Bad website identification method, device, electronic device and medium

Abstract

The present disclosure provides a method, device, electronic device and medium for identifying bad websites, and relates to the field of data processing, and in particular to the field of web page processing and search engines. A method for identifying bad websites includes: determining a first website among multiple websites that meets a traffic diversion target condition; determining a set of associated websites of the first website from the multiple websites according to the pointing relationship between the multiple websites, each website in the set of associated websites has a link to the first website; and in response to determining that the first website meets the bad website condition, identifying the website in the set of associated websites as a bad website.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, in particular to web page processing and search engines, and specifically to a method, device, electronic device, computer-readable storage medium and computer program product for identifying bad websites. Background Art

[0002] The Internet is made up of a large number of websites, the quality of which varies greatly. In particular, there are some bad cheating websites that divert traffic to other websites through links in websites or web pages, thereby affecting search rankings, etc. In particular, when the diverted websites involve bad content or black and gray industries, such bad websites have an extremely bad impact on the Internet ecological environment. It is necessary to identify and suppress these websites to improve the Internet ecological environment.

[0003] Therefore, a method is needed to effectively identify bad websites from a large number of websites. Summary of the invention

[0004] The present disclosure provides a method, device, electronic device, computer-readable storage medium and computer program product for identifying bad websites.

[0005] According to one aspect of the present disclosure, a method for identifying bad websites is provided, comprising: determining a first website among multiple websites that meets a diversion target condition; determining a set of associated websites of the first website from the multiple websites based on a pointing relationship between the multiple websites, each website in the set of associated websites having a link to the first website; and in response to determining that the first website meets a bad website condition, identifying a website in the set of associated websites as a bad website.

[0006] According to another aspect of the present disclosure, a device for identifying bad websites is provided, including: a traffic diversion target determination unit, used to determine a first website among multiple websites that meets a traffic diversion target condition; an associated website determination unit, used to determine an associated website set of the first website from the multiple websites based on a pointing relationship between the multiple websites, each website in the associated website set has a link to the first website; and a bad website identification unit, used to identify a website in the associated website set as a bad website in response to determining that the first website meets a bad website condition.

[0007] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for identifying bad websites according to an embodiment of the present disclosure.

[0008] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method for identifying bad websites according to an embodiment of the present disclosure.

[0009] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for identifying bad websites according to an embodiment of the present disclosure is implemented.

[0010] According to one or more embodiments of the present disclosure, bad websites in a network can be effectively identified.

[0011] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0013] Figure 1 A schematic diagram showing an exemplary system in which the various methods described herein may be implemented according to an embodiment of the present disclosure;

[0014] Figure 2 A flowchart of a method for identifying bad websites according to an embodiment of the present disclosure is shown;

[0015] Figure 3 A schematic diagram showing the relationship between websites according to an embodiment of the present disclosure;

[0016] Figure 4A and Figure 4B A flowchart showing some optional steps of the bad website identification method according to an embodiment of the present disclosure;

[0017] Figure 5 A structural block diagram of a bad website identification device according to an embodiment of the present disclosure is shown;

[0018] Figure 6 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0019] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0020] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, timing relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0021] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0022] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0023] Figure 1 FIG. 1 is a schematic diagram of an exemplary system 100 in which various methods and apparatuses described herein may be implemented according to an embodiment of the present disclosure. Figure 1 , the system 100 includes one or more client devices 101, 102, 103, 104, 105, and 106, a server 120, and one or more communication networks 110 coupling the one or more client devices to the server 120. The client devices 101, 102, 103, 104, 105, and 106 may be configured to execute one or more applications.

[0024] In an embodiment of the present disclosure, the server 120 may run one or more services or software applications that enable the bad website identification method to be performed.

[0025] In some embodiments, server 120 may also provide other services or software applications that may include non-virtualized environments and virtualized environments. In some embodiments, these services may be provided as web-based services or cloud services, such as provided to users of client devices 101, 102, 103, 104, 105, and / or 106 under a software as a service (SaaS) model.

