KR20230073542A - System and method for detecting online living crime capable of risk assessment - Google Patents

Abstract

An online life crime detection method according to an embodiment of the present invention includes the steps of, by an online life crime detection system, collecting target data for early detection of online life crime; b) inputting the collected target data into a suspected illegality discrimination model and outputting suspected illegal data classified according to analysis criteria for each crime type; c) inputting suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and receiving an output risk; and d) performing crime prevention measures, response measures, and warning measures based on the risk level.

Description

Online life crime detection system and method capable of risk assessment {SYSTEM AND METHOD FOR DETECTING ONLINE LIVING CRIME CAPABLE OF RISK ASSESSMENT}

The present invention relates to an online life crime detection system and method capable of risk assessment.

As users can use the Internet anytime, anywhere due to the development of high-speed Internet networks, users can obtain information by accessing portal sites or view news and movies.

However, due to the increase in Internet use, damage caused by Internet use is also increasing. Because anyone can access online regardless of gender and age, and data posted by netizens is posted as it is without any filtering, posting adult advertisements that are harmful to teenagers can be harmful to the mental health of teenagers. In addition, there is a problem in that it is difficult to achieve the original purpose of operating a discussion space on a web page if many advertisement articles are posted in a space where netizens discuss their thoughts with each other.

In addition, life crimes online are also increasing. Life crime refers to minor criminal crimes such as bicycle theft that are frequently encountered in daily life, and life crimes such as gambling, loan fraud, part-time job fraud, illegal pyramids, and phishing scams that are frequently encountered in daily life are gradually increasing on the Internet. are doing

Conventionally, in order to prevent such cybercrime, when netizens press the "report" button, it is reported to the web page manager, and measures are taken to prevent such cybercrime-related articles from being posted on the webpage. In addition, the web page manager can protect netizens from spam data by checking whether the data registered by netizens is an article that can be related to crime and then deleting it.

However, this method poses a problem that it is not easy to check the entire data registered in real time, and it requires a lot of cost to recruit personnel accordingly. In addition, while posting articles on web pages is becoming common, many articles related to false advertisements and adult advertisements are also posted, which adversely affects the establishment of a healthy Internet culture.

Accordingly, there is a demand for the development of an algorithm that can detect and prevent increasingly increasing cyber life crimes in advance, and in the present invention, a system and method capable of early detecting and responding to online life crimes suggests

An embodiment of the present invention collects online data and analyzes it based on deep learning to output suspected illegal data classified according to the analysis criteria for each crime type based on deep learning. An object of the present invention is to provide an online life crime detection system and method capable of outputting the risk level of suspected illegal data and taking crime preventive measures, countermeasures, and warning measures based on the output risk level.

On the other hand, the technical problems to be achieved in the present invention are not limited to the above-mentioned technical problems, and other technical problems that are not mentioned will become clear to those skilled in the art from the description below. You will be able to understand.

An online life crime detection method according to an embodiment of the present invention includes the steps of, by an online life crime detection system, collecting target data for early detection of online life crime; b) inputting the collected target data into a suspected illegality discrimination model and outputting suspected illegal data classified according to analysis criteria for each crime type; c) inputting suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and receiving an output risk; and d) performing crime prevention measures, response measures, and warning measures based on the risk level.

Step a) may be a step of receiving target data from a search portal, blog, employment information site, part-time job information site, used trading site, SNS, text message, comment, damage report information, and URL address through data crawling.

Step b) may include: b-1) extracting a first keyword by natural language processing of text data included in the target data; b-2) extracting a first keyword by applying an OCR model to image data included in the target data; b-3) inputting the first keyword and the second keyword to a suspected illegality determination model, and outputting suspected illegality data classified according to analysis criteria for each crime type.

The illegal suspicion determination model: classifies the target data by crime type based on the first keyword and the second keyword; classifying target data classified by crime type according to analysis criteria for each crime type; It may be configured to analyze the target data classified according to the crime type and the analysis criteria for each crime type to determine whether the target data is suspected illegal data.

