Counterfeit website detection method and device based on large language model

Abstract

The invention provides a counterfeit website detection method and device based on a large language model, and the method comprises the steps: inputting website information into a detection model, obtaining a discrimination result outputted by the detection model, and determining whether a to-be-detected website is a counterfeit website or not; wherein the detection model is obtained by constructing a reward function through a group mutual anti-rank index, constructing unsupervised contrast feedback based on a set of similar websites and training a large language model. According to the method, the strong semantic comprehension and generation capability of the large language model is utilized, and the group comparison feedback reinforcement learning mechanism and the fine-grained analysis of implicit semantic enhancement are combined, so that counterfeit network fraud activities are efficiently and accurately identified and prevented.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for detecting counterfeit websites based on a large language model. Background Art

[0002] With the advent of the Internet age, when the Internet becomes a way of life for the people, various hidden risks follow, especially fraud-related online resources (fraud-related websites, fraud-related apps, etc.), which affect a large number of people, cause great harm, and change quickly, bringing new challenges to network security governance.

[0003] At present, the detection methods of Internet fraud websites mainly rely on traditional machine learning and deep learning models, such as support vector machines, random forests, neural networks, etc., which are usually based on the static features of website content (such as domain names, page layouts, URL structures) and dynamic behaviors (such as user interactions and traffic patterns) for analysis. These methods perform well when processing simple fraud-related data, but have limitations in understanding and processing complex logical reasoning (especially phishing scams). For example, for text content in web pages, traditional models may not be able to accurately capture semantic nuances and potential deceptive cues, which makes these models easily fail when faced with carefully disguised fraud websites. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention provides a method and device for detecting counterfeit websites based on a large language model.

[0005] The present invention provides a method for detecting counterfeit websites based on a large language model, the method comprising: Get the website information of the website to be detected; Inputting the website information into the detection model to obtain the discrimination result output by the detection model to determine whether the website to be detected is a counterfeit website; The construction process of the detection model includes the following steps: Constructing reward function; Based on the reward function, construct an unsupervised contrast feedback signal; The detection model is obtained by training the original detection model based on the unsupervised comparison feedback signal.

[0006] Optionally, constructing a reward function includes: The reward function is constructed through the group reciprocal rank index.

[0007] Optionally, the group reciprocal rank index is obtained according to the following steps: Based on the original detection model, obtain a model output corresponding to any website in the suspected fraud website corpus, and a model output corresponding to other websites in the suspected fraud website corpus; The group reciprocal rank index is obtained based on the similarity between the model output corresponding to any one website and the model output corresponding to the other websites.

[0008] Optionally, constructing an unsupervised comparative feedback signal based on the reward function includes: Constructing the unsupervised comparative feedback signal based on the reward function, the penalty term, and a hyperparameter for balancing the group reciprocal rank index and the penalty term; The penalty term is used to measure the relative entropy between the trained detection model and the original detection model.

[0009] Optionally, the discrimination result includes a discrimination result of the backbone information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: Inputting the website information and the first prompt word template into the detection model to obtain the backbone information; The backbone information, backbone search content supplement and discrimination prompt template are input into the detection model to obtain the discrimination result of the backbone information.

[0010] Optionally, the discrimination result also includes a discrimination result of fine-grained information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: In the case where only one fine-grained information is included, the step of obtaining the discrimination result of the fine-grained information includes: Inputting the website information, the main information and the second prompt word template into the detection model to obtain the fine-grained information; The fine-grained information, the fine-grained search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the fine-grained information

[0011] In the case of i fine-grained information, i≥2, the steps of obtaining the discrimination result of the i-th fine-grained information include: The website information, , the second prompt word template and the previous fine-grained information are input into the detection model to obtain the i-th fine-grained information; The i-th fine-grained information, the i-th fine-grained search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the i-th fine-grained information.

[0012] Optionally, the discrimination result also includes a discrimination result of the implicit information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: The website information, , the i-th fine-grained information and the third prompt word template are input into the detection model to obtain the implicit information; The implicit information, the implicit search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the implicit information.