[0026] exist Figure 1 In the configuration shown, the server 120 may include one or more components that implement the functions performed by the server 120. These components may include software components, hardware components, or a combination thereof that can be executed by one or more processors. Users operating client devices 101, 102, 103, 104, 105, and / or 106 may in turn utilize one or more client applications to interact with the server 120 to utilize the services provided by these components. It should be understood that a variety of different system configurations are possible, which may differ from the system 100. Therefore, Figure 1 is one example of a system for implementing the various methods described herein and is not intended to be limiting.

[0027] The user can use the client device 101, 102, 103, 104, 105 and / or 106 to control the server to identify and process bad websites, view identification results and processing results, etc. The client device can provide an interface that enables the user of the client device to interact with the client device. The client device can also output information to the user via the interface. Figure 1 Only six client devices are depicted, but one skilled in the art will appreciate that the present disclosure may support any number of client devices.

[0028] Client devices 101, 102, 103, 104, 105 and / or 106 may include various types of computer devices, such as portable handheld devices, general-purpose computers (such as personal computers and laptop computers), workstation computers, wearable devices, smart screen devices, self-service terminal devices, service robots, game systems, thin clients, various messaging devices, sensors or other sensing devices, etc. These computer devices may run various types and versions of software applications and operating systems, such as MICROSOFT Windows, APPLE iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as GOOGLE Chrome OS); or include various mobile operating systems, such as MICROSOFT Windows Mobile OS, iOS, Windows Phone, Android. Portable handheld devices may include cellular phones, smart phones, tablet computers, personal digital assistants (PDAs), etc. Wearable devices may include head-mounted displays (such as smart glasses) and other devices. Game systems may include various handheld game devices, Internet-enabled game devices, etc. Client devices are capable of executing various different applications, such as various Internet-related applications, communication applications (such as email applications), short message service (SMS) applications, and may use various communication protocols.

[0029] The network 110 may be any type of network known to those skilled in the art that may support data communications using any of a variety of available protocols, including but not limited to TCP / IP, SNA, IPX, etc. By way of example only, the one or more networks 110 may be a local area network (LAN), an Ethernet-based network, a token ring, a wide area network (WAN), the Internet, a virtual network, a virtual private network (VPN), an intranet, an extranet, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., Bluetooth, WIFI), and / or any combination of these and / or other networks.

[0030] Server 120 may include one or more general purpose computers, dedicated server computers (e.g., PC (personal computer) servers, UNIX servers, mid-range servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and / or combination. Server 120 may include one or more virtual machines running virtual operating systems, or other computing architectures involving virtualization (e.g., one or more flexible pools of logical storage devices that may be virtualized to maintain a server's virtual storage device). In various embodiments, server 120 may run one or more services or software applications that provide the functionality described below.

[0031] The computing units in the server 120 may run one or more operating systems including any of the above operating systems and any commercially available server operating systems. The server 120 may also run any of a variety of additional server applications and / or middle-tier applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, etc.

[0032] In some implementations, server 120 may include one or more applications to analyze and consolidate data feeds and / or event updates received from users of client devices 101, 102, 103, 104, 105, and 106. Server 120 may also include one or more applications to display data feeds and / or real-time events via one or more display devices of client devices 101, 102, 103, 104, 105, and 106.

[0033] In some embodiments, the server 120 may be a server of a distributed system, or a server combined with a blockchain. The server 120 may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. A cloud server is a host product in a cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0034] The system 100 may also include one or more databases 130. In some embodiments, these databases may be used to store data and other information. For example, one or more of the databases 130 may be used to store information such as audio files and video files. The databases 130 may reside in various locations. For example, the database used by the server 120 may be local to the server 120, or may be remote from the server 120 and may communicate with the server 120 via a network-based or dedicated connection. The databases 130 may be of different types. In some embodiments, the databases used by the server 120 may be, for example, relational databases. One or more of these databases may store, update, and retrieve data to and from the databases in response to commands.

