Webpage content security processing method based on knowledge graph

Abstract

The invention discloses a webpage content security processing method based on a knowledge graph, and relates to the technical field of webpage content security. The webpage content security processing method based on the knowledge graph comprises the following specific steps: data collection: collecting webpage related internet content data covering texts, images and videos from an internal network of a network service provider, an enterprise or an organization and a website server. According to the method, comprehensive monitoring and analysis of webpage content security are realized, potential security threats, abnormal modes or association relationships in webpage content can be deeply mined by utilizing the reasoning capability of the knowledge graph, including representation learning, association analysis, event tracing, behavior prediction and the like, so that the security threat identification accuracy is improved, and the security threat identification efficiency is improved. And a visual and easy-to-understand visual interface is provided for safety personnel, so that the safety personnel can respond quickly and take corresponding safety measures.

Description

Technical Field

[0001] The present invention relates to the field of web page content security technology, and specifically to a web page content security processing method based on knowledge graph. Background Art

[0002] In the current Internet environment, web page content is growing explosively, and its data types are becoming increasingly rich, covering a variety of complex forms such as text, images, and videos. As an important carrier of information dissemination, the security of web page content is directly related to the health of the Internet ecosystem and the security of user information. With the continuous advancement of network technology, web page content security processing has become an important topic in the field of network security, aiming to identify and prevent security threats such as malicious content, sensitive information leakage, and network attacks through technical means.

[0003] Traditional web content security processing methods have many limitations. First, data processing is not comprehensive and it is difficult to cope with massive and diverse web content data, resulting in omissions in the identification of security threats. Second, security threat identification is inaccurate. Traditional technical means often rely on fixed rule bases or feature matching, which makes it difficult to effectively respond to ever-changing network security threats. In addition, traditional methods lack the ability to integrate and utilize knowledge and fail to fully utilize the correlation and contextual information between web content, resulting in insufficient depth and accuracy of security analysis. These defects limit the effectiveness of traditional methods in dealing with complex and diverse web content security threats.

[0004] In response to the above problems, it is necessary to optimize the existing web content security processing methods. By comprehensively collecting, processing and analyzing web content-related data and utilizing the representation and reasoning capabilities of knowledge graphs, effective protection of web content security can be achieved. Therefore, it is of great significance to develop a web content security processing method based on knowledge graphs that can comprehensively realize the above characteristics. Summary of the invention

[0005] The purpose of the present invention is to make up for the shortcomings of the prior art and to provide a web page content security processing method based on knowledge graph, which can achieve comprehensive, accurate and efficient security processing of web page content by introducing adaptive acquisition strategies of multimodal data fusion, ontology modeling, knowledge extraction, knowledge fusion, graph construction and monitoring and analysis. At the same time, the present invention also has the ability of dynamic update and semantic expansion, and can adapt to new network security threats and situations in a timely manner to ensure the continued effectiveness and accuracy of web page content security processing.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a webpage content security processing method based on knowledge graph, the method comprising the following specific steps:

[0007] Data collection: Collect web-related Internet content data in the form of text, images and videos from network service providers, internal networks of enterprises or organizations, and website servers. According to the characteristics of data from different sources and the needs of web content security analysis, formulate adaptive collection frequency and methods, and use multimodal data fusion technology to perform real-time fusion processing on different modal data during collection, so that the collected data meets the requirements of subsequent analysis;

[0008] Ontology modeling: clearly define concepts related to web content security and accurately define their scope and characteristics, determine the parent-child relationship between concepts to build a hierarchical concept system, and give specific characteristic attributes to each concept, clarify its connotation, definition method, value range and uniqueness constraint conditions, and define multiple semantic relationships and clarify the meaning and judgment criteria, formulate unified naming standards, establish axioms and rules, and clarify trigger conditions and execution logic. At the same time, establish a semantic expansion and dynamic update mechanism to automatically expand the semantics of related concepts according to new situations and review and update the ontology model according to preset cycles or specific trigger conditions;

[0009] Knowledge extraction: Use natural language processing technology to pre-process different types of data to make their formats and feature representations consistent. By building a joint extraction framework that integrates multi-source heterogeneous knowledge and using the multi-head attention mechanism in deep learning to focus on key information from different data sources and types, accurate extraction of entity, relationship and attribute information can be achieved, providing a high-quality knowledge foundation for subsequent knowledge fusion and graph construction.

[0010] Knowledge fusion: Similarity functions and vector space model methods are used to calculate the similarity between entities in the extracted knowledge. Entities that reach the threshold are aligned and merged according to the set similarity threshold and treated as the same entity. When entity alignment corresponds to multiple different concepts or attributes, specific algorithms and logic are used to eliminate ambiguity through in-depth analysis of semantic relationships and contextual information;

[0011] Graph construction: Use a graph database to accurately import entities and relationships between entities after knowledge fusion processing into the graph database according to their format requirements through specific input interfaces and data conversion processes to build a knowledge graph, form a semantic network containing entities and relationships between entities, and clarify the storage and representation methods of each entity and relationship in the knowledge graph;

[0012] Monitoring and analysis: Based on the constructed knowledge graph, set specific analysis algorithms and logic to conduct in-depth mining and analysis of entity relationships in the knowledge graph to explore potential security threats, abnormal patterns or associations;

[0013] Result display and response: Use visualization technology and tools to design layout, display methods and interactive functions, display knowledge graph relationships and monitoring and analysis results, so that security personnel can take corresponding measures based on the results.