[0013] Optionally, determining whether the website to be detected is a counterfeit website includes: Based on at least one of the discrimination result of the backbone information, the discrimination result of the fine-grained information and the discrimination result of the implicit information, a comprehensive discrimination model is constructed to judge whether the website to be detected is a counterfeit website. Optionally, obtaining the website information of the website to be detected includes: Using a crawler tool to perform semantic extraction on the website content of the website to be detected to obtain the website information; The website information includes but is not limited to page title, text, link text and script information; the website content includes but is not limited to web page content, Uniform Resource Locator System URL structure, domain name registration information and metadata.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned counterfeit website detection methods based on a large language model is implemented.

[0015] The invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned counterfeit website detection methods based on a large language model.

[0016] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned counterfeit website detection methods based on a large language model.

[0017] In the counterfeit website detection method and device based on a large language model provided by the present invention, website information is input into the detection model to obtain the discrimination result output by the detection model to determine whether the website to be detected is a counterfeit website; wherein the detection model is obtained by constructing a reward function through a group reciprocal rank index, constructing unsupervised comparative feedback based on a set of similar websites, and training a large language model. The present invention utilizes the powerful semantic understanding and generation capabilities of the large language model, combined with the group comparative feedback reinforcement learning mechanism and the fine-grained analysis of implicit semantic enhancement, to efficiently and accurately identify and prevent counterfeit network fraud activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 Flowchart of a method for detecting counterfeit websites based on a large language model provided by an embodiment of the present invention.

[0020] Figure 2 A schematic diagram of a model training process provided in an embodiment of the present invention.

[0021] Figure 3 A schematic diagram of the application of the detection model provided in an embodiment of the present invention.

[0022] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The existing technical solutions have the following shortcomings: the existing models have difficulty understanding the implicit information and deep meaning in the text, and have limited ability to identify strategies that use social engineering to induce fraudulent websites. If you want to accurately find the fraudulent websites where counterfeit cases occur, the method involving the knowledge base has the problems of high cost and long time consumption. Due to the unexplainability of the model and its reliance on the data set, it may only be able to make a judgment on whether it is a fraud or not, but cannot provide a basis for judgment. Existing models may not be able to accurately capture semantic nuances and potential deceptive cues, which makes these models easily fail when faced with carefully disguised fraudulent websites. When faced with novel fraudulent methods, existing technologies lack sufficient logical reasoning and common sense reasoning capabilities outside the current training set, and cannot effectively identify unseen deception patterns.

[0025] In view of the problems existing in the above-mentioned prior art, the embodiments of the present invention provide a counterfeit website detection method based on a large language model, which is mainly used in anti-fraud intelligent systems in the public security field in actual business. It integrates the language generation capability and fine-grained semantic information understanding capability of the large language model, and after group comparison feedback, it significantly improves the accuracy and intelligence level of counterfeit fraud website detection.

[0026] Figure 1 The flowchart of the method for detecting counterfeit websites based on a large language model provided by an embodiment of the present invention is as follows: Figure 1 As shown, the method includes: Step 100, obtaining website information of the website to be detected; In the process of obtaining the website information of the website to be detected, a crawler tool may be used to perform semantic extraction on the website content of the website to be detected to obtain the website information.

[0027] The website information includes but is not limited to page title, text, link text and script information; the website content includes but is not limited to web page content, uniform resource locator system URL structure, domain name registration information and metadata.

[0028] Step 101: input the website information into a detection model to obtain a discrimination result output by the detection model to determine whether the website to be detected is a counterfeit website; The construction process of the detection model includes the following steps: Constructing reward function; Based on the reward function, construct an unsupervised contrast feedback signal; The detection model is obtained by training the original detection model based on the unsupervised comparison feedback signal.

[0029] The detection model mentioned in the embodiment of the present invention is obtained by training with an unsupervised contrast feedback signal. The unsupervised contrast feedback signal can be constructed by a reward function, and the specific construction method may include: constructing the unsupervised contrast feedback signal based on the reward function, the penalty term, and the hyperparameter for balancing the group reciprocal rank index and the penalty term; wherein the penalty term is used to measure the relative entropy between the trained detection model and the original detection model.