[0035] In some embodiments, one or more of the databases 130 may also be used by applications to store application data. The databases used by the applications may be different types of databases, such as a key-value store, an object store, or a conventional store backed by a file system.

[0036] Figure 1 The system 100 may be configured and operated in various ways to enable the application of various methods and apparatuses described in the present disclosure.

[0037] Reference below Figure 2 The bad website identification method 200 according to an embodiment of the present disclosure is described.

[0038] At step 210, a first website among a plurality of websites that meets a traffic diversion target condition is determined.

[0039] At step 220, based on the pointing relationship between the multiple websites, a set of associated websites of the first website is determined from the multiple websites, and each website in the set of associated websites has a link pointing to the first website.

[0040] At step 230 , in response to determining that the first website satisfies the undesirable website condition, a website in the associated website set is identified as an undesirable website.

[0041] Through the method 200, bad websites in the network can be effectively identified.

[0042] In the black and gray industries, there is often such a pattern: one person or a team operates multiple websites to obtain a large amount of traffic through search engines, or points links to the same website to improve search rankings. Method 200 cleverly uses the topological and drainage characteristics of cheating websites to identify them as a whole. Specifically, the target drainage website can be preliminarily identified first, and then based on the target drainage website being a black and gray industry website, multiple associated websites that drain traffic to the target website are obtained. Determining that the target website is a black and gray industry website only requires a simple judgment of the quality of a website, thereby, it can be determined with a significantly reduced amount of calculation that multiple websites pointing to the single target website are all bad websites used for drainage.

[0043] On the contrary, in the existing technology, it is often necessary to analyze the quality and link direction of each website to determine whether the current website is a bad website or a website used for traffic diversion. The amount of calculation and computing resources required are very large, and the essential correlation characteristics of cheating websites are not mined. In addition, the website used for traffic diversion may not look different from ordinary websites on the surface, so judging only from the page itself will also be less effective.

[0044] refer to Figure 3 As an example, a first website 310 and an associated website collection 360 are shown, wherein the associated website collection 360 includes example websites 320, 330, 340, and 350, which respectively have web pages 321, 331, 341, and 351 pointing to the web page 311 in the first website 310. It can be understood that the number of websites, the number of web pages, the pointing relationship, etc. here are only examples. For example, the website collection 360 may include fewer or more websites, each website may have a larger number of web pages, one or each of the websites 320, 330, 340, and 350 may have multiple web pages pointing to the website 310 (not shown), the websites 320, 330, 340, and 350 may point to multiple web pages of the first website or different web pages in the first website, the websites 320, 330, 340, and 350 may have more mutual pointing relationships or these websites may not have links to each other at all, etc. It will be understood by those skilled in the art that the present disclosure is not limited to this.

[0045] According to some embodiments, determining the associated website set of the first website may include obtaining websites among multiple websites that have links pointing to the first website and meet a clustering condition, wherein the clustering condition includes at least one of the following: having the same IP address and being from the same region.

[0046] Multiple associated websites pointing to the target website often have certain clustering characteristics. For example, in actual operations, these cheating websites are often purchased and collectively diverted, so they often have the same IP address, the same region, etc. When the target website is obtained and multiple associated websites diverting traffic to the target website are obtained, the clustering conditions are also judged. By screening through simple features of IP and region, the correlation characteristics between the diversion cheating websites can be more accurately identified, and other websites can be prevented from being accidentally harmed.

[0047] According to some embodiments, determining the set of associated websites of the first website may include obtaining websites among multiple websites that have links pointing to the first website and satisfy the abnormal website condition. Instead of the aggregation condition, or in combination with the aggregation condition, the abnormal conditions of the associated websites may also be determined, that is, the "multiple websites" pointing to the target diverted website themselves have certain quality problems - even if these websites may appear to be normal websites to the naked eye or at the code level. The abnormal website condition may be summarized based on experience or continuously updated.

