KR20230109038A - Method of automatically detecting harmful media, and System there-for - Google Patents

Abstract

The automatic harmful media detection system of the present invention provides a report page to the user, receives a report of a victim media file or URL from the user through the report page, and extracts a media link from the URL to download the media file if the target of the report is a URL. , A reporting web server that extracts video identification data (VID) from the downloaded media file, and extracts the VID from the media file when the reporting target is a media file, receives the VID from the reporting web server and stores it in an API database, , The VID is transmitted to the Korea Communications Standards Commission server, and the report result is received from the Korea Communications Standards Commission server and transmitted to the report web server, so that the user accesses the report web server result page and confirms the report result. API server that allows investigators to extract the VID from the media collected, compare the extracted media VID with the storage media VID stored in the database of the API server, calculate the similarity between the two media, and media with high similarity It includes a media similarity comparator that groups objects to create similar media groups, and a harmful media crawler that automatically collects harmful media, extracts VIDs from the collected harmful media, and stores them in the database of the API server.

Description

Method of automatically detecting harmful media and its system {Method of automatically detecting harmful media, and System there-for}

The present invention relates to a service method and system for automatically detecting, reporting, and deleting damaged media or harmful media due to digital sex crimes.

Illegal filming and distribution of sex crime videos, which account for most of the digital sex crimes, have a great impact on the continuation of the damage. Currently, there are two ways to delete videos: through government support projects and through digital funeral service companies, but both methods have problems in that you have to disclose your identity and report it, and that the institution has possession of the damaged videos.

In addition, since digital funeral home companies have the potential for data leakage and criminal involvement, the psychological barrier for victims to report is high.

In addition, due to the nature of a digital file called a video, it is easy to distribute it through various pornography distribution sites or messengers. It is necessary to check numerous pornography distribution sites one by one until the fact of damage is confirmed, and reporting each of them causes a problem of continuous exposure to the fact of damage, so there is a need to find a better way.

Due to the nature of digital files, different artifacts are created depending on the recording device and transmission method. In particular, messenger platforms where digital sex crimes occur or victim images are distributed have their own artifacts, so it is possible to analyze and track the distribution process, but research related to this is not actively conducted.

When searching the digital sex crime suspect's PC to find victim media files, investigators are currently using a hash-based 'illegal footage tracking system'. It is a structure that compares the hash set of obscene videos and the collected media files to identify them, but since most domestic pornography sites are tampered with, such as inserting advertisements in the video, it cannot be detected with hash-based collation. . In addition, there are insufficient devices to protect the mental shock in the process of checking the media by the investigator.

In this way, in the past, only when there is no significant change between the comparison target and the original, it is determined that it is the same harmful image. However, if there is a resize (reduced or enlarged image size) image and an advertisement (advertisement video inserted) image, it cannot be determined or it is determined that the image is different.

In fact, in the National Police Agency, it is the same harmful video, but if it is resized (reduced) or if noise or advertisements are inserted, it cannot be identified or the reading ability is poor, so the investigator directly judges it with the naked eye. In this case, since it must be visually determined, it is inefficient and there is a possibility of secondary damage.

The technical problem to be achieved by the present invention is to provide a service method and system capable of automatically detecting victim media due to digital sex crimes by increasing discriminative power even when the comparison target is different from the original.

According to an embodiment of the present invention, a report page is provided to the user, a victim media file or URL is reported from the user through the report page, and when the target of the report is a URL, a media link is extracted from the URL to download the media file , A reporting web server that extracts video identification data (VID) from the downloaded media file, and extracts the VID from the media file when the reporting target is a media file; By receiving the VID from the reporting web server, storing it in an API database, transmitting the VID to the Broadcasting and Communications Standards Commission server, and receiving the report result from the Korea Communications Standards Commission server and transmitting it to the reporting web server, the user an API server that allows the user to access the result page of the report web server and check the report result; The VID is extracted from the media verified by the investigator, and the extracted media VID is compared with the storage media VID stored in the database of the API server to calculate the similarity between the two media, and media with high similarity are grouped to obtain similar media. a media similarity comparator that creates groups; and a harmful media crawler that automatically collects harmful media, extracts a VID from the collected harmful media, and stores it in a database of the API server.

