CN110019946A - A kind of method and its system identifying harmful video - Google Patents

Abstract

A method for identifying harmful videos and a system thereof, the method comprising: obtaining a URL path of a video, then obtaining a domain name and an IP address according to the URL path, and outputting a first weighting factor, a second weighting factor based on the related query of the IP address and the domain name weighting factor; and further obtain image files of multiple frames in the video, and extract DC coefficients in the compression domain of the image file, so as to identify the image file after partial decompression of the image file, and identify the image file according to the As a result, a third weighting factor is output; the first weighting factor, the second weighting factor and the third weighting factor are combined to identify whether the video is harmful video. The present disclosure can combine a database created by big data, use as few image processing means as possible, and provide a solution for identifying harmful videos by using multiple modes.

Description

A method and system for identifying harmful videos

technical field

The present disclosure belongs to the field of information security, for example, relates to a method for identifying harmful videos and a system thereof.

Background technique

In the information society, information flows are everywhere, including but not limited to text, video, audio, and pictures. Among them, video files often include auditory information and visual information, and the expression ability is more comprehensive. However, with the popularization of the mobile Internet, a large amount of harmful video content is flooded on the Internet. Due to its visual intuitiveness and impact, it is more harmful than harmful text, harmful pictures and harmful audio. Therefore, these harmful videos are identified. It is necessary to filter, delete, and eliminate hazards.

For the identification of harmful videos on the Internet, the current technologies can be mainly divided into two categories, one is the traditional method, which includes two categories: (1) The identification method based on unimodal features. This type of method mainly extracts the visual features of the video, and constructs a classifier according to these features. For example, in violent video recognition, common features include video motion vector, color, texture, and shape. (2) Identification methods based on multi-modal feature fusion. This type of method mainly extracts the features of multiple modalities of the video and fuses them to construct a classifier. For example, in violent video recognition, in addition to video features, many methods also extract audio features, including short-term energy, sudden sound, etc. Some methods also consider the text around the web video, and continue to extract some features from these texts for fusion recognition. The other is the deep learning method: (1) CNN uses convolutional neural network to identify and process sensitive and harmful images in the database, obtain the internal characteristics of harmful and sensitive videos, and use the learned harmful video frame to judge the obtained video frames. whether there is harmful information in it. (2) RNN recurrent neural network, directly input the video sequence in the database into the recurrent neural network to identify harmful video information, learn the frame of harmful video, and use the learned harmful video frame to judge and identify whether the new video is harmful video. (3) CNN+RNN, use CNN to learn the spatial domain information in the image frame in the video, use the RNN to identify the temporal domain information in the video sequence, and finally combine the two for identification and judgment, and use the learned framework to identify the video.

The existing image processing methods mainly include the following two methods: traditional methods and deep learning methods. Among them, the classical bag-of-words model in the traditional method consists of four parts: (1) Feature extraction stage at the bottom layer (2) Feature encoding (3) Feature aggregation (4) Use appropriate classifier for classification. Deep learning model is another image processing model, mainly including autoencoder, restricted Boltzmann machine, deep belief network, convolutional neural network, recurrent neural network, etc. With the continuous advancement of computer hardware and the improvement of databases, the operation process using traditional methods is simpler than deep learning. The deep learning method can learn more meaningful data and continuously adjust parameters according to tasks. Therefore, for In terms of image processing, deep learning models have more powerful feature expression capabilities.

Existing identification methods are insufficient in terms of identification efficiency. With the development of big data and artificial intelligence, how to efficiently identify harmful videos has become a problem that needs to be considered.