[0014] Furthermore, in the data collection step, according to the characteristics of data from different sources and the requirements of web content security analysis, an adaptive collection frequency and method are formulated. For text data, the update frequency is set to f update , the importance level coefficient is I level , the preset basic acquisition frequency is f base , the adjustment coefficient is k1, and its actual acquisition frequency is f text The calculation formula is: text =f base +k1×f update ×I level For image or video data, let the data size be D, the resolution be R, and the preset maximum sampling ratio be P. max , the reference data size is D ref , the reference resolution is R ref , the adjustment coefficient is k2, and its actual sampling ratio P image / video The calculation formula is:

[0015] Furthermore, in the data collection step, multimodal data fusion technology is used to perform real-time fusion processing on different modal data during collection. Specifically, the collected text data vector is represented by T = [t1, t2, ..., t n ], n is the feature dimension of text data, and the vector representation of image data after feature extraction is I = [i1, i2, ..., i m ], m is the feature dimension of image data, and the processed video data is represented by a vector V = [v1, v2, …, v k ], k is the feature dimension of video data, which is fused, and the fusion weight coefficients α, β, γ are set to satisfy α+β+γ=1. The calculation formula of the vector F after multimodal data fusion is: Among them, ||T||, ||I||, ||V|| represent the modulus of text data vector T, image data vector I, and video data vector V respectively.

[0016] Furthermore, in the ontology modeling step, the parent-child relationship between concepts is determined to construct a hierarchical concept system. Specifically, the two concepts whose relationship is to be determined are concept X and concept Y. XY The feature similarity index is S XY , and suppose there is a concept relationship impact factor set I = {i1,i2,…,i m}, where i j(j=1,2,…,m) represents the value of the jth influencing factor, m is the number of influencing factors, then the hierarchical relationship tendency value T of concept X relative to concept Y is XY The calculation formula is: Among them, w j is the weight coefficient of the jth influencing factor, where j = 1, 2, …, m, and satisfies T XY Represents the hierarchical relationship tendency value of concept X relative to concept Y, and its value range is between [0, 1]. XY When the value of is close to 1, it means that concept X is more likely to be a subclass of concept Y. When the value is close to 0, it means that concept X is not a subclass of concept Y. XY is the feature similarity index between concept X and concept Y, m is the number of influencing factors of concept relationship, i j is the value of the j-th concept relationship impact factor, w j It is the weight coefficient of the jth influencing factor, which is used to weight different influencing factors according to their importance in determining the hierarchical relationship.

[0017] Furthermore, in the ontology modeling step, S XY It is the feature similarity index between concept X and concept Y, and its calculation formula is: Among them, S AB Represents the feature similarity index between concept A and concept B, and its value range is between [0, 1]. AB When the value of is close, it means that the two concepts are highly similar in features. When the value is close to 0, it means that the similarity of features is very low. n is the number of feature dimensions, f Ai and f Bi are the feature values ​​of concept A and concept B on the i-th feature dimension, respectively, Ai represents its common transmission pathway, f Bi It is the quantitative analysis value of its corresponding transmission path.

[0018] Furthermore, in the ontology modeling step, semantic expansion of relevant concepts is automatically performed according to new situations, and the ontology model is comprehensively reviewed and updated according to a preset period or a specific trigger condition. Specifically, the set of all concepts related to webpage content security in the ontology model is M = {C1, C2, ..., C m}, where m is the total number of concepts, for each concept C j , where j = 1, 2, ..., m, and the semantic feature vector of the current version is After analyzing the new situation, the semantic feature vector of the concept in the new context is Where n is the number of semantic dimensions, the calculation formula for the conceptual system update necessity index U is: Among them, U represents the necessity index of updating the concept system. The larger its value is, the greater the gap between the concept system and the requirements in the new situation is, and the greater the necessity of updating is. m is the total number of concepts related to web content security in the ontology model, n is the number of semantic dimensions, and Concept C j The feature values ​​on the i-th semantic dimension in the current version and the new situation are compared to quantify the degree of change of each concept under the influence of the new situation, and then comprehensively evaluate the necessity of updating the entire concept system.

[0019] Furthermore, in the knowledge extraction step, by constructing a joint extraction framework that integrates multi-source heterogeneous knowledge, the multi-head attention mechanism in deep learning is used to simultaneously focus on key information in different data sources and types. Specifically, m different data sources and types are provided to participate in knowledge extraction. For the jth data source or type, its feature vector after feature extraction is where x ji Represents the feature value of the jth data source or type on the ith feature dimension, n is the feature dimension, and defines the query vector Key Vector Sum value vector They are: in, are the query matrix, key matrix and value matrix for the jth data source or type respectively. The corresponding vector is obtained by linearly transforming the original feature vector. Then the weight w of the jth data source or type in knowledge extraction is j The calculation formula is: Among them, h is the number of heads in the multi-head attention mechanism, d k is the scaling factor in the k-head attention calculation. According to the feature vectors of different data sources and types and the calculation of the multi-head attention mechanism, the importance weight of each data source and type in the knowledge extraction process is determined. Through the calculated weight, the knowledge extraction process pays more attention to those data sources and data types that are more important for web content security analysis.

[0020] Furthermore, in the knowledge fusion step, similarity functions and vector space model methods are used to calculate the similarity between entities in the extracted knowledge. Specifically, the two entities involved in entity alignment are entity X and entity Y. For entity X, a feature vector set F is defined. X ={f X1 ,f X2 ,…,f Xm}, where f Xi (i=1,2,…,m) represents the vector description of entity X at the i-th feature level. Each vector f Xi With ni Components, that is For entity Y, its feature vector set is F Y ={f Y1 ,f Y2 ,…,f Ym},in Considering the importance of semantic associations between entities in determining whether they are aligned, a semantic association matrix S is defined XY , whose dimension is m×m, where the element s ij (i,j=1,2,…,m) represents the semantic association between entity X at the i-th feature level and entity Y at the j-th feature level, and its value range is between [0,1]. The entity alignment comprehensive similarity Q between entity X and entity Y is XY The calculation formula is: Among them, λ ij is the weight coefficient.