According to an embodiment of the present invention, providing a report page to a user and receiving a report of a damaged media file or URL from the user through the report page; If the report target received from the user is a URL, the media link is extracted from the URL to download the media file, video identification data (hereinafter referred to as VID) is extracted from the downloaded media file, and if the report target is a media file, the above extracting a VID from a media file and deleting the media file; The VID is received from the reporting web server, stored in the database, the VID is transmitted to the reporting agency server, and the reporting result is received from the reporting agency server and transmitted to the reporting web server, so that the user can access the reporting web server. Accessing the result page of the report so that the report result can be checked; extracting a VID from the collected media, comparing the extracted media VID with a media VID stored in the database, and calculating a similarity between the two media; Deleting the collection media; generating a similar media group by grouping media having a high similarity using the calculated similarity; and automatically collecting harmful media, extracting a VID from the collected harmful media, and storing the extracted VID in the database. and deleting the collected harmful media.

According to the present invention, since the VID is extracted and stored, rather than the original media (video) of the victim, the risk of leakage and collection is low, and the victim's personal information can be protected for the above reasons.

In addition, when calculating the similarity between media, multi-dimensional similarity is evaluated through a multilateral similarity test (sound source + image + ratio, etc.) for the entire media. Accordingly, a separate analysis by the victim or the investigator is not required, and only media with a similarity level (eg, 90%) or higher can be automatically reported.

In addition, since the investigator does not have to directly watch the media, psychological trauma or secondary harm can be prevented.

In addition to the investigator, the reporter can also check the current status in real time, and it is possible to compare the similarity of the altered (resize, advertisement) video. The screening time for the same image is reduced, and the accuracy of similarity discrimination is improved. Since the original video is not needed after VID extraction, only a minimal DB is required.

1 is a diagram illustrating an automatic harmful media detection system according to an embodiment of the present invention.
2 is a flowchart illustrating the operation of a reporting web server according to an embodiment of the present invention.
3 is a flowchart for explaining the operation of a media similarity comparator according to an embodiment of the present invention.
4 is a flowchart for explaining the operation of a harmful media crawler according to an embodiment of the present invention.

Specific structural or functional descriptions of the embodiments according to the concept of the present invention disclosed in this specification are only illustrated for the purpose of explaining the embodiments according to the concept of the present invention, and the embodiment according to the concept of the present invention These may be embodied in various forms and are not limited to the embodiments described herein.

Embodiments according to the concept of the present invention can apply various changes and can have various forms, so the embodiments are illustrated in the drawings and described in detail in this specification. However, this is not intended to limit the embodiments according to the concept of the present invention to specific disclosed forms, and includes all modifications, equivalents, or substitutes included in the spirit and scope of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. Prior to this, the terms or words used in this specification and claims should not be construed as limited to ordinary or dictionary meanings, but should be interpreted as meanings and concepts consistent with the technical spirit of the present invention.

1 is a diagram illustrating an automatic harmful media detection system according to an embodiment of the present invention. Harmful media mainly means digital sex crime victim media, but can be used to encompass media such as videos and photos that are related to crime or are harmful to the general public.

Hereinafter, a system and method for automatically detecting and reporting digital sex crime victim media will be described as an example, but it is not limited to digital sex crime victim media.

Referring to FIG. 1, the automatic harmful media detection system includes a reporting web server 10, a media similarity comparator 20, an API server 30, and a harmful media crawler 40.

The report web server 10 is a server that provides a website for victims of digital sex crimes to report and receive digital sex crimes, and allows users to simply enter URLs or attach media files to digital sex crimes media (videos, photos, etc.) ) is configured to enable tracking requests and reports.

The reporting web server 10 tracks the site link where a video similar to the damage details was uploaded when a digital sex crime damage details are received, so that automatic reporting can be made to the reporting agency (eg, Korea Communications Standards Commission) 50 do.