[0030] Furthermore, the reward function can be constructed through a group reciprocal rank index, and the specific process includes: based on the original detection model, obtaining the model output corresponding to any website in the suspected fraudulent website corpus, and the model output corresponding to other websites in the suspected fraudulent website corpus; based on the similarity between the model output corresponding to any website and the model output corresponding to the other websites, obtaining the group reciprocal rank index.

[0031] In an embodiment of the present invention, after obtaining the website information, the website information can be input into a pre-trained detection model, and the discrimination result output by the detection model can be obtained to determine whether the website to be detected is a counterfeit website. The detection model is obtained by constructing a reward function through a group reciprocal rank index, constructing unsupervised comparative feedback based on a set of similar websites, and training a large language model. The present invention utilizes the powerful semantic understanding and generation capabilities of a large language model, combined with a group comparative feedback reinforcement learning mechanism and fine-grained analysis enhanced by implicit semantics, to efficiently and accurately identify and prevent counterfeit network fraud activities.

[0032] In an embodiment of the present invention, a group comparative feedback reinforcement learning mechanism is constructed, a combination of counterfeit similar fraud websites is constructed in the suspected fraud corpus, a reward function is constructed through the group reciprocal rank index, an unsupervised comparative feedback is constructed based on a set of similar website information, and a large language model is trained to generate output results that can distinguish subtle differences between similar frauds, thereby enhancing the LLM's ability to understand and distinguish counterfeit fraud information.

[0033] The counterfeit website detection method and device based on a large language model provided by the present invention utilize the powerful semantic understanding and generation capabilities of the large language model, combined with the group contrast feedback reinforcement learning mechanism and the fine-grained analysis of implicit semantic enhancement, to construct a high-precision, high-efficiency, and intelligent counterfeit fraud website detection system, so as to effectively deal with the increasingly complex counterfeit network fraud threats that are difficult to capture in existing detection schemes. In the existing detection schemes, the large language model alignment technology uses the calculation of reward scores one by one, relying only on a single input and output, which cannot reflect the uniqueness of the model output, while the group reciprocal rank index is calculated in a group grouping manner, which can help the model to identify small differences in the counterfeit sample set. The reasoning ability of the large model makes up for the shortcomings of the traditional model in logical analysis and improves the intelligence level of the detection system.

[0034] The methods provided by the embodiments of the present invention are used in a system for telecommunications operators to empower the anti-fraud industry, significantly improving the intelligence level and performance indicators of the system.

[0035] Among them, the reward function constructed by the group reciprocal rank index is:

[0036] Furthermore, based on the reward function constructed above, an unsupervised contrast feedback signal is constructed:

[0037] in, is a hyperparameter used to balance the group reciprocal rank index and the penalty term, which is used to measure the parameter The trained large language model and the one with parameters The KL divergence between the original large language model; The group reciprocity rank index is obtained according to the following steps: based on the original detection model, obtain the model output corresponding to any website in the suspected fraud website corpus and other websites in the suspected fraud website corpus, and then obtain the group reciprocity rank index based on the similarity between the model outputs . Specifically, in the above formula, is the group reciprocal rank index, This is a sample of a counterfeit website. For a sample of similar websites, For the general As the output of the large language model after input, For the general As the output of the large language model after input, is the similarity calculation function, , is a collection of similar website samples. is the indicator function, is an adjustable hyperparameter.

[0038] Furthermore, the discrimination result may include three levels of discrimination results, namely, a discrimination result of backbone information, a discrimination result of fine-grained information, and a discrimination result of implicit information.

[0039] Accordingly, in the step of inputting the website information into the detection model to obtain the discrimination result output by the detection model, the step of obtaining the discrimination result for the backbone information includes: The website information T and the first prompt word template Input into the detection model to obtain the backbone information ; The , Main search content supplement and discriminative prompt template , input into the detection model to obtain the discrimination result of the backbone information .