[0048] According to some embodiments, abnormal website conditions may include at least one of the following: the internal link value is within the predetermined internal link value range, the website scale is within the predetermined website scale range, and the life time is within the predetermined life time range. For example, the number of internal links, the proportion of internal links, the website scale, and the life time of a normal website are often within a specific range. Websites that are too large or too small, websites with too many or too few internal links, and websites with too short life time are often abnormal. Abnormal website conditions may also include other features, such as the number and proportion of external links, IP address attributes (for example, experience has found that IPs that fall into certain specific areas indicate a higher probability of being cheating websites). The judgment of abnormal website conditions may include detecting and judging a predetermined number or a predetermined proportion of pages in the website. For example, a predetermined number (one or more) of pages may be randomly selected, or the homepage of the website, the largest page, the page with the most visits, or the page with the most links, etc. may be obtained as typical pages, and the quality of these pages may be used to estimate the quality of the entire website. It is understandable that the above scheme is only an example, and the present disclosure is not limited thereto.

[0049] According to some embodiments, websites that meet the abnormal website conditions can be determined by using a pre-trained model. Using model recognition can identify more, more hidden, and richer features. In addition to the above features, other feature descriptions of the website can also be included, especially other potential feature associations that are not manually identified. As a result, the characteristics of bad diversion websites can be more accurately and comprehensively identified.

[0050] For example, a neural network can be trained using data from pre-labeled traffic-generating websites and non-traffic-generating websites (and / or a certain number of web pages selected or randomly extracted from such websites), so that the trained neural network can identify whether a website is a bad traffic-generating website based on the characteristics of the website or web page.

[0051] According to some embodiments, the diversion target condition may include at least one of the following: more than a first threshold of websites among multiple websites point to the first website, and more than a second threshold of links among multiple websites point to the first website. Identifying websites pointed to by a large number of websites / links as target diversion websites, as a preliminary screening method, can effectively reduce the amount of calculation compared to the algorithm that performs quality screening one by one in a large number of websites and determines whether they are black and gray industry websites. Optionally, after obtaining one or more first websites suspected of being diversion target websites through the number of websites and / or the number of links, high-quality websites can be eliminated from them-because some very high-quality websites will also have a large number of websites referencing their pages and links pointing to their pages. This can be achieved by comparing with a pre-set white list of high-quality websites, or by comparing the features of other high-quality websites, and those skilled in the art will understand that the present disclosure is not limited to this.

[0052] In some alternative embodiments, the first website that meets the drainage target condition can also be obtained based on the quality of the web page or other pre-screening conditions. For example, in the case where a certain website has been identified as a cheating website, a black and gray industry website or other target website that needs to be suppressed by other methods, it is not necessary to make an additional judgment on the number of links, and the website can be considered to meet the target drainage condition. As another alternative embodiment, the drainage target condition can be similar or identical to the "bad website condition" in step 230. For example, the drainage target condition can adopt a bad website condition (for example, a page involves a black and gray industry, etc.), and the associated website set obtained based on the first website judged in this way can be identified as a bad website without the need for a secondary judgment step. Alternatively, the drainage target condition can be similar to the bad website condition, but as a judgment step, a coarser granularity can be used, and a higher standard bad website standard judgment is performed after the associated drainage website set is screened out, thereby further saving the amount of calculation.

[0053] According to some embodiments, after identifying a website in the associated website collection as a bad website, the method may further include performing at least one of the following on the website in the associated website collection: reducing inclusion, deleting index, and adjusting search ranking algorithm rules to reduce the ranking of the bad website.

[0054] As a result, not only the identified target black and gray websites can be suppressed, but also the drainage websites can be suppressed, which will further optimize the accuracy and rationality of the search engine's ranking results.

[0055] As an example, the associated website set can point to multiple target diversion websites (also called target support websites), and the processing method of the associated website set can be determined according to the quality of the target website. If the target site is basically a black and gray production, low-quality website, the associated website set should be suppressed as a whole. If the target site is basically a normal, high-quality website, the associated website set can be continuously observed and monitored, and no suppression is done for the time being. As described above, the suppression method may include reducing the inclusion, indexing, search ranking suppression, etc., or other means of regulating cheating diversion websites that will be understood by those skilled in the art.