2 is a flowchart illustrating the operation of the reporting web server 10 according to an embodiment of the present invention.

When a user (e.g., digital sex crime victim) finds a victim media file or URL, the user accesses the reporting site provided by the reporting web server 10 (S120), accesses the reporting page, and inputs the subject to report and report (S130). The reporting web server 10 determines whether the reporting target is a URL (S140), and if the reporting target is a URL, extracts a media link from the URL (S150), downloads a media file using the extracted media link, (S160), video identification data (VID) is extracted from the downloaded media file (S170). If the reporting target is not a URL but a media file, the VID is directly extracted from the media file without going through the above process (S170). After extracting the VID, the media files are deleted.

VID (Video Identification Data) is a data storage type for not performing hash-based video comparison, and is an abbreviation of Video Identification Data.

In one embodiment, the structure of the VID is shown in Table 1 below, but is not limited thereto.

Referring to Table 1, the structure of VID is the ID corresponding to the PRIMARY KEY of the database, the media type indicating whether the media is a picture, music, or video, and the width/length of the image or video. Ratio, music or video playback time (PlayTime), latitude, longitude, file creation date (CreatedTime), sound source in EXIF (exchangeable image file format) values Array of feature data for file (SoundData), array of frame feature data for image or video (FrameData), ID of similar sound source group (SoundGroupID), ID of similar frame group (FrameGroupID), first reported/crawled date (FirstCatchedData) , recently reported/crawled date (LastCatchedData), etc.

As described above, the VID structure is configured so that the original image is not stored and it is impossible to estimate the original image through the VID. However, since it is possible to compare similarities between media through VID comparison, it is suitable for comparing digital sex crime images that have the risk of harm and re-distribution.

In one embodiment, a dehash (Dhash) for a representative frame extracted through a scene segmentation algorithm is extracted from media (video or photo) only once, and the extracted dehash (Dhash) value is stored in FrameData of VID. .

The extracted Dhash value is a series of hashes that can be compared for each scene even though the original video cannot be derived, and similar values are obtained in the case of similar videos.

Conventional image comparison services store original image files or original video files for frame comparison to extract data for each comparison, whereas in this embodiment, Dhash values are used for VID FrameData to determine image similarity. It is concise and accurate, so it is possible to accurately determine similarity in a short time.

The reporting web server 10 transmits the extracted VID data to the reporting agency (eg, Korea Communications Standards Commission) 50 via the database 301 of the API server, and automatically reports it to the “Korea Communications Standards Commission”. do. The report agency 50 transmits the report result to the report web server 10 via the database 301 of the API server. Accordingly, after reporting, the user can access the result page of the reporting web server 10 (S180) and check the reporting result (S190).

Existing services have problems in that personal information must be disclosed when reporting damage, and that the institution must keep the video. However, according to an embodiment of the present invention, anonymous reporting is supported, and only VID, which is video pattern data of unknown origin, is extracted from the reported video, and then the reported video is automatically discarded (deleted). In addition, even if the victim does not directly search for and report the damaged images uploaded to various pornography sites, the harmful media crawler 40 searches for them and automatically reports them in connection. The crawler 40 always extracts the VID from the harmful media of the site for distributing pornography, and upon receipt of the report, compares the VID to be reported with the media VID of the pornography distribution site that has been collected so far, and automatically reports it to the reporting agency 50.

3 is a flowchart for explaining the operation of a media similarity comparator according to an embodiment of the present invention.

The media similarity comparator 30 may be implemented as a computer used by investigators or police officers and a media similarity program installed and driven in the computer.

The media similarity comparison program is a program for investigators and is configured to assist the investigation by performing analysis, timeline extraction, and visualization on the media collected by the investigator.

Referring to FIG. 3, the operation flow of the media similarity comparator is as follows.

The investigator collects and collects the damaged media (S210), and executes a media similarity comparison analysis program (S215). If the damage media collected by the investigator is a new case, a new case is created (S220), the VID of the collected media is extracted (S225), and the extracted VID is compared with the VID stored in the API server database. (S230). The extracted VID and comparison result data may be stored in the database 301 of the API server.