[0040] Furthermore, in the step of inputting the website information into the detection model to obtain the discrimination result output by the detection model, the step of obtaining the discrimination result for the fine-grained information includes: In the case of only one fine-grained information, the discrimination result of the fine-grained information is The steps to obtain include: The T, the And the second prompt word template Input into the detection model to obtain the fine-grained information ; Will , the fine-grained search content supplements and discriminative hint template , input into the detection model to obtain the discrimination result of the fine-grained information

[0041] In the case of i fine-grained information, i ≥ 2, the discrimination result of the i-th fine-grained information is The steps to obtain include: The T, the , Second prompt word template and the previous fine-grained information , input into the detection model to obtain the i-th fine-grained information ; Will , i-th fine-grained search content supplement and discriminative prompt template , input into the detection model to obtain the discrimination result of the i-th fine-grained information .

[0042] In the step of inputting the website information into the detection model to obtain the discrimination result output by the detection model, the step of obtaining the discrimination result for the implicit information includes: The T, the , And the third prompt word template Input into the detection model to obtain the implicit information ; The , Implicit search content supplement and discriminative prompt template , input into the detection model to obtain the discrimination result of the implicit information .

[0043] Accordingly, the step of determining whether the website to be detected is a counterfeit website includes: Based on at least one of the discrimination results of the backbone information, the discrimination results of the fine-grained information, and the discrimination results of the implicit information, a comprehensive discrimination model is constructed to determine whether the website to be detected is a counterfeit website. For example, a comprehensive discrimination model is constructed. , set the threshold to make classification decisions and determine whether the website to be detected is a counterfeit website.

[0044] The following is a detailed introduction to the training process and actual application process of the detection model in combination with a specific example. The embodiment of the present invention is mainly used in the anti-fraud intelligent system in the public security field in actual business, and proposes a counterfeit fraud detection method based on a large language model, which utilizes the powerful semantic understanding and generation capabilities of the large language model, combined with the group contrast feedback reinforcement learning mechanism and the fine-grained analysis of implicit semantic enhancement, to efficiently and accurately identify and prevent counterfeit network fraud activities.

[0045] Step 1: Data preprocessing and information extraction

[0046] Based on step 1, obtain training samples. Specifically, collect and organize the webpage content, URL structure, domain name registration information, and website metadata of suspected fraudulent websites from Deep Packet Inspection (DPI) data. Use crawler tools to perform semantic extraction on website content, extract key information and semantic features that may be involved in fraud, including but not limited to page titles, text, link text, and script information, and splice them into website information. Construct a corpus of possible counterfeit fraudulent websites (similar websites are grouped together).

[0047] Step 2: Large language model group contrast feedback reinforcement learning

[0048] Model training is performed based on step 2. Specifically, the responses generated by the existing general large language model (LLM) are often general and cannot capture the uniqueness of each input, especially when the input content is similar, which makes it difficult for LLM to extract or determine the information of counterfeit fraud websites. Therefore, the embodiment of the present invention constructs unsupervised comparative feedback based on a collection of similar websites, and trains a large language model to generate output results that can distinguish subtle differences between similar websites.

[0049] Figure 2 This is a schematic diagram of the model training process provided by an embodiment of the present invention. The overall process of this step is as follows Figure 2 As shown in the figure, the information of each website in each group is input into the LLM to obtain the corresponding model output, from which comparative feedback is constructed, and a group reciprocal rank reward function is designed and adopted. Finally, the standard policy gradient method (Proximal Policy Optimization, ‌PPO) algorithm is used to optimize the large language model to enhance its ability to capture the unique characteristics of counterfeit websites.

[0050] The website obtained from the suspected fraud website corpus is , its similar website collection is , the website information is obtained from the output of LLM as . Use the similarity calculation model to obtain the document vector representation (for example, use SimBERT to convert text data into the corresponding 768-dimensional vector), and record the similarity calculation function as The formula is as follows:

[0051] Next, for each group of similar websites , concatenate the predefined instructions I and website information, and use LLM to generate corresponding outputs for each group of websites (it can be any type of output, and this proposal sets it as a specific text summarization task). The formula is:

[0052] By mapping the large model output and website information into a semantic space, and then calculating each document and If the trained LLM captures and The key information that distinguishes the information from other websites, then and The similarity score between will be the highest. Based on this, the embodiment of the present invention proposes a group reciprocal rank index As the reward function of reinforcement learning, the PPO algorithm is then used to maximize it, realize group comparison feedback, and optimize the information extraction and discrimination capabilities of LLM counterfeit fraud. The formula is:

[0053] in, is the indicator function, is an adjustable hyperparameter. The complete reward function is:

[0054] in, is a hyperparameter used to balance the group reciprocal rank index and the penalty term, which is used to measure the parameter The optimized large language model with parameters The KL divergence between the initial large language model can limit the policy model to produce outputs that are significantly different from the LLM, thereby preserving the language ability of the policy model.