The crime type may include at least one of a smishing type, a loan type, a multi-level type, a used transaction fraud type, and a part-time job fraud type.

The analysis criterion for each crime type includes: when the crime type is a smishing type, at least one of a crime technique, a crime victim type, and whether a personal phone book is stored; If the crime type is a loan type or a multi-level type, at least one of company name, business number, business address, homepage address, whether or not a KakaoTalk chat room inducement link is included, and whether or not a preset hashtag is included; If the above type of crime is second-hand transaction fraud, product name, selling price, whether or not to induce an external app, whether or not the content of the text is in image format, post title, whether to verify identity, whether to verify the seller, and whether to search on second-hand transaction fraud history sites includes at least one; If the crime type is a part-time job fraud type, it may include at least one of recruiting conditions, working conditions, recruiter information, application method information, and company information.

The risk calculation model may include: if the crime type is a smishing type, set a risk level of target data that induces installation of a specific app through a URL link to be relatively higher than risk levels of other target data; When the crime type is a loan type or a multi-level type, setting a risk level of target data including a plurality of preset hash tags higher than a risk degree of target data including only one hash tag; If the crime type is a second-hand transaction fraud type, setting the risk level of target data in which the price of a specific item is less than a predetermined ratio to the average value on a specific second-hand trading site is relatively higher than the risk level of other target data; If the crime type is a part-time job fraud type, the risk level of target data described as exceeding a predetermined ratio over the average wage in a specific part-time job information site is set to be relatively higher than the risk level of other target data. It can be.

Step d) includes: d-1) providing the suspected illegal data to relevant agencies for each online life crime by a related agency report unit; d-2) providing a damage report procedure to the user by the damage report procedure providing unit; d-3) providing a complaint or a method for preparing a complaint to the user by the complaint providing unit, or acting as a proxy for the preparation; d-4) providing the URL address to the relevant agency for each online life crime by the related agency report unit; and d-5) transmitting a warning message to the user.

The illegal suspicion determination model includes: first learning data input from a user; Second learning data received from public data through an open API; Third learning data that is data determined as illegal suspicious data by the illegal suspicious determination model; And it is configured to learn through at least one of fourth learning data that is data disclosed on a specific site, and to perform learning by assigning different weights to each of the first to fourth learning data.

An online life crime detection system according to an embodiment of the present invention includes a target data collection module for collecting target data for early detection of online life crimes; an illegal suspicious data discrimination module that inputs the collected target data into a suspected illegality discrimination model and outputs suspected illegal data classified according to analysis criteria for each crime type; a risk calculation module that inputs suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and receives an output risk; and a crime response module for performing crime prevention measures, response measures, and warning measures based on the risk level.

An online life crime detection system and method according to an embodiment of the present invention collects online data, analyzes it based on deep learning, outputs suspected illegal data classified according to analysis criteria for each crime type, and based on deep learning It outputs the risk level of suspected illegal data classified according to the analysis criteria for each crime type, and can perform crime prevention measures, countermeasures, and warning measures based on the output risk level.

On the other hand, the effects obtainable in the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below. You will be able to.

1 is a diagram schematically showing each component of an online life crime detection system 10 .
2 is a schematic diagram showing an online life crime detection method (S10).
3 is a flowchart illustrating an online life crime detection method (S10).
4 is a flowchart illustrating step S100 performed by the target data collection module 100 in more detail.
5 is a flowchart illustrating step S200 performed by the suspicious illegal data determination module 200 in more detail.
6 is a diagram schematically illustrating each configuration of the second keyword extraction unit 220 .
7 is a flowchart illustrating step S220 performed by the second keyword extraction unit 220 in more detail.
8 is a method for extracting a second keyword in step S220 by the phoneme unit text extraction unit 221, the language type determination unit 222, the combined text generation unit 223, and the second keyword extraction unit 224 of FIG. This is an example of what it looks like.
FIG. 9 is S220 by the phoneme unit text extraction unit 221, the language type determination unit 222, the combined text generation unit 223, the second keyword extraction unit 224, and the recombinant text generation unit 225 of FIG. 6 It is an exemplary diagram showing how to extract the second keyword in the step.
10 is a flowchart illustrating step S400 performed by the crime response module 400 in more detail.

