An information processing method and apparatus

Abstract

The present invention discloses an information processing method and apparatus. By obtaining a piece of retrieval information for a retrieval object, at least one feature information is extracted from the retrieval information based on a predefined feature information extraction method, and each feature information is weighted respectively according to a predefined weight assignment method to determine the information weight value of each feature information. Based on the logical relationship between the feature information, an additional weight value of the retrieval information is determined, and the information weight value of each feature information is added to the additional weight value to obtain the total weight value of the retrieval information. The present invention can evaluate the information value and importance of the retrieval information for determining the identity information of the retrieval information based on the calculated total weight value of the retrieval information, and effectively realize the quantitative evaluation of the information value and importance of the retrieval information.

Description

Technical Field

[0001] The present invention relates to computer science and technology, and particularly to an information processing method and apparatus. Background Art

[0002] With the development of science and technology, information processing technology has been continuously improved.

[0003] Currently, there are information retrieval scenarios where it is necessary to retrieve relevant information of a certain object in an information source (such as some information retrieval platforms). For example, when it is necessary to trace the identity of a certain network attacker, it is necessary to retrieve the identity information of the network attacker in different information sources.

[0004] Specifically, the prior art can retrieve for a retrieval object in different information sources to obtain retrieval result information from different information sources. Each piece of retrieval result information can include the identity information of the retrieved retrieval object, such as name and mobile phone number. In the face of a relatively large number of retrieval result information that may be retrieved, the prior art needs to identify the retrieval result information with higher information value or higher importance from it.

[0005] However, the prior art cannot effectively identify the information value of the retrieval result information. Summary of the Invention

[0006] In view of the above problems, the present invention provides an information processing method and apparatus that overcome the above problems or at least partially solve the above problems, and the technical solutions are as follows:

[0007] An information processing method includes:

[0008] Obtaining a piece of retrieval information for a retrieval object;

[0009] Extracting at least one feature information from the retrieval information based on a predefined feature information extraction method;

[0010] Assigning weights to each of the feature information respectively according to a predefined weight assignment method to determine the information weight values of each of the feature information;

[0011] Determining an additional weight value of the retrieval information based on the logical relationship between the feature information;

[0012] Adding the information weight values of each of the feature information to the additional weight value to obtain the total weight value of the retrieval information.

[0013] Optionally, the method further includes:

[0014] Obtaining multiple pieces of retrieval information for the retrieval object;

[0015] Determine the total weight value of each of the retrieved information respectively;

[0016] Sort each of the retrieved information in descending order according to the total weight value, and output the sorting result of each of the retrieved information.

[0017] Optionally, the step of assigning weights to each of the feature information according to a predefined weight assignment method includes:

[0018] Based on a predefined first relationship table that stores the feature information and the associated degree value, determine the associated degree value corresponding to each of the feature information respectively;

[0019] Based on the associated degree value corresponding to each of the feature information and a predefined second relationship table that stores the associated degree value and the information weight value, assign the corresponding information weight value to each of the feature information respectively.

[0020] Optionally, the step of determining the additional weight value of the retrieved information based on the logical relationship between each of the feature information includes:

[0021] In the retrieved information, if there is a corroboration relationship between different feature information, determine that the additional weight value is a preset weight value greater than zero.

[0022] Optionally, the step of determining the additional weight value of the retrieved information based on the logical relationship between each of the feature information includes:

[0023] In the retrieved information, if there is a negative relationship between different feature information, determine that the additional weight value is a preset weight value less than zero.