[0055] Step 3: Fine-grained analysis based on implicit semantic enhancement of the optimized LLM.

[0056] Figure 3 A schematic diagram of the application of the detection model provided in the embodiment of the present invention is shown in FIG. Figure 3 As shown, in step 3, the website information is parsed into three levels: main information, fine-grained secondary information, and implicit information, and each level is deeply analyzed using the large language model optimized in step 2.

[0057] (1) Main information identification: Based on the powerful summarization ability of the large language model, a more reasonable extraction method is designed to extract website content information. Assume that the input initial website information text is T, and the extraction prompt word template used is , the extracted main information is ,but:

[0058] Introduce external knowledge supplements and retrieve factual information related to the main information through search engines to verify the authenticity of the website page content. Assume that the collected retrieval information is , the corresponding discriminant prompt word template is , further improving the reasoning ability of the large language model, the discrimination result of the backbone information is

[0059] (2) Identification of fine-grained information: A large number of counterfeit fraud websites will make significant changes to the website service content by tampering with the details while keeping the main information of the website unchanged. In order to detect this type of more fine-grained counterfeit fraud information, the potential of the large language model in content understanding is effectively released, and after each fine-grained information is given, the query template with the termination condition is repeatedly used three times to determine that the information extraction is complete and obtain all the corresponding fine-grained information. Specifically, the extraction prompt word template used is , the i-th fine-grained information extracted is , the result of the i-th inquiry whether to terminate is , represents a non-terminating information set. Therefore, when When , we can get:

[0060] Further introduce external knowledge supplement, retrieve factual information related to fine-grained information through search engines, and use similar discriminant prompt words Determine each piece of fine-grained information and add supplementary retrieval content to each part before determining it , and obtain the discrimination results of each set of fine-grained information:

[0061] (3) Implicit information reasoning: In addition to the above-mentioned main information and fine-grained secondary information, many counterfeit fraud websites also use language guidance and implicit assumptions in the text, making the text contain certain fraud-related assumptions and hints. This type of information is difficult to detect due to its high concealment and complex logic. Therefore, this proposal uses the implicit information reasoning ability of the large language model to provide more perspectives for the discrimination process.

[0062] Specifically, the extraction prompt word template used is The extracted main information and fine-grained secondary information are used as input to force the large language model to give the hidden content behind the website content. ,but:

[0063] Further supplementary content retrieved by adding implicit content , and finally use the discriminant prompt word template The final judgment result is:

[0064] Step 4: Comprehensive judgment and decision-making

[0065] According to the fine-grained analysis and discrimination results of implicit semantic enhancement obtained in step 3, a comprehensive discrimination model is constructed , set the threshold to make classification decisions and determine whether the website is a counterfeit fraud website.

[0066] One embodiment is: after obtaining the results of all the above branches, if two or more judgment parts appear in the results as counterfeit websites, the news will be judged as counterfeit content, and the specific information of the corresponding counterfeit parts will also be obtained; if only 0 or 1 branch results are judged as counterfeit websites, the website will be judged as a real and legitimate website.

[0067] In the embodiment of the present invention, the optimized LLM fully exploits and utilizes the summarization and reasoning capabilities of the generative large language model, performs hierarchical deduction in the order of main information, fine-grained secondary information and implicit information, and comprehensively identifies counterfeit fraud websites.

[0068] By decomposing the large language model into tasks and performing hierarchical derivation in the order of main information, fine-grained secondary information and implicit information, the embodiment of the present invention maximizes the capabilities of LLM and improves the ability to capture counterfeit fraud. At the same time, the method also has a certain degree of explainability and can provide a basis for detection.

[0069] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the counterfeit website detection method based on the large language model provided in the above embodiments.