Other advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms, but only the present embodiments make the disclosure of the present invention complete, and the common knowledge in the art to which the present invention belongs It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Even if not defined, all terms (including technical or scientific terms) used herein have the same meaning as generally accepted by common technology in the prior art to which this invention belongs. Terms defined by general dictionaries may be interpreted to have the same meaning as they have in the related art and/or the text of the present application, and are not conceptualized or overly formalized, even if not expressly defined herein. won't

Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used in the specification, 'comprise' and/or various conjugations of this verb, such as 'comprise', 'comprising', 'comprising', 'comprising', etc., refer to a mentioned composition, ingredient, component, Steps, acts and/or elements do not preclude the presence or addition of one or more other compositions, ingredients, components, steps, acts and/or elements.

In this specification, the term 'and/or' refers to each of the listed elements or various combinations thereof. Meanwhile, terms such as '~unit', '~group', '~block', and '~module' used throughout this specification may mean a unit that processes at least one function or operation. For example, it can mean software, hardware components such as FPGAs or ASICs. However, '~ unit', '~ group', '~ block', '~ module', etc. are not meant to be limited to software or hardware. '~unit', '~group', '~block', '~module' may be configured to be in an addressable storage medium or configured to reproduce one or more processors. Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings of this specification.

1 is a diagram schematically showing each component of an online life crime detection system 10 .

2 is a schematic diagram showing an online life crime detection method (S10).

3 is a flowchart illustrating an online life crime detection method (S10).

1 to 3, the online life crime detection system 10 includes a target data collection module 100, an illegal suspicious data determination module 200, a risk calculation module 300, and a crime response module 400. do.

The data collection module 100 is configured to collect target data for early detection of online life crimes. The suspected illegal data discrimination module 200 is configured to input the collected target data to the suspected illegality discrimination model and receive output of suspected illegal data classified according to analysis criteria for each crime type. The risk calculation module 300 is configured to input suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and to receive an output risk. The crime response module 400 is configured to perform crime prevention measures, countermeasures, and warning measures based on the degree of risk.

The online life crime detection method (S10) includes the steps of collecting target data for early detection of online life crimes (S100), inputting the collected target data into an illegal suspicion determination model, and classifying suspected illegal activities according to analysis criteria for each crime type. Receiving data (S200), inputting suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model, and receiving risk output (S300), and crime prevention measures, countermeasures, and warning measures based on the risk level and performing (S400).

For example, the target data collection module 100 is used for smishing crimes such as leakage of personal information, impersonation of public institutions, illegal financial transactions, provision of monetary compensation for illegal financial transactions, impersonation of acquaintances, illegal loan crimes, illegal multi-level crimes, second-hand In order to perform early detection of online life crimes, including transaction fraud, illegal part-time jobs, part-time job fraud, gambling, or illegal pyramids, target data, which is content disclosed online, is input. The illegal suspicious data discrimination module 200 determines whether there is illegal suspicious data related to online life crime in the target data by applying an illegal suspicious discrimination model to the target content input by the target data collection module 100 . When it is determined that there is suspicious illegal data by the illegal suspicious data determination module 200, the risk calculation module 300 calculates illegal suspicious data. The crime response module 400 performs preventive measures, countermeasures, and warning measures corresponding to the calculated risk level.

4 is a flowchart illustrating step S100 performed by the target data collection module 100 in more detail.

Referring to FIG. 4 , step S100 includes receiving target data from open data 20 including search engines and SNS through data crawling (S110) and receiving target data from URL addresses through data crawling (S120). ) may be included.

More specifically, in step S110, data is crawled from contents disclosed in the open data 20 including search engines including Naver and Google, recruitment information sites, part-time job information sites, used trading sites, and SNS such as Facebook and Twitter. to receive target data for online life crime detection. In addition, articles posted online by the user 50 and comments posted thereon may also be crawled and used as target data.

