second terminal displays the received second website on one side of the corresponding second link information as a harmful site. (For example, obscene site) 11th notification information 710 is displayed in the form of a speech bubble. At this time, as shown in FIG. 7, the second terminal converts the second link information to which the 'a tag' in the HTML language is applied according to the previous hyperlink function into plain text, and applies the corresponding 'a tag'. In this canceled state, the second link information (or the second link information converted to plain text) 720 is displayed (S660).

In addition, when the XML data related to the collected web site is not included in the blacklist including a plurality of harmful XML data previously stored in the server 200 as a result of the determination (or the result of the confirmation), the server 200 200 is other guidance information indicating that the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site (or indicating that the website related to the link information is not a harmful site). other guide information) is transmitted to the terminal 100 .

That is, when one or more similarities greater than or equal to the preset reference value (for example, 90%) do not exist among the calculated plurality of similarities as a result of the determination (or as a result of the confirmation), the server 200 determines the terminal 100 ) determines that the website corresponding to the link information included in the content being displayed is not a harmful site, and the website corresponding to the link information included in the content displayed on the terminal 100 is not a harmful site. Transmits other guide information indicating the to the terminal (100).

For example, when there is no similarity higher than the preset reference value (for example, 90%) among the calculated first to 300,000 similarities, the server 200 provides the second content being displayed on the second terminal. Twelfth notification information indicating that the second website corresponding to the included second link information is not a harmful site is transmitted to the second terminal (S670).

Thereafter, the terminal 100 responds to the previously transmitted link information to indicate that the website corresponding to the link information included in the content transmitted from the server 200 and displayed on the terminal 100 is not a harmful site. Receive other guidance information indicating

In addition, while content including the corresponding link information is being displayed, the terminal 100 displays other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. (or output). At this time, the terminal 100 may display other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the corresponding link information in the form of a pop-up or a speech bubble. In addition, while the content including the corresponding link information is being displayed, the terminal 100 responds to other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information. emoticon (or icon/AR emoticon/AR icon) may be displayed.

In addition, in order to access a website corresponding to the corresponding link information, when the link information included in the content being displayed on the terminal 100 is selected, the terminal 100 is directed to the website corresponding to the corresponding link information. connect At this time, the terminal 100 may access the website corresponding to the link information through the mediation of the server 200 for safe access.

For example, the second terminal receives twelfth notification information transmitted from the server 200 in response to previously transmitted second link information.

In addition, as shown in FIG. 8, the second terminal corresponds to the received second link information on one side of the corresponding second link information while the second content including the second link information is being displayed. A preset safety emoticon 810 is displayed in response to the twelfth notification information indicating that the second web site is not a harmful site. At this time, as shown in FIG. 8, the second terminal displays the second link information 820 to which the 'a tag' in the HTML language is applied according to the hyperlink function (S680).

As described above, in the embodiment of the present invention, when content including a URL address is displayed on the terminal, the server determines the corresponding site based on information about a specific site corresponding to the URL address included in the corresponding content provided from the terminal. When a screen of a specific site is acquired and the previously acquired screen of a specific site is included among a plurality of screens included in the pre-stored blacklist, access to the specific site from the terminal is blocked or whether the URL address is harmful or not is determined. It provides real-time information on whether or not the URL address displayed on the terminal is harmful, prevents users from accessing harmful sites without being aware of it, and thereby prevents leakage of personal information of users. can

In addition, as described above, in an embodiment of the present invention, when content including a URL address is displayed in a terminal, the server based on information about a specific site corresponding to the URL address included in the corresponding content provided from the terminal. Collects XML data related to the specific site, and blocks access to the specific site from the terminal if XML data related to the specific site obtained earlier is included among a plurality of XML data included in the pre-stored blacklist. It is possible to prevent a user from being exposed to dangerous information by providing information on whether a URL address is harmful or not.

The foregoing may be modified and modified by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

10: harmful site blocking system 100: terminal
200: server

Claims (10)