[0056] Reference below Figure 4A The method 410 for acquiring pointing relationships between multiple websites according to some embodiments of the present disclosure may also be referred to as the site relationship mining method 410 .

[0057] At step 411, web pages are extracted from multiple websites. For example, for each of the multiple websites, typical web pages, a predetermined number of web pages, web pages with the most links, web pages with the largest scale, and randomly selected web pages can be screened out. Alternatively, multiple (or even all) web pages in a website can be selected.

[0058] At step 412, links are extracted from the extracted web pages.

[0059] At step 413, a relationship between web pages is established based on the links within the web pages, that is, a mutual pointing relationship at the web page level.

[0060] At step 414, the relationship between websites is generated based on the relationship between web pages established in step 413, that is, the relationship between web pages is converted into the relationship between websites. Figure 3 The relationship network shown in FIG. In this process, the relationships between web pages are classified and screened. Specifically, the inter-site relationships (external links) are used to screen the collection of related websites, and when analyzing the inter-site relationships, there is no need to analyze the intra-site relationships (internal links), but internal link features such as the number of internal links, the proportion of internal links, etc. can be retained as quality features of the website (for example, used in the website quality assessment as described above).

[0061] It is understandable that the above acquisition method is only an example, and the bad website identification method according to one or more embodiments of the present disclosure can utilize the pointing relationship between websites acquired in other ways and still achieve beneficial effects.

[0062] Reference below Figure 4B A method 420 of determining an associated website collection according to one or more embodiments of the present disclosure is described.

[0063] At step 421, a suspicious website set is determined based on the pointing relationship between the websites. After obtaining the target traffic diversion website, based on the association relationship between the target support station and the website, a website set that diverts traffic to this website is determined, and this set is used as a suspicious website set. As described above, the target traffic diversion website can be determined based on a large number of pages in the website being pointed to and diverted, or based on other target traffic diversion conditions, etc., and will not be repeated here.

[0064] At step 422, by determining whether the conditions for diverting traffic to bad websites are met, such as the aggregation conditions and / or abnormal website conditions described above, a set of associated websites is obtained.

[0065] As an example, step 422 may include judging whether these websites meet the aggregation condition based on IP distribution. For example, the website IP in the suspicious website set may be first obtained and split into the same IP, different IP, same region, different region, etc. If the suspicious website set contains a large number of websites with the same IP, since a large number of websites with the same IP simultaneously point to a certain target, it can be basically determined as an associated drainage website of the first website. If the suspicious website set contains a large number of different IPs, the IP region analysis, such as the presence of a large number of IPs in a common region or a specific region, means a higher possibility of drainage. At this time, the suspicious website may also be considered to be an associated drainage website of the first website, or it may be further judged in combination with the webpage quality. As described above, the treatment of the website or webpage may be evaluated based on one or more dimensions of webpage quality (e.g., internal links, external links, scale, etc.), and optionally, the model may be further used to identify. If a portion of the websites in the suspicious website set meets the aggregation condition or the abnormal website condition, a subset of the portion of the websites may be used as an associated website set for diverting traffic to the first website. It can be understood that the steps here are only examples. For example, the aggregation condition can be used alone, the abnormal website condition can be used alone, or a combination or partial combination thereof. The aggregation condition can use the IP aggregation condition alone, the regional aggregation condition alone, or both, etc., and the present disclosure is not limited to this.

[0066] At step 423, normal or easily mistakenly damaged websites in the associated website set are excluded or adjusted to obtain an updated associated website set. For example, some user-generated content (UGC) websites are easily passively involved and mistakenly damaged in such a judgment process because they contain a large number of user-generated links, but such websites themselves are not established as traffic diversion websites, so they can be excluded, or marked and processed differently (for example, a label can be added to the website to mark the suspicious content or the tendency to divert traffic, and the sorting algorithm can be appropriately adjusted in subsequent processing, etc., rather than simply deleting the collection or index of the website).