SUMMARY OF THE INVENTION

The present disclosure provides a method of identifying harmful videos, including:

Step a), obtain the URL path of the video, and then obtain domain name, IP address according to the URL path, and based on the IP address, inquire whether there is the IP address or the same network segment IP address in the first database, and according to the IP address The query result outputs the first weighting factor related to IP;

Step b), based on the domain name, carry out whois query in the second database, and output the second weight factor related to the domain name according to the whois query result;

Step c), obtain the image file of a plurality of frame pictures in the video, and extract the DC coefficient in the compression domain of the image file, so that the image file is partially decompressed to identify the image file, and output according to the result of identifying the image file the third weighting factor;

Step d), synthesizing the first weighting factor, the second weighting factor and the third weighting factor, to identify whether the video is harmful video.

In addition, the present disclosure also discloses a system for identifying harmful videos, including:

The first weight factor generation module is used to: obtain the URL path of the video, and then obtain the domain name and IP address according to the URL path, and based on the IP address, query whether the IP address or the same network segment IP exists in the first database. address, and output the first weighting factor related to the IP according to the query result of the IP address;

The second weighting factor generating module is used for: performing a whois query in the second database based on the domain name, and outputting a second weighting factor related to the domain name according to the whois query result;

The third weight factor generation module is used for: acquiring image files of multiple frames in the video, and extracting DC coefficients in the compression domain of the image files, so as to identify the image files after partial decompression of the image files, and identify the image files according to the The result of identifying the image file outputs a third weighting factor;

The identification module is configured to integrate the first weighting factor, the second weighting factor and the third weighting factor to identify whether the video belongs to harmful video.

Through the method and the system thereof, the present disclosure can provide a more efficient solution for identifying harmful videos with as few image processing means as possible in combination with the database created by big data.

Description of drawings

1 is a schematic diagram of the method described in one embodiment of the present disclosure;

Figure 2 is a schematic diagram of a system according to one embodiment of the present disclosure.

Detailed ways

In order to make those skilled in the art understand the technical solutions disclosed in the present disclosure, the technical solutions of the various embodiments will be described below with reference to the embodiments and the related drawings. The described embodiments are part of the present disclosure, not All examples. The terms "first", "second" and the like used in the present disclosure are used to distinguish different objects, rather than to describe a specific order. Furthermore, "including" and "having" and any variations thereof are intended to be inclusive and not exclusive. For example, a process, or method, or system, or product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optional Also includes other steps or units inherent to these processes, methods, systems, products or devices.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present disclosure. The appearance of the phrase in various places in the specification is not necessarily all referring to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. Those skilled in the art will appreciate that the embodiments described herein may be combined with other embodiments.

Referring to FIG. 1 , FIG. 1 is a schematic flowchart of a method for identifying harmful videos provided by an embodiment of the present disclosure. As shown, the method includes:

Step S100, obtain the URL path of the video, and then obtain the domain name and IP address according to the URL path, and based on the IP address, inquire whether the IP address or the same network segment IP address exists in the first database, and according to the IP address. The query result outputs the first weighting factor related to the IP;

It can be understood that the first database maintains a list of known IP addresses that have published harmful videos.

For example, if the IP address is 192.168.10.3:

If the IP address is recorded in the first database, the first weight factor may be exemplarily 1.0;

If the IP address recorded in the database is only 192.168.10.4, then 192.168.10.3 is moderately suspected to be the alternate address or the newly replaced address of the website to which the video belongs, and the first weight factor can be exemplarily 0.6;

If the IP addresses recorded in the database are 192.168.10.4 and 192.168.10.5, or even all IP addresses of the 192.168.10.X network segment are recorded, then 192.168.10.3 is highly suspected to be the alternate address of the website to which the video belongs or has been replaced recently. address, the first weight factor can be exemplarily 0.9;

If the IP address recorded in the database includes multiple 192.168.X.X network segments, but there is no 192.168.10.X network segment, then 192.168.10.3 is carefully suspected to be the address of the website to which the harmful video belongs, and the first weight factor can be exemplified is 0.4.

Step S200, based on the domain name, perform a whois query in the second database, and output a second weight factor related to the domain name according to the whois query result;

It can be understood that the second database maintains a list of known domain names that have published harmful videos.