In step S120, URL addresses as well as contents included in the open data 20 may be further crawled and inputted as target data for online crime detection. For example, not only online posts but also the text in URLs of those posts can be crawled.

5 is a flowchart illustrating step S200 performed by the suspicious illegal data determination module 200 in more detail.

Referring to FIG. 5 , step S200 is a step of extracting a first keyword by excluding special characters from text data included in target data by a first keyword extractor 210 and then processing natural language to extract a first keyword (S210); Extracting the second keyword by applying the OCR model to the image data included in the target data by the extraction unit 220 (S220) and the illegal suspicious data determination unit 230 determines whether the first keyword and the second keyword are illegal. It may include a step ( S230 ) of outputting suspected illegal data that is input into a suspicion determination model and classified according to analysis criteria for each crime type.

More specifically, in step S210 performed by the first keyword extractor 210, special characters are excluded from target data collected by the target data collection module 100. For example, special characters are characters such as @ or #. Next, target data from which special problems are excluded is processed in natural language and extracted as a first keyword.

In step S220 performed by the second keyword extractor 220, a second keyword, which is text included in the image data, is extracted by applying an OCR model capable of extracting text data from image data.

In step S230 performed by the illegal suspicious data determination unit 230, the first keyword extracted in step S210 and the second keyword extracted in step S220 are input to the illegal suspicion determination model, and the suspected illegal data classified according to the analysis criteria for each crime type. is output.

The illegal suspicion discrimination model is configured to analyze target data through a deep learning model and determine whether or not it is illegal suspicious data based on the analysis results. At this time, the illegal suspicious data is, for example, gambling, loan fraud, This may include illegal pyramids and phishing scams.

The deep learning model used for the illegal suspicion discrimination model may include a BiLSTM-based deep learning model. However, it is not limited to this, and any deep learning model that can be applied without difficulty by a skilled person, including autoencoder, self-attention, etc., can be applied without limitation.

The illegal suspicion discrimination model classifies target data by crime type based on the first and second keywords, classifies the target data classified by crime type according to the analysis criteria for each crime type, and classifies the target data by crime type and crime type based on the first and second keywords. It may be configured to analyze target data classified according to an analysis criterion to determine whether the target data is suspected illegal data.

In this case, the crime type may include at least one of a smishing type, a loan type, a multi-level type, a used transaction fraud type, and a part-time job fraud type.

In addition, the analysis criteria may be different for each type of crime.

For example, when the crime type is the smishing type, the analysis criterion may include at least one of a crime technique, a crime damage type, and whether or not a personal phone book is stored.

In addition, if the crime type is a loan type or a multi-level type, the analysis criterion may include at least one of company name, business number, business address, homepage address, whether or not a KakaoTalk chat room inducement link is included, and whether or not a preset hashtag is included. there is.

In addition, if the crime type is the used transaction fraud type, the analysis criteria are the product name, selling price, whether or not to induce an external app, whether or not the content of the text is in image format, the post title, whether to verify the identity of the person, whether to verify the seller, and whether to use the used transaction fraud history. It may include at least one of whether to search for.

Also, when the crime type is a part-time job fraud type, the analysis criterion may include at least one of recruiting conditions, working conditions, recruiter information, reception method information, and company information.

The user 50 prepares first learning data in advance to train the deep learning model used in the suspected illegality discrimination model, and learns the deep learning model to be applied to the online life crime detection system 10 through this.

For learning of the deep learning model, in addition to the first learning data, second learning data received from the public data 30 through an open API may be additionally used. In more detail, a server of a public institution such as the National Police Agency or the Financial Supervisory Service may include data including companies and persons related to life crimes. Therefore, it is possible to improve the discrimination accuracy through the illegal suspicion discrimination model by additionally learning the second learning data included in the public data 30 through the open API to the deep learning model.

In addition, the suspected illegality discrimination model may also perform additional learning by using the data it has identified as suspected illegal data as third learning data.