[0067] At optional step 424, other target drainage websites can also be obtained based on the associated website set. In practice, a common situation is that such a cheating website set will support multiple target websites. For example, the determined associated drainage website set not only drains the first website, but also points to the second website (as well as the third website, the fourth website, etc.). According to this pointing relationship between websites, it can be easily judged that the second website is also a cheating or black and gray industry website. Afterwards, multiple target websites and associated website sets can be suppressed. The specific processing method has been given as an example in the previous text, and will not be repeated here.

[0068] According to one or more embodiments of the present disclosure, the source of cheating can be controlled, thereby enabling more efficient and accurate identification of cheating websites.

[0069] Reference below Figure 5 A bad website identification device 500 according to an embodiment of the present disclosure is described. The device 500 may include a traffic diversion target determination unit 51, an associated website determination unit 520, and a bad website identification unit 530. The traffic diversion target determination unit 510 is used to determine a first website that meets the traffic diversion target condition among multiple websites. The associated website determination unit 520 is used to determine a set of associated websites of the first website from multiple websites based on the pointing relationship between the multiple websites, and each website in the associated website set has a link to the first website. The bad website identification unit 530 is used to identify a website in the associated website set as a bad website in response to determining that the first website meets the bad website condition.

[0070] According to some embodiments, the associated website determination unit 520 may include a unit for acquiring websites among multiple websites that have links pointing to the first website and satisfy an aggregation condition, wherein the aggregation condition includes at least one of the following: having the same IP address and being from the same region.

[0071] According to some embodiments, the associated website determination unit 520 may include a unit for determining the associated website set of the first website including acquiring a website having a link to the first website and satisfying an abnormal website condition from among the plurality of websites.

[0072] According to some embodiments, the abnormal website condition may include at least one of the following: the inlink value is within a predetermined inlink value range, the website scale is within a predetermined website scale range, and the life time is within a predetermined life time range.

[0073] According to some embodiments, websites satisfying abnormal website conditions may be determined by using a pre-trained model.

[0074] According to some embodiments, the traffic target condition may include at least one of the following: more than a first threshold of websites among multiple websites point to the first website, and more than a second threshold of links among the links of the multiple websites point to the first website.

[0075] According to some embodiments, the device 500 may also include a unit that, after identifying a website in the associated website collection as a bad website, performs at least one of the following on the website in the associated website collection: reducing inclusion, deleting the index, and adjusting the search ranking algorithm rules to reduce the ranking of the bad website.

[0076] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0077] According to an embodiment of the present disclosure, an electronic device, a readable storage medium and a computer program product are also provided.

[0078] refer to Figure 6 , a block diagram of an electronic device 600 that can be used as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0079] like Figure 6 As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0080] Multiple components in the device 600 are connected to the I / O interface 605, including: an input unit 606, an output unit 607, a storage unit 608, and a communication unit 609. The input unit 606 can be any type of device that can input information to the device 600. The input unit 606 can receive input digital or character information and generate key signal input related to user settings and / or function control of the electronic device, and can include but is not limited to a mouse, a keyboard, a touch screen, a track pad, a track ball, a joystick, a microphone, and / or a remote controller. The output unit 607 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 608 can include but is not limited to a disk, an optical disk. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a 1302.11 device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0081] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as method 200 and optional methods 410, 420, etc. For example, in some embodiments, method 200 and optional methods 410, 420, etc. may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the method 200 described above and optional methods 410, 420, etc. may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to execute the method 200 and the optional methods 410 , 420 , etc. in any other appropriate manner (eg, by means of firmware).