Whois queries are made to examine the association of domain name registrants with harmful videos. The second database may maintain the following information: domain names, information of domain name registrants who publish a large number of harmful videos on the Internet, and the identification of the corresponding harmful videos.

For example, if the domain name is www.a.com:

If the domain name address, the identifier of the corresponding harmful video and its whois information are recorded in the second database, the second weight factor may be exemplarily 1.0;

If the identification of any harmful video of the above-mentioned domain name www.a.com is not recorded in the second database, but the domain name registrant of the domain name and the domain names of other websites registered by the domain name registrant of the domain name can be queried, and the second database Including the identification of the other websites that publish a large number of harmful videos on the Internet; then even if the second database does not record the identification of any harmful videos of the above-mentioned domain name www.a.com, the website corresponding to the domain name www.a.com is still highly regarded. Suspected to be the source of the harmful video, the second weight factor can be exemplarily 0.9;

If the identification of any harmful video of the above-mentioned domain name www.a.com is not recorded in the second database, but the domain name registrant of the domain name and the domain names of other websites registered by the domain name registrant of the domain name can be queried, the second database Does not include any identification about the other website publishing harmful videos, and the second weight factor can be exemplarily 0;

It is easy to understand that if the second database does not record the identification of any harmful video of the above-mentioned domain name www.a.com, and the domain names of other websites registered by the domain name registrant of the domain name cannot be queried, then the second weighting factor can also be Exemplarily 0.

Step S300, acquiring image files of multiple frames in the video, and extracting DC coefficients in the compression domain of the image files, so as to identify the image files after partially decompressing the image files, and output the first image file according to the result of identifying the image files. Three weighting factors;

In step S300, an image file is acquired based on the video, and a third weighting factor is output through the recognition result of the image file. The third weighting factor will reflect if conventional harmful videos or other unsafe content, etc. are detected. It can be understood that when the number of occurrences of conventional harmful videos or other unsafe content meets the corresponding threshold condition, the third weight factor may be 1.0, 0.8 or 0.4, depending on the specific threshold condition.

In addition, it should be emphasized that, in order to reduce the computational resources and time costs required by this embodiment, when identifying an image file, the DC coefficients are first extracted from the compression domain of the image file, so that the image file can be used after partial decompression. for image recognition. Since the inventor utilizes the characteristic that most of the image information is concentrated in the DC coefficient and its nearby low-frequency spectrum, the image file can be partially decompressed by the DC coefficient, and the partially decompressed image information can be used for image recognition without using Complete image files with all information, thus reducing workload. Typically, image files conforming to the JPEG encoding standard can be processed in this way.

It can be understood that all technical means in the art for identifying harmful information of image files can be used for the image files in the video files described in the present disclosure. In the step S300, images can be processed in combination with traditional methods, or images can be processed in combination with deep learning models, so as to identify harmful videos.

More particularly, in one case, identifying the image file after partially decompressing the image file in step S300 specifically includes: after partially decompressing the image file, storing the image file with the third-party image database. The maintained, known harmful image files are compared for characteristics in order to identify the image files. When identified as harmful, the image file is updated to the third-party image database. Wherein, the third-party image database is pre-established by crawling image files of known harmful websites.

Step S400, synthesizing the first weighting factor, the second weighting factor, and the third weighting factor, to identify whether the video belongs to a harmful video.

Exemplarily, set the first weighting factor to be x, the second weighting factor to be y, and the third weighting factor to be z, where 0≤x≤1, 0≤y≤1, 0≤z≤1, can be synthesized according to the following formula: The above weighting factors calculate the harmful coefficient W of the video:

W=a×x+b×y+c×z, where a+b+c=1, and a, b, and c respectively represent the weights of each weighting factor.

For example, a=b=c=1/3;

More for example, a, b, and c are not equal, and can be adjusted according to each weighting factor and the actual situation of identifying harmful content.

It can be understood that the closer W is to 1, the greater the probability that the related video is harmful.