[0021] Furthermore, in the knowledge fusion step, when entity alignment corresponds to multiple different concepts or attributes, the ambiguity is eliminated by in-depth analysis of semantic relationships and context information using specific algorithms and logic. Specifically, suppose there is an entity E, which has k other entities, denoted as E1, E2, …, E k The comprehensive similarity of entity alignment with entity E For each entity E i , suppose it has p additional attributes, recorded as The values ​​of each additional attribute are Define a conflict resolution indicator C Ei To measure each entity E i The degree of advantage over entity E in a conflict situation is calculated as: Among them, γ and δ are weight coefficients, and γ+δ=1, which are used to balance the proportion of the part based on the comprehensive similarity exceeding the threshold and the degree of advantage based on the additional attribute value in the calculation of the conflict resolution index, w' j is the weight coefficient of the jth additional attribute and satisfies Used to weight different additional attributes according to their importance in resolving conflicts. Representing Entity E i In the case of a conflict, the larger the value of the conflict resolution index relative to entity E, the more advantageous the entity is relative to other competing entities in resolving the conflict after considering the portion of the comprehensive similarity exceeding the threshold and the additional attribute value, and the easier it is to be selected as the entity that is finally aligned with entity E.

[0022] Furthermore, in the monitoring and analysis step, based on the constructed knowledge graph, a specific analysis algorithm and logic are set to perform in-depth mining and analysis on the entities and relationships in the knowledge graph. Specifically, the entity set in the knowledge graph is E = {e1, e2, ..., e N}, the relation set is R = {r1,r2,…,r M}, for entity e i , which has the attribute vector where a ij Represents entity e i The eigenvalue on the jth attribute dimension, n is the attribute dimension, for the relation r k , which has the attribute vector where a kj Represents the relationship k The eigenvalue on the jth attribute dimension, m is the attribute dimension, and the weight matrix W is defined entity Used to weight entity attributes, its elements Represents entity e i The weight coefficient on the jth attribute dimension defines the weight matrix W relation Used to weight relationship attributes, its elements Represents the relationship k The weight coefficient on the jth dimension is also determined according to the importance of the attribute in the security threat assessment. The calculation formula for the comprehensive evaluation value P of potential security threats based on the knowledge graph is:

[0023] Compared with the prior art, this webpage content security processing method based on knowledge graph has the following advantages:

[0024] Beneficial effects:

[0025] 1. The present invention realizes comprehensive monitoring and analysis of web content security by constructing a web content security processing system based on knowledge graph. By utilizing the reasoning ability of knowledge graph, including representation learning, association analysis, event tracing, behavior prediction, etc., it can deeply explore potential security threats, abnormal patterns or association relationships in web content, which not only improves the accuracy of security threat identification, but also provides security personnel with an intuitive and easy-to-understand visual interface, so that they can respond quickly and take corresponding security measures.

[0026] 2. The present invention can efficiently collect Internet data related to web page content from multiple sources, including text, images, videos and other forms, by introducing an adaptive collection strategy of multimodal data fusion. It not only ensures the comprehensiveness of data collection, but also significantly optimizes the collection efficiency and reduces data processing costs by dynamically adjusting the collection frequency and method, and using layered sampling, key frame extraction and other technologies. At the same time, multimodal data fusion technology ensures that the collected data has rich related information before entering the subsequent processing flow, providing a solid foundation for subsequent security analysis.

[0027] Other advantages, objectives and features of the present invention will be set forth in part in the following description and, in part, will be apparent to those skilled in the art based on an examination of the following or may be taught from the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 It is a flow chart of a webpage content security processing method based on knowledge graph;

[0030] Figure 2 The figure is a knowledge graph schematic diagram of a web page content security processing method based on knowledge graph. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Example

[0033] This embodiment describes in detail a specific application of a knowledge graph-based web content security processing method in processing e-commerce platform web content security threat detection. Through the present invention, the web content security of the e-commerce platform is monitored and managed, various potential security threats and abnormal situations are discovered and handled in a timely manner, and the normal operation of the e-commerce platform and the information security of users are guaranteed.

[0034] First, data related to the webpage content of the e-commerce platform is collected from multiple key sources. For the text information such as product descriptions, user comments, and transaction records on the platform, the text data collection frequency adjustment unit is used to collect them. For example, the frequently updated description information of popular products (with an update frequency of f update Higher, assuming it is updated 3 times a day), and its importance level coefficient is evaluated as I level is 0.8 (hot product information has a greater impact on platform operations and user decisions), and the preset basic collection frequency f base Once a day, the adjustment coefficient k1 is 0.5, according to the formula f t ext=f base +k1×f update ×I level , the actual acquisition frequency f can be calculated text =1+0.5×3×0.8=2.2 times / day, that is, the system will collect text description information of such popular products at a frequency of about 2.2 times a day. For multimedia content such as product pictures and promotional videos, the collection ratio is determined by the image / video data collection ratio adjustment unit. Assuming that the data size D of a product promotion video is 500MB and the resolution R is 1920x1080 (expressed as horizontal pixels × vertical pixels), the preset maximum sampling ratio P max is 0.8, the reference data size is D ref Set to 300MB, reference resolution R ref Set to 1280×720, adjust the coefficient k2 to 1, according to the formula The actual sampling ratio can be calculated That is, the system will collect data of the promotional video at a ratio of about 23%. The collected text, image, video and other data are fused by the multimodal data fusion unit. Assume that the collected text data vector of a certain product is represented by T = [t1, t2, …, t n ] (n is the feature dimension of text data), and the image data vector after feature extraction is expressed as I = [i1, i2, ..., i m ] (m is the feature dimension of the image data), the processed video data is represented by a vector V = [v1, v2, …, v k ] (k is the feature dimension of video data), set the fusion weight coefficients α = 0.4, β = 0.3, γ = 0.3 (based on the relative importance of each data type in the content analysis of the e-commerce platform), and use the formula (where ||T||, ||I||, |V|| represent the modulus of the text data vector T, the image data vector I, and the video data vector V, respectively) are fused to obtain a fused data vector F for subsequent unified processing.