[0082] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0083] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0084] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0085] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0086] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0087] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0088] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0089] Although the embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it should be understood that the above-mentioned methods, systems and devices are merely exemplary embodiments or examples, and the scope of the present invention is not limited by these embodiments or examples, but only by the claims after authorization and their equivalent scope. Various elements in the embodiments or examples can be omitted or replaced by their equivalent elements. In addition, each step can be performed in an order different from that described in the present disclosure. Further, the various elements in the embodiments or examples can be combined in various ways. It is important that with the evolution of technology, many elements described herein can be replaced by equivalent elements that appear after the present disclosure.

Claims

1. A method for identifying bad websites, comprising: Determine the pointing relationship between websites in multiple websites; Determine a first website that meets a traffic diversion target condition according to the pointing relationship, wherein the traffic diversion target condition includes at least one of the following items: more than a first threshold of websites among the multiple websites point to the first website, and more than a second threshold of links among the links of the multiple websites point to the first website; Determining a suspicious website set having links pointing to the first website according to the pointing relationship between the websites; Obtaining the associated website set by determining whether the website in the suspicious website set meets the conditions for diverting traffic to the bad website, including at least one of the aggregation condition and the abnormal website condition; Eliminate or adjust normal or easily damaged websites in the associated website collection to obtain an updated associated website collection; In response to determining that the first website satisfies the undesirable website condition, identifying each website in the updated set of associated websites as an undesirable website; and Based on the updated associated website set, other diverted websites are obtained and suppressed.

2. The method according to claim 1, wherein: Obtaining the updated associated website set includes acquiring websites in the associated website set that have links pointing to the first website and meet a clustering condition, wherein the clustering condition includes at least one of the following: having the same IP address and being from the same region.

3. The method according to claim 1, wherein: The abnormal website condition includes at least one of the following: the internal link value is within a predetermined internal link value range, the website scale is within a predetermined website scale range, and the life time is within a predetermined life time range.

4. The method according to claim 1, wherein: Websites satisfying the abnormal website conditions are determined by using a pre-trained model.

5. The method according to any one of claims 1 to 4, wherein: After identifying the websites in the updated associated website collection as bad websites, the method further includes performing at least one of the following items on the websites in the updated associated website collection: reducing the inclusion, deleting the index, and adjusting the search ranking algorithm rules to reduce the ranking of the bad websites.

6. A device for identifying bad websites, comprising: The drainage target determination unit is used to: Determine the pointing relationship between the websites in the plurality of websites, and A first website that satisfies a traffic diversion target condition based on the pointing relationship, wherein the traffic diversion target condition includes at least one of the following items: more than a first threshold of websites among the multiple websites point to the first website, and more than a second threshold of links among the links of the multiple websites point to the first website; The associated website determination unit is used to: Determining a suspicious website set having links pointing to the first website according to the pointing relationship between the websites; Obtaining the associated website set by determining whether the website in the suspicious website set meets the conditions for diverting traffic to the bad website, including at least one of the aggregation condition and the abnormal website condition; Eliminate or adjust normal or easily damaged websites in the associated website collection to obtain an updated associated website collection; and Bad Website Identification Unit, used to: In response to determining that the first website satisfies the undesirable website condition, identifying a website in the updated set of associated websites as an undesirable website; and Based on the updated associated website set, other diverted websites are obtained and suppressed.

7. The device according to claim 6, wherein: Obtaining the updated associated website set includes acquiring websites in the associated website set that have links pointing to the first website and meet a clustering condition, wherein the clustering condition includes at least one of the following: having the same IP address and being from the same region.

8. The device according to claim 6, wherein: The abnormal website condition includes at least one of the following: the internal link value is within a predetermined internal link value range, the website scale is within a predetermined website scale range, and the life time is within a predetermined life time range.

9. The device according to claim 6, wherein: Websites satisfying the abnormal website conditions are determined by using a pre-trained model.

10. The device according to any one of claims 6 to 9, wherein: The device also includes a unit that, after identifying a website in the updated associated website collection as a bad website, performs at least one of the following on the website in the updated associated website collection: reducing inclusion, deleting index, and adjusting search ranking algorithm rules to reduce the ranking of bad websites.

11. An electronic device, comprising: at least one processor; as well as a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

13. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images