[0070] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0071] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the counterfeit website detection method based on a large language model provided in the above embodiments.

[0072] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program is used by a processor to execute the counterfeit website detection method based on a large language model provided in the above embodiments.

[0073] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0074] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting counterfeit websites based on a large language model, characterized in that: The method comprises: Get the website information of the website to be detected; Inputting the website information into the detection model to obtain the discrimination result output by the detection model to determine whether the website to be detected is a counterfeit website; The construction process of the detection model includes the following steps: Constructing reward function; Based on the reward function, construct an unsupervised contrast feedback signal; The detection model is obtained by training the original detection model based on the unsupervised comparison feedback signal.

2. The method for detecting counterfeit websites based on a large language model according to claim 1, characterized in that: The constructing reward function comprises: The reward function is constructed through the group reciprocal rank index.

3. The method for detecting counterfeit websites based on a large language model according to claim 2, characterized in that: The group reciprocal rank index is obtained according to the following steps: Based on the original detection model, obtain a model output corresponding to any website in the suspected fraud website corpus, and a model output corresponding to other websites in the suspected fraud website corpus; The group reciprocal rank index is obtained based on the similarity between the model output corresponding to any one website and the model output corresponding to the other websites.

4. The method for detecting counterfeit websites based on a large language model according to claim 1, characterized in that: The step of constructing an unsupervised contrast feedback signal based on the reward function includes: Constructing the unsupervised comparative feedback signal based on the reward function, the penalty term, and a hyperparameter for balancing the group reciprocal rank index and the penalty term; The penalty term is used to measure the relative entropy between the trained detection model and the original detection model.

5. The method for detecting counterfeit websites based on a large language model according to claim 4, characterized in that: The discrimination result includes a discrimination result of the backbone information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: Inputting the website information and the first prompt word template into the detection model to obtain the backbone information; The backbone information, backbone search content supplement and discrimination prompt template are input into the detection model to obtain the discrimination result of the backbone information.

6. The method for detecting counterfeit websites based on a large language model according to claim 5, characterized in that: The discrimination result also includes a discrimination result of fine-grained information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: In the case where only one fine-grained information is included, the step of obtaining the discrimination result of the fine-grained information includes: Inputting the website information, the main information and the second prompt word template into the detection model to obtain the fine-grained information; The fine-grained information, the fine-grained search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the fine-grained information In the case of i fine-grained information, i≥2, the steps of obtaining the discrimination result of the i-th fine-grained information include: The website information, , the second prompt word template and the previous fine-grained information are input into the detection model to obtain the i-th fine-grained information; The i-th fine-grained information, the i-th fine-grained search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the i-th fine-grained information.

7. The method for detecting counterfeit websites based on a large language model according to claim 6, characterized in that: The discrimination result also includes the discrimination result of the implicit information; Accordingly, the website information is input into the detection model to obtain the discrimination result output by the detection model, including: The website information, , the i-th fine-grained information and the third prompt word template are input into the detection model to obtain the implicit information; The implicit information, the implicit search content supplement and the discrimination prompt template are input into the detection model to obtain the discrimination result of the implicit information.

8. The method for detecting counterfeit websites based on a large language model according to claim 7, characterized in that: The step of determining whether the website to be detected is a counterfeit website includes: Based on at least one of the discrimination result of the backbone information, the discrimination result of the fine-grained information and the discrimination result of the implicit information, a comprehensive discrimination model is constructed to judge whether the website to be detected is a counterfeit website.

9. The method for detecting counterfeit websites based on a large language model according to any one of claims 1 to 8, characterized in that: The step of obtaining website information of the website to be detected includes: Using a crawler tool to perform semantic extraction on the website content of the website to be detected to obtain the website information; The website information includes but is not limited to page title, text, link text and script information; the website content includes but is not limited to web page content, Uniform Resource Locator System URL structure, domain name registration information and metadata.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for detecting counterfeit websites based on a large language model as described in any one of claims 1 to 9 is implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting counterfeit websites based on a large language model as described in any one of claims 1 to 9 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for detecting counterfeit websites based on a large language model as described in any one of claims 1 to 9 is implemented.

Images