[0035] In the ontology modeling stage, a conceptual system related to the security of web content on e-commerce platforms is constructed, and a series of concepts are clearly defined, such as "malicious product information" (including false advertising, infringement, etc.), "risk of sensitive user information leakage" (involving possible leakage of user accounts, passwords, payment information, etc.), "types of network attacks targeting e-commerce platforms" (such as SQL injection attacks, DDoS attacks, and other attack methods targeting the characteristics of e-commerce platforms), "platform security vulnerabilities" (such as payment system vulnerabilities, user authentication vulnerabilities, etc.), etc., and each concept is precisely defined. For example, "malicious product information" is defined as the presence of deliberate exaggeration of product efficacy, theft of other people's brand image, or dissemination of false authentication information in product descriptions, pictures, videos, etc., to ensure that the concept definition is clear and accurate, avoid ambiguity and ambiguity, and at the same time determine the parent-child relationship between the above concepts. When judging the relationship, the concept hierarchy relationship determination formula is used to assist in determination. Suppose the two concepts to be determined are concept X and concept Y, S XY The feature similarity index is S XY , and suppose there is a concept relationship impact factor set I = {i1,i2,…,i m}, where i j (j=1,2,…,m) represents the value of the jth influencing factor, m is the number of influencing factors, then the hierarchical relationship tendency value T of concept X relative to concept Y is XY The calculation formula is: Among them, w j is the weight coefficient of the jth influencing factor, where j = 1, 2, …, m, and satisfies T XY Represents the hierarchical relationship tendency value of concept X relative to concept Y, and its value range is between [0, 1]. XY When the value of is close to 1, it means that concept X is more likely to be a subclass of concept Y. When the value is close to 0, it means that concept X is not a subclass of concept Y. XY is the feature similarity index between concept X and concept Y, m is the number of influencing factors of concept relationship, i j is the value of the j-th concept relationship impact factor, w j is the weight coefficient of the jth influencing factor, which is used to weight different influencing factors according to their importance in determining the hierarchical relationship. XY It is the feature similarity index between concept X and concept Y, and its calculation formula is: Among them, S AB Represents the feature similarity index between concept A and concept B, and its value range is between [0, 1]. AB When the value of is close, it means that the two concepts are highly similar in features. When the value is close to 0, it means that the similarity of features is very low. n is the number of feature dimensions, f Ai and f Biare the feature values ​​of concept A and concept B on the i-th feature dimension, respectively, Ai represents its common transmission pathway, f Bi is the quantitative analysis value of its corresponding propagation path. Through the above calculation, according to the hierarchical relationship tendency value T XY The size of the data is determined, and the relationship between each subclass and the parent class is clarified. After rigorous logical analysis and sorting, a hierarchical conceptual system is constructed to provide a clear framework for subsequent knowledge organization and processing. For data attribute definition, specific characteristic attributes are given to each e-commerce platform web content security-related concept. For example, for the concept of "malicious product information", attributes such as "false propaganda content type", "infringement type", "occurrence frequency" are given. For each attribute, its specific connotation and definition method are clarified, and key elements such as the value range and data type of the attribute are specified in detail to ensure the uniqueness and certainty of the attribute definition, so as to facilitate accurate identification and application in subsequent processing. When determining the importance of each characteristic attribute of each concept to the concept in the analysis of e-commerce platform web content security, the attribute importance evaluation formula is adopted: Assume that concept C (such as "malicious product information") has n characteristic attributes, recorded as A1, A2, ..., A n , for each feature attribute A i (i=1,2,…,2n), and the comprehensive evaluation value e is obtained by analyzing and evaluating its correlation with concept C in different network security scenarios and its contribution to judging the security status of concept C. Ai , whose value range is between [0, 1]. At the same time, suppose there is a set of attribute influencing factors F = {f1, f2, ..., f m}, where f j (j=1,2,…,m) represents the value of the jth influencing factor, m is the number of influencing factors, then the characteristic attribute A i Importance index I for concept C Ai The calculation formula is: Among them, w j (j=1,2,…,m) is the weight coefficient of the jth operation and satisfies For each defined data attribute, its value range, uniqueness and other restrictions are clarified. By formulating clear rules, the value range of each attribute, whether duplication is allowed, etc. are strictly regulated to ensure the consistency and compliance of data at the attribute level. After clarifying the value range of each characteristic attribute, in order to evaluate whether the set value range is reasonable, that is, whether it can accurately cover all reasonable values ​​that may appear in the actual e-commerce platform web page content security scenario, the attribute value range rationality evaluation formula is adopted: Assume that the set value range of characteristic attribute A (such as "false propaganda content type") is [a min ,a max], by statistically analyzing the values ​​of this attribute in a large amount of historical network security data, relevant standards and specifications, and actual application cases, an actual value distribution function P(x) is obtained, where x represents the value of attribute A. The attribute value range rationality index R A The calculation formula is When determining whether each characteristic attribute satisfies the uniqueness constraint condition, the attribute uniqueness constraint evaluation formula is used: Assume that concept C (such as "malicious product information") has characteristic attribute A (such as "false advertising content type"), in a sample set containing N e-commerce platform web content security-related instances (such as different product information records, security detection events, etc.), count the values ​​of attribute A in these instances, and assume that the value of attribute A in the i-th instance is v i (i=1,2,…,N), then the uniqueness constraint index U of attribute A is A The calculation formula is Among them, δ(v i ,v j ) is a Kronecker function, when v i =v j When δ(v i ,v j )=1, when v i ≠v j When δ(v i ,v j )=0, It represents the number of combinations of selecting 2 elements from N elements. The calculation formula is For the definition of semantic relationships, define a variety of semantic relationships related to the security of e-commerce platform web page content. For each semantic relationship, clarify its specific meaning and judgment criteria, and elaborate on the conditions under which a certain semantic relationship can be considered to be established, to ensure the clarity and operability of the semantic relationship definition, and provide an accurate basis for subsequent knowledge reasoning and analysis. For example, for the association between "malicious product information" and "sensitive user information leakage risk", the judgment criteria can be set as follows: when there is false propaganda in the product information and it induces users to input additional information, and the transaction process to which the product belongs involves the transmission of key user information, this association is considered to be established. For the formulation of naming standards, formulate unified and clear naming standards that are applicable to concepts, attributes and relationships related to the security of e-commerce platform web page content, specify the naming format, rules and principles to be followed, and ensure that the naming of each element is consistent. The system is characterized by high security and clarity, which is convenient for understanding, operation and maintenance in the subsequent knowledge graph construction, query and management processes. For the establishment of axioms and rules, a series of axioms and rules are established. These axioms and rules are determined based on the business logic and actual needs of the e-commerce platform web content security. The specific triggering conditions and execution logic of each axiom and rule are clarified, and the corresponding actions should be triggered under what conditions. It is ensured that in the entire e-commerce platform web content security processing process, the operations and decisions of each link have rules to follow and evidence to rely on. At the same time, a dynamic update mechanism is established to comprehensively review and update the entire ontology model according to the preset update cycle or specific trigger conditions. When conducting a comprehensive review, the concept system update necessity evaluation formula is used to determine whether the concept system needs to be updated. Suppose the concept set of all e-commerce platform web content security related concepts in the ontology model is M = {C1, C2, …, C m}, where m is the total number of concepts, for each concept C j (j=1,2,…,m), let the semantic feature vector of the current version be After analyzing new situations (such as new safety standards, related changes caused by specific safety incidents, etc.), the semantic feature vector of the concept in the new situation is obtained as follows: Similarly, n is the number of semantic dimensions, and the calculation formula of the conceptual system update necessity index U is:

[0036] In the knowledge extraction stage, natural language processing technology is used to extract knowledge from the rich product description texts on the e-commerce platform. First, the text is preprocessed, including word segmentation, part-of-speech tagging, and stop word removal. Based on the preprocessed text, key information is identified by setting specific rules and patterns. For product descriptions, focus is placed on information related to product characteristics, functions, advantages, etc., as well as statements that may involve security risks. Named entity recognition (NER) technology is used to identify various entities in the text, such as product names, brands, models, etc. as specific entities, and "malicious product information" and "sensitive user information" as abstract security-related entities. For image data such as product pictures and promotional posters on the e-commerce platform, computer vision technology is used to extract features. For example, the convolutional neural network (CNN) model is used to process the image to extract the color features, texture features, shape features, etc. of the image. Based on the extracted image features, security-related features are further identified. For example, if the image contains blurred product logos, suspected tampered certification marks, exaggerated visual effects that may imply false advertising (such as over-enlarged product effect displays), etc. The features are extracted as security-related information. These feature information will be associated with the corresponding commodity entities in subsequent steps, so that the relationship between image data and security situations can be reflected in the knowledge graph. The commodity entity corresponding to the extracted image features is associated with the same commodity entity identified in the text data. The relationship between entities is constructed according to the content presented in the image and the correspondence with the text description. For video data such as product promotion videos on e-commerce platforms, the video is first decomposed into multiple video frames, and then each video frame is analyzed. By analyzing the video frames, feature information such as the appearance features of the mobile phone at different angles, the gestures of the user when operating the mobile phone, and the satisfied expressions on the user's face can be extracted. Based on the analysis of the video frames, security-related information is captured, and the information extracted from the video data is integrated with the information extracted from the text and image data. The corresponding commodity entity is found through information such as the commodity logo and voice narration in the video. The various relationships presented in the video are merged with the relationships constructed in the text and image data to form a complete knowledge system about commodities and related security situations, so that they can be accurately presented in the knowledge graph later.

[0037] When performing knowledge fusion, in order to determine whether two entities should be aligned, the improved entity alignment comprehensive similarity formula is used to calculate the comprehensive similarity between entities. Suppose the two entities involved in entity alignment are entity X and entity Y. For entity X, its features are described from multiple aspects, and a feature vector set F is defined. X ={f X1 ,f X2 ,…,f Xm}, where fXi (i=1,2,…,m) represents the vector description of entity X at the i-th feature level. Each vector f Xi Also has n i Components, that is Its feature level includes the basic attributes of the entity (such as name, type, etc.), related information (such as the relationship with other entities, the category to which it belongs, etc.), behavioral characteristics (such as operating behaviors and activity patterns in specific scenarios, etc.), etc. By analyzing and quantifying the entity in detail, the vector description of each level is obtained. For entity X, at the "basic attribute" feature level, f X1 It contains the character feature vector of the product name, the classification code of the product type, and other components. At the “related information” feature level, f X2 It contains the user evaluation vector related to the product, the code of the e-commerce platform region to which it belongs, and other components. At the "behavioral characteristics" feature level, f X3 It contains the sales trend vector of the product, the promotion frequency vector, and other components. Similarly, for entity Y, its feature vector set is F Y ={f Y1 ,f Y2 ,…,f Ym},in In addition, considering the importance of semantic associations between entities in determining whether they are aligned, a semantic association matrix S is defined XY , whose dimension is m×m, where the element s ij (i,j=1,2,…,m) represents the semantic association between entity X at the i-th feature level and entity Y at the j-th feature level, with a value range of [0,1] and obtained through a specific semantic analysis method. The entity alignment comprehensive similarity Q of entity X and entity Y is XY The calculation formula is: Among them, λ ij (i,j=1,2,…,m) is the weight coefficient, satisfying It is used to weight the correlation between different feature levels and the proportion of semantic correlation in the comprehensive similarity calculation. If the calculated Q XY Greater than the preset alignment threshold θ AL , it is considered that entity X and entity Y can be aligned and merged into one entity so that relevant knowledge information can be uniformly processed in the knowledge fusion process, avoiding knowledge redundancy and improving the accuracy of subsequent analysis and processing.