In addition, the illegal suspicion discrimination model is a life crime among contents disclosed in open data (20) including search engines including Naver and Google, recruitment information sites, part-time job information sites, used trading sites, and SNS such as Facebook and Twitter. After culling only the contents disclosed in used transaction sites, employment information sites, part-time job information sites, loan company related sites, and multi-level related sites where '' is actually occurring a lot, additional learning can be performed using this as the fourth learning data.

In particular, the illegal suspicion discrimination model can be learned by assigning different weights to each of the first to fourth learning data, thereby focusing on reflecting data with a higher degree of fitness to learn the illegal suspicion discrimination model.

For example, the illegal suspicion discrimination model can be learned by assigning a weight to the fourth data in which many actual online life crimes occur, and thus learning can be performed through data with a higher degree of fitness.

In summary, in step S230 performed by the illegal suspicious data determination unit 230, the first keyword and the second keyword may be input to the illegal suspicious determination model, and illegal suspicious data classified according to the analysis criteria for each crime type may be output. can

6 is a diagram schematically illustrating each configuration of the second keyword extraction unit 220 .

7 is a flowchart illustrating step S220 performed by the second keyword extraction unit 220 in more detail.

6 and 7 , the second keyword extraction unit 220 includes a phoneme unit text extraction unit 221, a language type determination unit 222, a combined text generation unit 223, and a second keyword extraction unit 224 ) may be included.

Step S220 performed by the second keyword extractor 220 includes a step of extracting text in phoneme units by applying an OCR model to image data by the phoneme unit text extraction unit 221 (S221), a language type determination unit ( 222) to determine the language type of the text based on the text in phoneme units (S222), and the text in phoneme units in consideration of the handwriting direction in the language type determined in step S222 by the combined text generating unit 223 and generating combined text by combining (S223) and extracting the combined text as a second keyword by the second keyword extraction unit 224 (S224).

8 is a method for extracting a second keyword in step S220 by the phoneme unit text extraction unit 221, language type determination unit 222, combined text generation unit 223, and second keyword extraction unit 224 of FIG. This is an example of what it looks like.

Referring to FIG. 8 , as shown in FIG. 8 online, 'Doba' may be described in the first row and 'a' may be disclosed at the bottom of the 'bar' in the second row.

The phoneme-unit text extraction unit 221 extracts the phoneme-unit text from the text of FIG. 7, and as a result of the extraction, 'c, ㅗ, f, a, and a' may be extracted.

The language type determination unit 222 determines the type of the corresponding language based on each extracted phoneme, and may determine that it is Korean in the case of an example.

The combined text generation unit 223 combines the extracted phonemes to generate combined text. Since it is determined that the type of language is Korean, the text in units of phonemes is combined in consideration of the right and down handwriting directions, and as a result A combination text of 'gambling' may be generated. If the language determined by the language type determining unit 222 is a language written in the left direction, the combined text generating unit 223 may generate combined text by combining text in phoneme units in consideration of the corresponding direction. .

Finally, the second keyword extraction unit 224 may extract 'gambling', which is a combination test, as a second keyword.

Referring back to FIGS. 6 and 7 , the second keyword extraction unit 220 may further include a recombinant text generating unit 225, and step S220 is determined by the recombinant text generating unit 225 in step S222. When the similarity between the shape of the first phoneme in the first language, which is a language type, and the shape of the second phoneme in a second language, which is a different language type from the first language, exceeds a preset value, the second phoneme is selected as the first phoneme. It may further include generating recombinant text by replacing with (S225) and extracting the recombinant text as a second keyword by the second keyword extraction unit 224 (S226).

FIG. 9 is S220 by the phoneme unit text extraction unit 221, the language type determination unit 222, the combined text generation unit 223, the second keyword extraction unit 224, and the recombinant text generation unit 225 of FIG. 7 It is an exemplary diagram showing how to extract the second keyword in the step.

Referring to FIG. 9 , as shown in FIG. 8 online, 'Do ㅅr' may be described in the first row and 'ㄱ' may be disclosed at the bottom of 'ㅅr' in the second row. At this time, 'Doㅅ' in the first line and 'ㄱ' in the second line are Korean characters, and 'r' in the first line is a lowercase English alphabet.