The terminal for transmitting the link information when link information is included in content displayed on the terminal; and
Accessing the website corresponding to the link information transmitted from the terminal, obtaining a screen of the website, and determining whether the screen of the obtained website is included in a blacklist including a plurality of harmful screens previously stored in the server. and, as a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the server, the link information included in the content displayed on the terminal And the server for transmitting guide information indicating that the corresponding website is a harmful site to the terminal,
The terminal,
Guide information transmitted from the server is received, and while content including the link information is being displayed on the terminal, a guide indicating that a website corresponding to the received link information is a harmful site is displayed on one side of the link information. A harmful site blocking system comprising the server performing a function characterized by displaying information. According to claim 1,
The server,
At least one of the acquired color in the screen of the website, the position or size of one or more objects, and text in the screen of the website through a character recognition function is checked, and the color and one or more objects in the screen of the identified website are checked. Harmful site blocking system, characterized in that for determining whether at least one of the position, size and text of is similar to at least one of a color, a position, size and text of one or more objects in a plurality of harmful screens included in the blacklist. . transmitting, by the terminal, link information to a server when link information is included in content displayed on the terminal;
accessing, by the server, a web site corresponding to the link information transmitted from the terminal, and obtaining a screen of the web site;
determining, by the server, whether the screen of the obtained web site is included in a blacklist including a plurality of harmful screens previously stored in the server;
As a result of the determination, when the screen of the obtained web site is included in the blacklist including a plurality of harmful screens previously stored in the server, the link information included in the content displayed on the terminal by the server transmitting guide information indicating that the web site corresponding to is a harmful site to the terminal;
Receiving, by the terminal, guide information transmitted from the server; and
displaying, by the terminal, guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while the terminal is displaying content including the link information; How to block harmful sites, including. According to claim 3,
The step of determining whether or not the screen of the obtained web site is included in the blacklist,
calculating a plurality of similarities between a plurality of harmful screens included in the blacklist and the acquired web site screens, respectively; and
and determining whether one or more similarities greater than or equal to a preset reference value exist among the calculated plurality of similarities. According to claim 3,
The step of determining whether or not the screen of the obtained web site is included in the blacklist,
checking at least one of a color in the screen of the acquired web site, a position or size of one or more objects, and text in the screen of the web site through a text recognition function; and
At least one of color, position or size, and text of one or more objects in the screen of the identified website is similar to at least one of color, position or size, and text of one or more objects in a plurality of harmful screens included in the blacklist. A method for blocking harmful sites, comprising a process of determining whether According to claim 3,
Displaying guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while content including the link information is being displayed,
A method for blocking harmful sites, characterized in that the link information being displayed on the terminal is converted into a plain-text form and displayed. According to claim 3,
As a result of the determination, when the screen of the obtained web site is not included in the blacklist including a plurality of harmful screens previously stored in the server, the link included in the content displayed on the terminal by the server transmitting other guide information indicating that the web site corresponding to the information is not a harmful site to the terminal;
receiving, by the terminal, other guide information transmitted from the server; and
While the content including the link information is being displayed by the terminal, other guide information indicating that the website corresponding to the received link information is not a harmful site is displayed on one side of the link information. Harmful site blocking method characterized in that it further comprises the step of. The terminal for transmitting the link information when link information is included in content displayed on the terminal; and
It accesses a website corresponding to the link information transmitted from the terminal, collects XML data related to the website, and collects XML related to the collected website from a blacklist including a plurality of harmful XML data previously stored in the server. It determines whether data is included, and as a result of the determination, when XML data related to the collected website is not included in the blacklist including a plurality of harmful XML data previously stored in the server, it is displayed on the terminal. And the server for transmitting to the terminal other guide information indicating that the web site corresponding to the link information included in the content to be is not a harmful site,
The terminal,
In a state in which other guide information transmitted from the server is received and the content including the link information is being displayed on the terminal, the website corresponding to the received link information is not a harmful site on one side of the link information. A harmful site blocking system comprising the server performing a function characterized in that for displaying an emoticon corresponding to other guidance information indicating. transmitting, by the terminal, link information to a server when link information is included in content displayed on the terminal;
accessing, by the server, a web site corresponding to the link information transmitted from the terminal, and collecting XML data related to the web site;
determining, by the server, whether XML data related to the collected web site is included in a blacklist including a plurality of harmful XML data previously stored in the server;
As a result of the determination, when the XML data related to the collected website is not included in the blacklist including a plurality of harmful XML data previously stored in the server, the server includes it in the content displayed on the terminal. transmitting, to the terminal, other guide information indicating that the web site corresponding to the linked link information is not a harmful site;
receiving, by the terminal, other guide information transmitted from the server; and
Corresponds to other guide information indicating that the website corresponding to the received link information is not a harmful site on one side of the link information while the terminal is displaying the content including the link information in the terminal. A method of blocking harmful sites, including the step of displaying an emoticon that says. According to claim 9,
As a result of the determination, when the XML data related to the collected web site is included in the blacklist including a plurality of harmful XML data previously stored in the server, the content displayed on the terminal is included by the server. transmitting guide information indicating that the web site corresponding to the link information is a harmful site to the terminal;
Receiving, by the terminal, guide information transmitted from the server; and
displaying, by the terminal, guide information indicating that a website corresponding to the received link information is a harmful site on one side of the link information while the terminal is displaying content including the link information; A method for blocking harmful sites, further comprising:

Images