[0038] When multiple entities reach or approach the alignment threshold in terms of comprehensive similarity with a certain entity during entity alignment, but there are differences between these entities, the final alignment selection is determined by the entity alignment conflict resolution formula to resolve the conflict. Suppose there is an entity E with k other entities (denoted as E1, E2, …, E k ) and entity E's entity alignment comprehensive similarity reaches or exceeds the preset alignment threshold θ AL , for each entity E i (i=1,2,…,k), assuming it has p additional attributes, denoted as The values ​​of each additional attribute are Define a conflict resolution metric To measure each entity E i The degree of advantage over entity E in a conflict situation is calculated as Among them, γ and δ are weight coefficients, and γ+δ=1, which are used to balance the proportion of the part based on the comprehensive similarity exceeding the threshold and the advantage degree based on the additional attribute value in the calculation of the conflict resolution index, w′ j (j=1,2,…,…,p) is the weight coefficient of the jth additional attribute and satisfies Used to weight different additional attributes according to their importance in resolving conflicts.

[0039] After completing knowledge fusion, the knowledge graph is constructed, with various entities determined in the ontology modeling and knowledge fusion stages as nodes of the knowledge graph. For example, entities such as "malicious product information", "risk of sensitive user information leakage", "type of network attacks against e-commerce platforms", and "platform security vulnerabilities" correspond to a node in the graph. For each node, in addition to its basic concept information, the relevant attribute information determined in the previous stage will also be associated with the node. For example, the "malicious product information" node, in addition to marking its name, will also be associated with attributes such as "false advertising content type", "infringement type", and "frequency of occurrence" and their corresponding values. According to the semantic relationships defined in the ontology modeling stage, edges are created between the corresponding nodes to represent these relationships. For example, if there is a relationship between "malicious product information" and "risk of sensitive user information leakage", If there is a connection relationship, a directed edge is created between the nodes representing the two entities. The direction of the edge can be determined according to the logical direction of the relationship. Similarly, for the correspondence between "cyber attack targeting e-commerce platform type" and "platform security vulnerability", appropriate edges are also created between their corresponding nodes. In this way, each entity node is connected through the semantic relationship edge to form a complete knowledge graph structure. A graph database is used to store the constructed knowledge graph. The graph database can efficiently handle the storage and query operations of nodes and edges, and is suitable for the data storage needs of knowledge graphs with complex relational structures. During the storage process, the metadata of the graph is managed in a standardized manner to facilitate subsequent query, update and maintenance operations. For example, a unique identifier is set for each node and edge to facilitate rapid positioning and operation of the corresponding elements in the database.

[0040] After the knowledge graph is constructed, monitoring and analysis are carried out. Real-time or regular monitoring and analysis of the web content of the e-commerce platform is carried out to discover potential security threats and abnormal situations. The latest web content-related data is continuously collected from various data sources of the e-commerce platform, including newly released product information, user comments, transaction records, platform system logs, etc. These newly collected data are processed according to the previous data processing flow, and then updated to the corresponding node and edge attributes in the knowledge graph. For example, if the newly collected user comments on a certain product mention suspected false advertising content, then the count of the "occurrence frequency" attribute of the "malicious product information" node is increased accordingly, and the value of the "false advertising content type" attribute may be further updated according to the comment content. The updated knowledge graph is then updated using pre-set rules and models. Perform anomaly detection according to the rules established in the axiom and rule establishment stage, and use deep learning models to analyze the data in the knowledge graph. For example, train a classification model to determine whether the newly collected product information belongs to the category of "malicious product information". Various features of the product information (such as text description, image features, sales data, etc.) are used as input to the model. The model makes a judgment based on the previously trained parameters and algorithms. If the model output results show that the product information has a high probability of belonging to "malicious product information", then the corresponding node in the knowledge graph is also marked as an abnormal situation, and the nodes and edges in the knowledge graph are associated with each other to discover the complex relationships and potential risks hidden in the data. Specifically, let the entity set in the knowledge graph be E = {e1, e2, ..., e N}, the relation set is R = {r1,r2,…,r M}, for entity e i , which has the attribute vector where a ij Represents entity e i The eigenvalue on the jth attribute dimension, n is the attribute dimension, for the relation r k , which has the attribute vector where a kj Represents the relationship k The eigenvalue on the jth attribute dimension, m is the attribute dimension, and the weight matrix W is defined entity Used to weight entity attributes, its elements Represents entity e i The weight coefficient on the jth attribute dimension defines the weight matrix W relation Used to weight relationship attributes, its elements Represents the relationship k The weight coefficient on the jth dimension is also determined according to the importance of the attribute in the security threat assessment. The calculation formula for the comprehensive evaluation value P of potential security threats based on the knowledge graph is: If it is found that after a certain type of malicious product information appears, user purchasing behavior shows a clear downward trend, and there is a temporal correlation with the platform's ongoing promotion activities, then it can be inferred that the malicious product information may have a negative impact on the platform's promotion activities, and then the cause can be analyzed in depth and corresponding measures can be taken.

[0041] Once an abnormal situation or valuable analysis results are found in the monitoring and analysis stage, the result display and response stage will be entered to display information to relevant personnel in a timely manner and take effective countermeasures. By developing a visual user interface, the knowledge graph and the results of the monitoring and analysis are displayed in an intuitive graphical way. On the interface, you can clearly see each node (representing different entities), edge (representing semantic relationships) and nodes or areas marked as abnormal situations. For example, the "Malicious Product Information" node is highlighted in red. If its associated "Sensitive User Information Leakage Risk" node is also in an abnormal state, the node is marked with a flashing red border so that users can see the problematic area at a glance. At the same time, the changes in relevant attribute values ​​are displayed through charts (such as bar charts, line charts, etc.), such as the curve of the change in the frequency of occurrence of "Malicious Product Information" over time, so that users can more intuitively understand the development trend of the problem.