The above formula for calculating W is a linear formula, but in practical application, a nonlinear formula may also be used.

Further, whether it is a linear formula or a nonlinear formula, it can be considered to determine the relevant formula and its parameters through training or fitting.

To sum up, for the above-mentioned embodiment, only step S300 performs image processing, and the remaining steps are a new way to obtain relevant weight factors by using relevant queries. In step S400, multiple weighting factors are integrated (also referred to as fusion) to identify harmful videos. Those skilled in the art know that processing and identifying each frame of a video is very time-consuming, and querying is relatively time-saving. Obviously, the above embodiments provide an efficient method for identifying harmful videos. In addition, the above-mentioned embodiments can obviously further combine big data and/or artificial intelligence to establish and update the first database, the second database and other databases.

In another embodiment, the second database is a third-party database.

For example, databases of numerous websites that conduct whois queries, and third-party-maintained lists of websites with harmful videos.

In another embodiment, for a video determined to be harmful after identification, the IP address information of the publisher of the harmful video recorded on the website is collected for the website (for example, a forum or a web page) of its source, and the first update is made. database. This is because harmful videos generally form some sticky users, some of these users will participate in the dissemination of harmful videos, and most of their IP addresses will be relatively fixed. If the relevant website itself records the IP address information of the publisher of the harmful video, The present disclosure updates the aforementioned first database by collecting its IP address information.

In another embodiment, step S200 further includes:

Further, the security of the domain name is queried in a third-party domain name security list so as to output a security factor, and the second weighting factor related to the domain name is modified by the security factor.

For example, virustotal.com, a third-party domain name security screening website. It can be understood that if the third-party information believes that the relevant domain name contains viruses or Trojan horses, the second weight factor should be increased, because the relevant website is more insecure.

It can be understood that the embodiment focuses on correcting the second weighting factor from the perspective of network security, so as to prevent the user from suffering other losses. This is because network security concerns the privacy and property rights of users. If there are hidden network security risks on websites related to harmful videos, in addition to the harm of harmful videos, it will also bring harm to users' privacy leakage or property loss.

In another embodiment, the acquisition of image files of multiple frames in the video in step S300 is acquired in a random manner.

For this embodiment, it means randomly selecting a picture in the video, for example, selecting an image file of one or more frames of pictures from the first 1/3 of the playback time period of the video, and from the middle 1/3 of the playback time period and the end 1. /3 The playback time period also selects image files of one or more frames respectively. Usually, video recognition is done based on key frame extraction, and key frame extraction is relatively time-consuming. Therefore, the embodiment selects one or more frames, especially multiple frames, in a random manner, which can significantly save money. time. Obtaining image files of multiple frames in a random manner not only saves time significantly, but also ensures that the processing results are relatively credible to a certain extent.

In another embodiment, acquiring image files of multiple frames in the video in step S300 further includes the following:

Step c1): extract the audio in the video;

Step c2): Identify whether the audio contains harmful content, and if so, acquire image files of multiple frames within the start and end times of the audio according to the start and end times of the audio.

For this embodiment, if it is identified that the audio contains harmful content, its time is located, and based on the start and end times of the audio, image files of multiple frames within the start and end time are acquired. This can be more targeted to find relevant harmful pictures.

As mentioned above, if combined with big data technology, the present disclosure can effectively combine multiple dimensions, multiple modes, and combine IP information, domain name information, image information, and audio information to quickly identify harmful videos.

Further, the above embodiment may be implemented on the router side or the network provider side to filter relevant videos in advance.