The phoneme-unit text extraction unit 221 extracts the phoneme-unit text from the text of FIG. 8 , and the extraction result 'c, ㅗ, f, r, and a' may be extracted.

The language type determination unit 222 determines the type of the corresponding language based on each extracted phoneme. It can be determined that the 'c, ㅗ, f, and a' phonemes are Korean and the 'r' phoneme is English.

9 is different from FIG. 8 in that, in the case of FIG. 9 , the recombinant text generating unit 225 replaces 'r' with 'a' to generate recombinant text.

More specifically, the recombinant text generation unit 225 sets the language with the highest frequency among the language types of each phoneme determined by the language type determination unit 222 as the first language, and sets the next most frequent language as the second language. set to Therefore, in the case of FIG. 8 , Korean may be set as the first language and English may be set as the second language.

Thereafter, the similarity between the shape of each phoneme of the first language and the shape of each phoneme of the second language is compared to determine whether the similarity exceeds a preset value. For example, in the case of FIG. 8 , the similarity between the shape of the first phoneme 'a' of Korean, the first language, and the shape of the 'r' phoneme, the second phoneme of English, the second language, may exceed a preset value. In this case, the 'r' phoneme can be replaced with the 'ㄱ' phoneme.

If necessary, the user 50 may directly input judgment data for similarity comparison, and the recombinant text generation unit 225 may compare the similarity based on this.

Finally, the recombinant text may be extracted as a second keyword by the second keyword extraction unit 224 .

Referring back to FIG. 1 , step S200 includes setting the first and second keywords as suspicious keywords by the suspicious keyword setting unit 240 (S240), and The method may further include calculating related keywords (S250) and determining illegal suspicious data by applying a suspected illegality discrimination model to the suspicious keyword and related keywords by the illegal suspicious data determining unit 230 (S260).

In steps S210 to S230, it is determined whether the first keyword and the second keyword correspond to suspected illegal data by applying an illegal suspicion determination model.

Additionally, in steps S240 to S260, the illegal suspicion determination model can be applied not only to the first keyword and the second keyword but also to related keywords, which are related keywords.

In this case, the related keyword may be a keyword provided when a suspicious keyword is entered into a search engine.

For example, the suspicious keyword setting unit 240 may set 'Toto' as a suspicious keyword, and the related keyword calculation unit 250 may set 'toto' related search words such as 'exchange, charging, playground' as related keywords. can be calculated Therefore, the suspected illegal data determining unit 230 may additionally input 'exchange, charging, playground', etc. in addition to 'Toto' to the suspected illegal data determination model to determine whether or not the suspected illegal data exists.

Referring back to FIGS. 1 to 3 , in step S10 , the step S300 of inputting suspected illegal data classified by the risk calculation module 300 according to the analysis criteria for each crime type into the risk calculation model and outputting the risk degree (S300) is further performed. can include

In step S300, suspected illegal data classified according to the analysis criteria for each crime type output in step S200 by the risk calculation module 300 may be input to a risk calculation model, and a risk may be output from the risk calculation model.

The risk calculation model is configured to analyze suspected illegal data through a deep learning model and output a risk based on the analysis result.

The deep learning model used for the risk calculation model may include a BiLSTM-based deep learning model. However, it is not limited to this, and any deep learning model that can be applied without difficulty by a skilled person, including autoencoder, self-attention, etc., can be applied without limitation.

More specifically, when the crime type is the smishing type, the risk calculation model may set the risk level of target data that induces installation of a specific app through a URL link to be relatively higher than the risk level of other target data.

For example, if there are two target data advertising a gambling site, if the specific target data contains a link to a URL that drives an app install, then the app may be an app operated by a gambling site, and thus a URL that drives an app install. The risk level of target data with links can be set relatively higher than the risk level of other target data.

In addition, when the crime type is a loan type or a multi-level type, the risk level of target data including a plurality of the predetermined hash tags may be set higher than the risk level of target data including only one hash tag.

For example, the risk analysis model can set the risk of the target data to be relatively higher than that of the target data containing only 'Toto' when the target data includes preset hashtags 'Toto' and 'Exchange'. .