[0042] In summary, through the above steps, the present invention can comprehensively and systematically monitor and manage the security of the web page content of the e-commerce platform, timely discover and handle various potential security threats and abnormal situations, and ensure the normal operation of the e-commerce platform and the information security of users.

[0043] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A webpage content security processing method based on knowledge graph, characterized in that: The method comprises the following specific steps: Data collection: Collect web-related Internet content data in the form of text, images and videos from network service providers, internal networks of enterprises or organizations, and website servers. According to the characteristics of data from different sources and the needs of web content security analysis, formulate adaptive collection frequency and methods, and use multimodal data fusion technology to perform real-time fusion processing on different modal data during collection, so that the collected data meets the requirements of subsequent analysis; Ontology modeling: clearly define concepts related to web content security and accurately define their scope and characteristics, determine the parent-child relationship between concepts to build a hierarchical concept system, and give specific characteristic attributes to each concept, clarify its connotation, definition method, value range and uniqueness constraint conditions, and define multiple semantic relationships and clarify the meaning and judgment criteria, formulate unified naming standards, establish axioms and rules, and clarify trigger conditions and execution logic. At the same time, establish a semantic expansion and dynamic update mechanism to automatically expand the semantics of related concepts according to new situations and review and update the ontology model according to preset cycles or specific trigger conditions; Knowledge extraction: Use natural language processing technology to pre-process different types of data to make their formats and feature representations consistent. By building a joint extraction framework that integrates multi-source heterogeneous knowledge and using the multi-head attention mechanism in deep learning to focus on key information from different data sources and types, accurate extraction of entity, relationship and attribute information can be achieved, providing a high-quality knowledge foundation for subsequent knowledge fusion and graph construction. Knowledge fusion: Similarity functions and vector space model methods are used to calculate the similarity between entities in the extracted knowledge. Entities that reach the threshold are aligned and merged according to the set similarity threshold and treated as the same entity. When entity alignment corresponds to multiple different concepts or attributes, specific algorithms and logic are used to eliminate ambiguity through in-depth analysis of semantic relationships and contextual information; Graph construction: Use a graph database to accurately import entities and relationships between entities after knowledge fusion processing into the graph database according to their format requirements through specific input interfaces and data conversion processes to build a knowledge graph, form a semantic network containing entities and relationships between entities, and clarify the storage and representation methods of each entity and relationship in the knowledge graph; Monitoring and analysis: Based on the constructed knowledge graph, set specific analysis algorithms and logic to conduct in-depth mining and analysis of entity relationships in the knowledge graph to explore potential security threats, abnormal patterns or associations; Result display and response: Use visualization technology and tools to design layout, display methods and interactive functions, display knowledge graph relationships and monitoring and analysis results, so that security personnel can take corresponding measures based on the results.

2. According to claim 1, a webpage content security processing method based on knowledge graph is characterized in that: In the data collection step, according to the characteristics of data from different sources and the requirements of web content security analysis, an adaptive collection frequency and method are formulated. For text data, the update frequency is set to f update , the importance level coefficient is I level , the preset basic acquisition frequency is f base , the adjustment coefficient is k1, and its actual acquisition frequency is f text The calculation formula is: text =f base +k1×f update ×I level For image or video data, let the data size be D, the resolution be R, and the preset maximum sampling ratio be P. max , the reference data size is D ref , the reference resolution is R ref , the adjustment coefficient is k2, and its actual sampling ratio P image / video The calculation formula is:

3. According to claim 1, a webpage content security processing method based on knowledge graph is characterized in that: In the data collection step, multimodal data fusion technology is used to perform real-time fusion processing on different modal data during collection. Specifically, the collected text data vector is represented by T = [t1, t2, ..., t n ], n is the feature dimension of text data, and the vector representation of image data after feature extraction is I = [i1, i2, ..., i m ], m is the feature dimension of image data, and the processed video data is represented by a vector V = [v1, v2, …, v k ], k is the feature dimension of video data, which is fused, and the fusion weight coefficients α, β, γ are set to satisfy α+β+γ=1. The calculation formula of the vector F after multimodal data fusion is: Among them, ||T||, ||I||, ||V|| represent the modulus of text data vector T, image data vector I, and video data vector V respectively.

4. According to the method for securely processing webpage content based on knowledge graph in claim 1, it is characterized in that: In the ontology modeling step, the parent-child relationship between concepts is determined to build a hierarchical concept system. Specifically, the two concepts to be determined are concept X and concept Y. XY The feature similarity index is S XY , and suppose there is a concept relationship impact factor set I = {i1,i2,…,i m }, where i j (j=1,2,…,m) represents the value of the jth influencing factor, m is the number of influencing factors, then the hierarchical relationship tendency value T of concept X relative to concept Y is XY The calculation formula is: Among them, w j is the weight coefficient of the jth influencing factor, where j = 1, 2, …, m, and satisfies T XY Represents the hierarchical relationship tendency value of concept X relative to concept Y, and its value range is between [0, 1]. XY When the value of is close to 1, it means that concept X is more likely to be a subclass of concept Y. When the value is close to 0, it means that concept X is not a subclass of concept Y. XY is the feature similarity index between concept X and concept Y, m is the number of influencing factors of concept relationship, i j is the value of the j-th concept relationship impact factor, w j It is the weight coefficient of the jth influencing factor, which is used to weight different influencing factors according to their importance in determining the hierarchical relationship.

5. A webpage content security processing method based on knowledge graph according to claim 4, characterized in that: In the ontology modeling step, S XY It is the feature similarity index between concept X and concept Y, and its calculation formula is: Among them, S AB Represents the feature similarity index between concept A and concept B, and its value range is between [0, 1]. AB When the value of is close, it means that the two concepts are highly similar in features. When the value is close to 0, it means that the similarity of features is very low. n is the number of feature dimensions, f Ai and f Bi are the feature values ​​of concept A and concept B on the i-th feature dimension, respectively, Ai represents its common transmission pathway, f Bi It is the quantitative analysis value of its corresponding transmission path.