Corresponding to the method, referring to FIG. 2 , the present disclosure discloses, in another embodiment, a system for identifying harmful videos, including:

The first weight factor generation module is used to: obtain the URL path of the video, and then obtain the domain name and IP address according to the URL path, and based on the IP address, query whether the IP address or the same network segment IP exists in the first database. address, and output the first weighting factor related to the IP according to the query result of the IP address;

The second weighting factor generating module is used for: performing a whois query in the second database based on the domain name, and outputting a second weighting factor related to the domain name according to the whois query result;

The third weight factor generation module is used for: acquiring image files of multiple frames in the video, and extracting DC coefficients in the compression domain of the image files, so as to identify the image files after partial decompression of the image files, and identify the image files according to the The result of identifying the image file outputs a third weighting factor;

The identification module is configured to integrate the first weighting factor, the second weighting factor and the third weighting factor to identify whether the video belongs to harmful video.

Similar to the foregoing embodiments of the respective methods,

Preferably, the second database is a third-party database.

More preferably, the second weight factor generation module further includes:

The correction unit is configured to: further query the security of the domain name in the third-party domain name security list to output a security factor, and correct the second weighting factor related to the domain name by the security factor.

More preferably, the acquisition of the image files of multiple frames in the video described in the third weight factor generation module is acquired in a random manner.

More preferably, the third weight factor generation module also realizes the acquisition of image files of multiple frames in the video through the following units:

Audio extraction unit for extracting audio in video;

The audio identification unit is configured to identify whether the audio contains harmful content, and if so, acquire image files of multiple frames within the start and end times according to the start and end times of the audio.

The present disclosure discloses, in another embodiment, a system for identifying harmful videos, comprising:

A processor and a memory having executable instructions stored in the memory that the processor executes to perform the following operations:

Step a), obtain the URL path of the video, and then obtain domain name, IP address according to the URL path, and based on the IP address, inquire whether there is the IP address or the same network segment IP address in the first database, and according to the IP address The query result outputs the first weighting factor related to IP;

Step b), based on the domain name, carry out whois query in the second database, and output the second weight factor related to the domain name according to the whois query result;

Step c), obtain the image file of a plurality of frame pictures in the video, and extract the DC coefficient in the compression domain of the image file, so that the image file is partially decompressed to identify the image file, and output according to the result of identifying the image file the third weighting factor;

Step d), synthesizing the first weighting factor, the second weighting factor and the third weighting factor, to identify whether the video is harmful video.

In another embodiment, the present disclosure also discloses a computer storage medium storing executable instructions for performing the following method of identifying harmful videos:

Step a), obtain the URL path of the video, and then obtain domain name, IP address according to the URL path, and based on the IP address, inquire whether there is the IP address or the same network segment IP address in the first database, and according to the IP address The query result outputs the first weighting factor related to IP;

Step b), based on the domain name, carry out whois query in the second database, and output the second weight factor related to the domain name according to the whois query result;

Step c), obtain the image file of a plurality of frame pictures in the video, and extract the DC coefficient in the compression domain of the image file, so that the image file is partially decompressed to identify the image file, and output according to the result of identifying the image file the third weighting factor;

Step d), synthesizing the first weighting factor, the second weighting factor and the third weighting factor, to identify whether the video is harmful video.

For the above system, it may include: at least one processor (eg CPU), at least one sensor (eg accelerometer, gyroscope, GPS module or other positioning module), at least one memory, at least one communication bus, wherein the communication bus uses It is used to realize the connection communication between various components. The device may also include at least one receiver and at least one transmitter, wherein the receiver and the transmitter may be wired transmission ports or wireless devices (eg, including antenna devices) for signaling with other node devices or data transmission. The memory may be a high-speed RAM memory, or a non-volatile memory (Non-volatile memory), such as at least one disk memory. The memory may optionally be at least one storage device located remotely from the aforementioned processor. A set of program codes is stored in the memory, and the processor can call the code stored in the memory through the communication bus to perform the related functions.

Embodiments of the present disclosure further provide a computer storage medium, wherein the computer storage medium can store a program, and when the program is executed, the program includes part or all of the steps of any of the methods for identifying harmful videos described in the above method embodiments.

The steps in the method of the embodiment of the present disclosure may be adjusted, combined and deleted in sequence according to actual needs.