In addition, if the crime type is a second-hand transaction fraud type, the risk of target data described as having a price of a specific item less than a predetermined ratio than the average value on a specific second-hand trading site can be set relatively higher than the risk of other target data. .

For example, in the risk analysis model, if the content described in the target data is that a specific model speaker is sold at 50,000 won, but the average price of the model is 100,000 won and the preset ratio is 80%, the speaker is at an average price of 100,000 won. Since it is sold at a lower price than 80%, which is 80,000 won, the risk level of the target data with the corresponding content can be set relatively higher than the risk level of other target data.

In addition, if the crime type is a part-time job fraud type, the risk level of target data described as exceeding a predetermined ratio over the average wage in a specific part-time job information site can be set relatively higher than the risk level of other target data. there is.

For example, in the risk analysis model, if the content described in the target data introduces a model part-time job with an hourly wage of 100,000 won, and the average hourly wage of the model part-time job is 50,000 won on average and the preset ratio is 20%, the model part-time job with an hourly wage of 100,000 won Since the average hourly wage exceeds 10,000 won, which is 20% of the average hourly wage of 50,000 won, the risk level of the target data with the contents can be set relatively higher than the risk level of other target data.

10 is a flowchart illustrating step S400 performed by the crime response module 400 in more detail.

Referring to FIG. 10, step S400 may include a step (S410) of providing suspected illegal data to the related agency 40 for each online life crime by the related agency reporting unit 410, and the related agency reporting unit 410 A step (S440) of providing the URL address to the relevant agency 40 for each online life crime may be further included.

In addition, along with data suspected of being illegal, information on damage received by the user 50 may also be provided. In this case, the related institutions 40 may include all public institutions related to online life crimes, such as the National Police Agency, the Financial Supervisory Service, the Fair Trade Commission, and the Korea Communications Standards Commission.

Step S400 may further include providing a damage report procedure to the user 50 by the damage report procedure providing unit 420 (S420).

For example, the damage report procedure providing unit 420 may guide the damage report procedure, recommend an expert or lawyer related to the damage, or guide how to receive advice from the expert or lawyer.

Step S400 may further include a step (S430) of providing a petition or a method of writing a complaint to the user 50 by the complaint providing unit 430, or acting as a writing agent.

For example, if the user 50 has suffered damage, guide the method of directly writing a complaint or complaint, or if the user delivers the fact of damage to the complaint providing unit 430, receive it and write a complaint or complaint based on this. It can be provided to the user 50.

Step S400 may further include transmitting a warning message to the user 50 through the warning message transmission unit 440 (S450).

For example, the warning phrase transmission unit 440 may transmit different warning phrases to the user 50 according to which section of the risk level preset section corresponds to.

More specifically, the preset section may be a normal section, a caution section, a warning section, and a danger section, and the lowest risk may belong to the normal section and the highest risk may belong to the danger section.

Although the present invention has been described through examples above, the above examples are only for explaining the idea of the present invention and are not limited thereto. Those skilled in the art will understand that various modifications can be made to the above-described embodiments. The scope of the present invention is defined only through the interpretation of the appended claims.

10 Online life crime detection system
20 open data
30 public data
40 Relevant institutions
50 users
100 target data collection module
200 Illegal Suspicious Data Discrimination Module
210 First keyword extraction unit
220 Second keyword extraction unit
221 phoneme unit text extraction unit
222 language type judgment unit
223 Combination Text Generation Unit
224 second keyword extraction unit
225 Recombinant Text Generation Unit
230 Illegal Suspicious Data Discrimination Department
240 Suspicious keyword setting unit
250 Related keyword calculation unit
300 risk calculation module
400 Crime Response Module
410 Relevant Agency Notification Department
420 Damage Reporting Procedures Department
430 Collection Department
440 warning message transmission unit