6. A webpage content security processing method based on knowledge graph according to claim 1, characterized in that: In the ontology modeling step, semantic expansion of relevant concepts is automatically performed according to new situations, and the ontology model is comprehensively reviewed and updated according to a preset period or a specific trigger condition. Specifically, the set of all concepts related to webpage content security in the ontology model is M = {C1, C2, ..., C m }, where m is the total number of concepts, for each concept C j , where j = 1, 2, ..., m, and the semantic feature vector of the current version is After analyzing the new situation, the semantic feature vector of the concept in the new context is Where n is the number of semantic dimensions, the calculation formula for the conceptual system update necessity index U is: Among them, U represents the necessity index of updating the concept system. The larger its value is, the greater the gap between the concept system and the requirements in the new situation is, and the greater the necessity of updating is. m is the total number of concepts related to web content security in the ontology model, n is the number of semantic dimensions, and Concept C j The feature values ​​on the i-th semantic dimension in the current version and the new situation are compared to quantify the degree of change of each concept under the influence of the new situation, and then comprehensively evaluate the necessity of updating the entire concept system.

7. A webpage content security processing method based on knowledge graph according to claim 1, characterized in that: In the knowledge extraction step, a joint extraction framework integrating multi-source heterogeneous knowledge is constructed, and the multi-head attention mechanism in deep learning is used to simultaneously focus on key information in different data sources and types. Specifically, m different data sources and types are provided to participate in knowledge extraction. For the jth data source or type, its feature vector after feature extraction is where x ji Represents the feature value of the jth data source or type on the ith feature dimension, n is the feature dimension, and defines the query vector Key Vector Sum value vector They are: in, are the query matrix, key matrix and value matrix for the jth data source or type respectively. The corresponding vector is obtained by linearly transforming the original feature vector. Then the weight w of the jth data source or type in knowledge extraction is j The calculation formula is: Among them, h is the number of heads in the multi-head attention mechanism, d k is the scaling factor in the k-head attention calculation. According to the feature vectors of different data sources and types and the calculation of the multi-head attention mechanism, the importance weight of each data source and type in the knowledge extraction process is determined. Through the calculated weight, the knowledge extraction process pays more attention to those data sources and data types that are more important for web content security analysis.

8. A webpage content security processing method based on knowledge graph according to claim 1, characterized in that: In the knowledge fusion step, similarity function and vector space model method are used to calculate the similarity between entities in the extracted knowledge. Specifically, the two entities involved in entity alignment are entity X and entity Y. For entity X, a feature vector set F is defined. X ={f X1 ,f X2 ,…,f Xm }, where f Xi (i=1,2,…,m) represents the vector description of entity X at the i-th feature level. Each vector f Xi With n i Components, that is For entity Y, Its feature vector set is F Y ={f Y1 ,f Y2 ,…,f Ym },in Considering the importance of semantic associations between entities in determining whether they are aligned, a semantic association matrix S is defined XY , whose dimension is m×m, where the element s ij (i,j=1,2,…,m) represents the semantic association between entity X at the i-th feature level and entity Y at the j-th feature level, and its value range is between [0,1]. The entity alignment comprehensive similarity Q between entity X and entity Y is XY The calculation formula is: Among them, λ ij is the weight coefficient.

9. A webpage content security processing method based on knowledge graph according to claim 1, characterized in that: In the knowledge fusion step, when entity alignment corresponds to multiple different concepts or attributes, the ambiguity is eliminated by in-depth analysis of semantic relationships and context information using specific algorithms and logic. Specifically, suppose there is an entity E, which has k other entities, denoted as E1, E2, …, E k The comprehensive similarity of entity alignment with entity E For each entity E i , suppose it has p additional attributes, recorded as The values ​​of each additional attribute are Define a conflict resolution metric To measure each entity E i The degree of advantage over entity E in a conflict situation is calculated as: Among them, γ and δ are weight coefficients, and they satisfy γ+δ=1, which are used to balance the proportion of the part based on the comprehensive similarity exceeding the threshold and the advantage degree based on the additional attribute value in the calculation of the conflict resolution index, w j ' is the weight coefficient of the jth additional attribute and satisfies Used to weight different additional attributes according to their importance in resolving conflicts. Representing Entity E i In the case of a conflict, the larger the value of the conflict resolution index relative to entity E, the more advantageous the entity is relative to other competing entities in resolving the conflict after considering the portion of the comprehensive similarity exceeding the threshold and the additional attribute value, and the easier it is to be selected as the entity that is finally aligned with entity E.

10. A webpage content security processing method based on knowledge graph according to claim 1, characterized in that: In the monitoring and analysis step, based on the constructed knowledge graph, a specific analysis algorithm and logic are set to perform in-depth mining and analysis on the entities and relationships in the knowledge graph. Specifically, the entity set in the knowledge graph is E = {e1, e2, ..., e N }, the relation set is R = {r1,r2,…,r M }, for entity e i , which has the attribute vector where a ij Represents entity e i The eigenvalue on the jth attribute dimension, n is the attribute dimension, for the relation r k , which has the attribute vector where a kj Represents the relationship k The eigenvalue on the jth attribute dimension, m is the attribute dimension, and the weight matrix W is defined entity Used to weight entity attributes, its elements Represents entity e i The weight coefficient on the jth attribute dimension defines the weight matrix W relation Used to weight relationship attributes, its elements Represents the relationship k The weight coefficient on the jth dimension is also determined according to the importance of the attribute in the security threat assessment. The calculation formula for the comprehensive evaluation value P of potential security threats based on the knowledge graph is:

Images