The modules and units in the system of the embodiments of the present disclosure can be combined, divided and deleted according to actual needs. It should be noted that, for the sake of simple description, the foregoing method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence. As in accordance with the present invention, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions, modules and units involved are not necessarily required by the present invention.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

In the several embodiments provided in the present disclosure, it should be understood that the disclosed system may be implemented in other manners. For example, the above-described embodiments are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between units or components may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and may be located in one place or distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist independently, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present disclosure can be embodied in the form of software products in essence, or the part that contributes to the prior art, or all or part of the technical solutions, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which can be a smartphone, a personal digital assistant, a wearable device, a laptop, a tablet) to perform all or part of the steps of the methods described in various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes .

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present disclosure, but not to limit them; although the present disclosure has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that: it is still possible to implement the above-mentioned implementations. The technical solutions described in the examples are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present disclosure.

Claims (10)

1. a kind of method for identifying harmful video, comprising:

Step a) obtains the path URL of video, and then obtains domain name, IP address according to the path URL, and based on the IP Location, inquiry whether there is the IP address or same network segment IP address in first database, and according to the inquiry knot of IP address Fruit exports the first weight factor relevant to IP；

Step b), be based on domain name, in the second database carry out whois inquiry, and according to whois query result output with Relevant second weight factor of domain name；

Step c) obtains the image file of multiple frame pictures in video, and direct current system is extracted in the compression domain of image file Number, so as to image file carry out part decompression after identify described image file, and according to identification image file result export Third weight factor；

Whether step d), comprehensive first weight factor and the second weight factor and third weight factor, belong to the video Harmful video is identified.

2. according to the method described in claim 1, wherein, it is preferred that second database is third party database.

3. according to the method described in claim 1, wherein, step b) further include:

Further, the safety of domain name is inquired in third party's domain name safe list so as to the output safety factor, and led to The factor of safety is crossed to be modified second weight factor relevant to domain name.

4. according to the method described in claim 1, wherein, the image for obtaining multiple frame pictures in video in step c) is literary Part is obtained by random fashion.

5. according to the method described in claim 1, wherein, the image for obtaining multiple frame pictures in video in step c) is literary Part further includes as follows:

Step c1): extract the audio in video；

Step c2): it whether include harmful content in identification audio, if so, then obtaining described rise according to the beginning and ending time of audio The only image file of multiple frame pictures in the time.

6. a kind of system for identifying harmful video, comprising:

First weight factor generation module, is used for: obtaining the path URL of video, and then with obtaining domain name, IP according to the path URL Location, and it is based on the IP address, inquiry whether there is the IP address or same network segment IP address in first database, and The first weight factor relevant to IP is exported according to the query result of IP address；

Second weight factor generation module, is used for: it is based on domain name, the progress whois inquiry in the second database, and according to Whois query result exports the second weight factor relevant to domain name；

Third weight factor generation module, is used for: obtaining the image file of multiple frame pictures in video, and in image file DC coefficient is extracted in compression domain, to identify described image file after carrying out part decompression to image file, and according to identification The result of image file exports third weight factor；

Identification module is to the video for integrating the first weight factor and the second weight factor and third weight factor It is no to belong to harmful video and identified.

7. system according to claim 6, wherein preferred, second database is third party database.

8. system according to claim 6, wherein the second weight factor generation module further include:

Amending unit is used for: it is further, the safety of domain name is inquired in third party's domain name safe list to export Factor of safety, and second weight factor relevant to domain name is modified by the factor of safety.

9. system according to claim 6, wherein in acquisition video described in the third weight factor generation module Multiple frame pictures image file, be to be obtained by random fashion.

10. system according to claim 6, wherein also by such as lower unit in the third weight factor generation module Realize the image file for obtaining multiple frame pictures in video:

Audio extraction unit, for extracting the audio in video；

Whether audio identification unit includes for identification harmful content in audio, if so, then being obtained according to the beginning and ending time of audio Take the image file of multiple frame pictures in the beginning and ending time.