Claims (10)

online life crime detection system,
a) Collecting target data for early detection of crimes in online life;
b) inputting the collected target data into a suspected illegality discrimination model and outputting suspected illegal data classified according to analysis criteria for each crime type;
c) inputting suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and receiving an output risk; and
d) a method for detecting online life crimes, comprising performing crime prevention measures, countermeasures, and warning measures based on the risk level.
According to claim 1,
Step a) is:
Online life crime detection method, which is a step of receiving target data from search portals, blogs, recruitment information sites, part-time job information sites, used trading sites, SNS, text messages, comments, damage report information, and URL addresses through data crawling.
According to claim 2,
Step b) is:
b-1) processing the target data in natural language or extracting keywords after applying an OCR model to the target data; and
b-2) A method for detecting online life crimes, including the step of inputting the keyword into a suspected illegality determination model and outputting suspected illegal data classified according to analysis criteria for each crime type.
According to claim 3,
The illegal suspicion determination model is:
classifying the target data by crime type based on the keyword;
classifying target data classified by crime type according to analysis criteria for each crime type;
The online life crime detection method configured to analyze the target data classified according to the crime type and the analysis criterion for each crime type to determine whether the target data is suspected illegal data.
According to claim 4,
The crime types are:
A method for detecting online life crimes including at least one of a smishing type, a loan type, a multi-level type, a used transaction fraud type, and a part-time job fraud type.
According to claim 5,
The analysis criteria for each type of crime are as follows:
if the crime type is a smishing type, includes at least one of a crime technique, a crime damage type, and whether or not a personal phone book is stored;
If the crime type is a loan type or a multi-level type, at least one of company name, business number, business address, homepage address, whether or not a KakaoTalk chat room inducement link is included, and whether or not a preset hashtag is included;
If the above type of crime is second-hand transaction fraud, product name, selling price, whether or not to induce an external app, whether or not the content of the text is in image format, post title, whether to verify identity, whether to verify the seller, and whether to search on second-hand transaction fraud history sites includes at least one;
If the crime type is a part-time job fraud type, the online life crime detection method includes at least one of recruitment conditions, working conditions, recruiter information, application method information, and company information.
According to claim 6,
The risk calculation model is:
When the crime type is a smishing type, setting a risk level of target data that induces installation of a specific app through a URL link to be relatively higher than a risk level of other target data;
When the crime type is a loan type or a multi-level type, setting a risk level of target data including a plurality of preset hash tags higher than a risk degree of target data including only one hash tag;
If the crime type is a second-hand transaction fraud type, setting the risk level of target data in which the price of a specific item is less than a predetermined ratio to the average value on a specific second-hand trading site is relatively higher than the risk level of other target data;
If the crime type is a part-time job fraud type, the risk level of target data described as exceeding a predetermined ratio over the average wage in a specific part-time job information site is set to be relatively higher than the risk level of other target data. How to detect online life crime.
According to claim 7,
Step d) is:
d-1) providing the suspected illegal data to relevant agencies for each online life crime by a related agency report unit;
d-2) providing a damage report procedure to the user by the damage report procedure providing unit;
d-3) providing a complaint or a method for preparing a complaint to the user by the complaint providing unit, or acting on behalf of the preparation;
d-4) providing the URL address to the relevant agency for each online life crime by the related agency report unit; and
d-5) A method for detecting online life crimes, including sending a warning message to a user.
According to claim 8,
The illegal suspicion determination model is:
First learning data input from a user;
Second learning data received from public data through an open API;
Third learning data that is data determined as illegal suspicious data by the illegal suspicious determination model; and
It is configured to learn through at least one of the fourth learning data, which is data disclosed on a specific site,
The online life crime detection method configured to perform learning by assigning different weights to each of the first to fourth learning data.
a target data collection module for collecting target data for early online life crime detection;
an illegal suspicious data discrimination module that inputs the collected target data into a suspected illegality discrimination model and outputs suspected illegal data classified according to analysis criteria for each crime type;
a risk calculation module that inputs suspected illegal data classified according to the analysis criteria for each crime type into a risk calculation model and receives an output risk; and
An online life crime detection system including a crime response module that performs crime prevention measures, response measures, and warning measures based on the risk level.

Images