When the VID is extracted from the acquired media, the original media (ie, the acquired media) is deleted (discarded).

The similarity between the two media can be calculated by comparing the extracted VID with the VID stored in the database.

Also, a similar media group may be created by grouping media having a high similarity (S235). For example, a result file of a specific type (eg, .djj type) is generated through similar media grouping in which media of a criterion similarity (eg, 80%) or higher is set as a similar media group (S240). When the result file is created, the result file can be viewed (S250).

If the damage media collected by the investigator is not a new case, the case can be loaded (S245) and the resulting file can be viewed (S250).

The media similarity comparator 30 may assist the investigator in the investigation by providing the investigator with a case creation information screen (S255), a similarity comparison chart screen (S260), and a similarity group visualization screen (S270).

The investigator can view information about each case, such as case creation date, analysis time, case information, etc., through the case creation information screen, and check the similarity between two or more media through the similarity group visualization screen (S270). Node editing, file extraction, timeline confirmation, etc. can be performed through the similarity group visualization screen (S270).

Since the API server 30 initially does not hold crime site information, it stores a list of seed URLs for initial collection of victim media VIDs. The seed URL list includes VIDs of media extracted through the harmful media crawler 40 . Crawler targets for the seed URL list include at least one of domestic and foreign pornographic sites, illegal sites, Hidden Wiki sites, dark web advertising sites, and dark web search sites.

Harmful media crawler 400 automatically collects victim media from numerous servers and/or websites on a network using search engine robots.

The harmful media crawler 400 performs crawling on the seed URL list of the API server 30 to collect victim media and extracts a VID. The VID of the victim media extracted by the harmful media crawler 400 is transmitted to the API server 30 . After the VID is extracted from the damaged media, the damaged media is automatically deleted (discarded).

The harmful media crawler 400 initially crawls the list of seed URLs, collects internal/external links in the target website as the crawl progresses, and continuously updates the crawl target URL list.

4 is a flowchart for explaining the operation of the harmful media crawler 400 according to an embodiment of the present invention.

Referring to FIG. 4 , the harmful media crawler 400 loads harmful media URLs and keywords (S310) and starts crawling. When the harmful media crawler 400 initially operates, the harmful media URL list may be a seed URL list of the API server 30 .

It is determined whether there are URLs to be crawled (S320), and if there are URLs to be crawled, it is determined whether the corresponding URL is a media file (S325). If the URL is a media file, the media file is downloaded and the VID is extracted (S330 , S335) The extracted VID is transmitted to the API server (S340).

In step S325, if the URL is not a media file, it is determined whether a harmful keyword is included (S345), and if the URL is contained, it is checked whether the URL matches the registered regular expression (S350), A link suitable for is immediately registered in the crawling target list (S355).

Links that do not match the regular expression are added to the site depth index by 1 (S360), and if the site depth index is greater than or equal to a specific value (eg, 5), all links in the site are registered in the list to be crawled (S370).

In step S345, if the harmful keyword is not included, the harmful site index is deducted by 1 (S375), and if the harmful site index is less than a specific value (eg, 5), the process returns to step S320 to perform crawling targeting the next crawl URL. carry out

If the harmful site index is higher than a specific number (e.g., 5), it is checked whether the URL matches the registered regular expression (S350), and the link matching the regular expression is immediately registered in the list to be crawled (S355). Links that do not fit are added to the site depth index by 1 (S360), and if the site depth index is greater than or equal to a specific value (eg, 5), all links in the site are registered in the list to be crawled (S370).

If there is no URL to be crawled in step S320, the process returns to step S320 after being in an idle state for a specific period of time.

As described above, according to the embodiment of the present invention, since the present invention extracts and stores the VID, not the victim's original media (video), the risk of leakage and collection is small. For the above reasons, the victim's personal information can be protected.

In addition, when calculating the similarity between media, multi-dimensional similarity is evaluated through a multilateral similarity test (sound source + image + ratio, etc.) for the entire media. Accordingly, a separate analysis by the victim or the investigator is not required, and only media with a similarity level (eg, 90%) or higher can be automatically reported.

