Apparatus and method for gathering of objectional web sites

• US 20070005652A1
• Filed: 03/21/2006
• Published: 01/04/2007
• Est. Priority Date: 07/02/2005
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Nam, Taek, Han, Seung, Choi, Su, Jeong, Chi
• Application Number:
  US11/386,572
• Publication Number:
  US 20070005652A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]

Abstract

An apparatus and method for collecting harmful web sites are provided. In the apparatus, a start uniform resource locator (URL) database (DB) stores URLs of harmful web pages. A URL examination and distribution unit provides URLs grouped in relation to predetermined hosts, the URLs obtained by removing redundant URLs that are different to each other but indicate identical web pages, among the URLs stored in the start URL DB, and then among the remaining URLs, removing URLs corresponding web sites already collected. A web site collection unit collects web contents of the web sites corresponding to the URLs received from the URL examination and distribution unit. A URL extraction unit extracts URLs in the links included in the web contents collected by the web site collection unit, identifies harmless URLs based on top-level domain names and a harmless URL list among the extracted URLs, and removes the identified harmless URLs from the URLs that are the object of the collection. According to the apparatus and method, the harmful site database is helped to maintain accurate, abundant, and latest information.

Claims

1. A harmful site collection apparatus comprising:

a start uniform resource locator (URL) database (DB) storing URLs of harmful web pages;

a URL examination and distribution unit providing URLs grouped in relation to predetermined hosts, the URLs obtained by removing redundant URLs that are different to each other but indicate identical web pages, among the URLs stored in the start URL DB, and then among the remaining URLs, removing URLs corresponding to web sites already collected;

a web site collection unit collecting web contents of the web sites corresponding to the URLs received from the URL examination and distribution unit; and

a URL extraction unit extracting URLs in the links included in the web contents collected by the web site collection unit, identifying harmless URLs based on top-level domain names and a harmless URL list among the extracted URLs, and removing the identified harmless URLs from the URLs that are the object of the collection.

3. The apparatus of claim 1, wherein the URL extraction unit identifies, as harmless URLs, URLs linked from harmless URLs identified by an external harmful site automatic classification unit.

4. The apparatus of claim 1, further comprising:

a harmful URL meta search unit identifying the URL of a web site that is highly probable to be harmful, by using a harmful keyword as an input for meta search.

5. The apparatus of claim 4, wherein the harmful URL meta search unit comprises:

a harmful keyword list including harmful keywords that appear frequently in harmful sites;

a meta search unit using the harmful keywords as inputs of search engines and extracting URLs included in the search results by the search engines; and

a URL examination unit storing only the URLs included in the search result, excluding harmless URLs, in the URL DB.

6. The apparatus of claim 1, further comprising:

a harmless image filter, if the contents of a web page collected by the web site collection unit are images, comparing the characteristic of the images with a preset harmless image characteristic profile, and blocking collection of harmless images.

7. The apparatus of claim 1, wherein the URL examination and distribution unit comprises:

a URL examination unit removing redundant URLs that are different to each other but indicate identical web pages, among the URLs stored in the start URL DB, and then removing URLs corresponding to web sites already collected, to arrange URLs that are the object of the collection;

a URL management unit deleting URLs that are determined to be harmless by the URL extraction unit, in the URLs that are the object of the collection; and

a URL distribution unit dividing the URLs that are the object of the collection, into groups in relation to predetermined hosts, and transferring the URLs.

8. The apparatus of claim 1, wherein the web site collection unit comprises:

a web contents collection unit receiving a list of URLs included in a predetermined host from the URL examination and distribution unit, and collecting web contents corresponding to the received URL list; and

a web site analysis unit identifying whether or not a characteristic pattern that occurs when a harmful web site is accessed occurs when the web contents are collected.

9. The apparatus of claim 1, wherein the URL extraction unit comprises:

a URL obtaining unit extracting URLs from links included in the web contents collected by the web site collection unit;

a harmless URL filter identifying harmless URLs among the extracted URLs, based on top-level domain names and a harmless URL list; and

a link relation management unit identifying the URLs of sites linked from harmless URLs identified by an external harmful site automatic classification unit, as harmless URLs, and then requesting the URL examination and distribution unit to delete the URLs identified to be harmless.

2. The apparatus of claim 2, wherein the web site collection unit determines whether or not a characteristic pattern that occurs when the web site is accessed is similar to a characteristic pattern that occurs when a harmful site is accessed.

10. A harmful site collection method comprising:

removing redundant URLs that are different to each other but indicate identical web pages, among URLs stored in a start URL DB, then removing URLs corresponding to web sites already collected among the remaining URLs, then dividing the URLs into groups in relation to predetermined hosts and providing the groups of URLs;

collecting web contents of the web sites corresponding to the arranged URLs and based on a characteristic pattern that occurs when a harmful site is accessed, analyzing whether or not the web site is harmful; and

extracting URLs from links included in the collected web contents, identifying harmless URLs among the extracted URLs, based on top-level domain names and a harmless URL list, and removing the identified harmless URLs from the URLs that are the object of the collection.

11. The method of claim 10, wherein the collecting of the web contents and analyzing whether or not the web site is harmful include:

determining whether or not the characteristic pattern that occurs when the web site is accessed is similar to the characteristic pattern that occurs when a harmful site is accessed.

12. The method of claim 10, wherein the extracting of the URLs from links and the identifying of the harmless URLs include:

identifying the URLs of sites linked to a predetermined harmless URL, as harmless URLs.

13. The method of claim 10, further comprising before the removing the redundant URLs:

identifying URLs of web sites having high probabilities of being harmful, by using harmful keywords as input of meta search, and storing the URLs in the URL DB.

14. The method of claim 10, wherein the collecting of the web contents and analyzing whether or not the web site is harmful include:

if the collected contents of the web page are images, blocking collection of harmless image, by comparing the characteristic of the images with a preset harmless image characteristic profile.