Unlike conventional techniques, since the investigator does not have to directly watch the media, psychological trauma or secondary harm can be prevented.

In addition, after the VID is extracted from the media, the media file is automatically deleted or discarded, and the media itself is not stored anywhere in the system, let alone the database. Also, it is impossible to recover the media from the VID. Accordingly, there is no risk of leakage of harmful media, and the risk of being exposed to harmful media by investigators, victims, and reporters is reduced.

In addition, unlike the conventional technology, the present invention can check the real-time status of the reporting person in addition to the investigator, and it is possible to compare the similarity of the altered (resize, advertisement) video. The screening time of the same image is reduced, and the accuracy of similarity determination is also improved. Since the original image is not needed after VID extraction, only a minimal DB is required.

Although the present invention has been described with reference to the embodiments shown in the drawings, this is only exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the attached claims.

10: Report web server
20: Media Similarity Comparator
30: API server
40: Harmful Media Crawler

Claims (6)

In the harmful media automatic detection system,
A report page is provided to the user, the user reports the damaged media file or URL through the report page, and if the target of the report is a URL, the media link is extracted from the URL to download the media file, and video identification data is obtained from the downloaded media file. A reporting web server that extracts (VID) and extracts the VID from the media file if the reporting target is a media file;
By receiving the VID from the reporting web server, storing it in the API database, transmitting the VID to the Korea Communications Standards Commission server, and receiving the report result from the Korea Communications Standards Commission server and transmitting it to the reporting web server, the user An API server that allows access to the result page of the virtual reporting web server and confirms the reporting result;
The investigator extracts the VID from the collected media, compares the extracted media VID with the storage media VID stored in the API server database, calculates the similarity between the two media, and groups the media with high similarity into a similar media group. a media similarity comparator that generates and
An automatic harmful media detection system including a harmful media crawler that automatically collects harmful media, extracts VIDs from the collected harmful media, and stores them in the database of the API server. According to claim 1,
The storage unit stores a list of seed URLs for initial collection of harmful media, and the harmful media crawler
Initially, crawling is performed targeting the seed URL, and the VID of the extracted harmful media is transmitted to the storage unit again. Harmful media automatic detection system characterized by updating. The method of claim 1, wherein the VID is
a media type (MediaType) indicating whether the harmful media is a picture, music, or video;
ratio information (Ratio) indicating the horizontal/vertical ratio of an image or video; Play time of music or video (PlayTime);
Characteristic data array for a sound source (SoundData); and
An automatic harmful media detection system comprising a frame feature data array (FrameData) for an image or video. In the harmful media automatic detection method,
Providing a report page to the user and receiving a report of the damaged media file or URL from the user through the report page;
If the report target received from the user is a URL, the media link is extracted from the URL to download the media file, video identification data (hereinafter referred to as VID) is extracted from the downloaded media file, and the report target is a media file extracting a VID from the media file and deleting the media file;
The VID is received from the reporting web server, stored in a database, the VID is transmitted to the reporting agency server, and the reporting result is received from the reporting agency server and transmitted to the reporting web server, so that the user can access the reporting web server. Accessing the result page of the report so that the report result can be checked;
extracting a VID from the collected media, comparing the extracted media VID with a media VID stored in the database, and calculating a similarity between the two media;
Deleting the collection media;
generating a similar media group by grouping media having a high similarity using the calculated similarity; and
automatically collecting harmful media, extracting VIDs from the collected harmful media, and storing them in the database; and
A method for automatically detecting harmful media, comprising deleting collected harmful media. According to claim 4,
storing a list of seed URLs for initial collection of harmful media;
Initially, crawling is performed on the seed URL list, and as the crawling progresses, internal and external links in the crawled website are collected to update the crawled URL list. Method for automatically detecting harmful media. According to claim 4,
The method of automatically detecting harmful media further comprising the step of automatically reporting by transmitting the VID of the collected media to the reporting agency server when the calculated similarity is equal to or greater than the reporting criterion.