[0024] An information processing device includes: a first obtaining unit, a first extracting unit, a first weighting unit, a first determining unit, a second determining unit, a first adding unit, and a second obtaining unit; wherein:

[0025] The first obtaining unit is configured to obtain a piece of retrieved information for a retrieval object;

[0026] The first extracting unit is configured to extract at least one feature information from the retrieved information based on a predefined feature information extraction method;

[0027] The first weighting unit is configured to assign weights to each of the feature information according to a predefined weight assignment method;

[0028] The first determining unit is configured to determine the information weight value of each of the feature information;

[0029] The second determination unit is configured to determine an additional weight value of the retrieval information based on the logical relationship between the respective feature information;

[0030] The first addition unit is configured to add the information weight values of the respective feature information and the additional weight value;

[0031] The second obtaining unit is configured to obtain the total weight value of the retrieval information.

[0032] Optionally, the apparatus further includes: a third obtaining unit, a third determination unit, a sorting unit, and an output unit;

[0033] The third obtaining unit is configured to obtain multiple pieces of retrieval information for the retrieval object;

[0034] The third determination unit is configured to respectively determine the total weight value of each piece of retrieval information;

[0035] The sorting unit is configured to sort each piece of retrieval information in descending order of the total weight value;

[0036] The output unit is configured to output the sorting result of each piece of retrieval information.

[0037] Optionally, the first weight assignment unit includes: a fourth determination unit and a second weight assignment unit;

[0038] The fourth determination unit is configured to respectively determine the association degree value corresponding to each piece of feature information based on a first relationship table that is predefined and stores the feature information and the association degree value;

[0039] The second weight assignment unit is configured to respectively assign corresponding information weight values to each piece of feature information based on the association degree value corresponding to each piece of feature information and a second relationship table that is predefined and stores the association degree value and the information weight value.

[0040] Optionally, the second determination unit is configured to, in the retrieval information, if there is a corroboration relationship between different pieces of feature information, determine that the additional weight value is a preset weight value greater than zero.

[0041] Optionally, the second determination unit is configured to, in the retrieval information, if there is a negation relationship between different pieces of feature information, determine that the additional weight value is a preset weight value less than zero.

[0042] The information processing method and device proposed in this embodiment obtain a piece of retrieval information for a retrieval object, extract at least one piece of feature information from the retrieval information based on a predefined feature information extraction method, assign weights to each piece of feature information respectively according to a predefined weight assignment method, determine the information weight value of each piece of feature information, determine the additional weight value of the retrieval information based on the logical relationship between each piece of feature information, and add the information weight value of each piece of feature information and the additional weight value to obtain the total weight value of the retrieval information. The present invention can evaluate the information value and importance of the retrieval information for determining the identity information of the retrieval information based on the calculated total weight value of the retrieval information, and effectively realize the quantitative evaluation of the information value and importance of the retrieval information.

[0043] The above description is only an overview of the technical solution of the present invention. In order to understand the technical means of the present invention more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable, the specific embodiments of the present invention are specifically described below. Brief Description of the Drawings

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0045] Figure 1 The flowchart of the first information processing method provided by the embodiment of the present invention is shown;

[0046] Figure 2 The flowchart of the second information processing method provided by the embodiment of the present invention is shown;

[0047] Figure 3 The structural schematic diagram of the first information processing device provided by the embodiment of the present invention is shown. Detailed Description of the Embodiments

[0048] The exemplary embodiments of the present invention will be described in more detail below with reference to the drawings. Although the exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0049] As Figure 1 shown, the first information processing method is proposed in this embodiment, and the method may include the following steps:

[0050] S101. Obtain a piece of retrieval information for the retrieval object;

[0051] Among them, the retrieval object can be an object that needs to obtain relevant information by performing information retrieval in at least one information source (such as an information retrieval platform). For example, the retrieval object can be a cyber attacker who needs to retrieve identity information in multiple information sources to obtain identity information.

[0052] Among them, the retrieval information can be a piece of result information retrieved by performing information retrieval on the retrieval object in a certain information source.

[0053] Optionally, the retrieval information may include information such as the name, mobile phone number, ID number, and / or nationality of the retrieval object.

[0054] It should be noted that the present invention can initiate an information retrieval of the retrieval object by inputting a certain information or combined information of the retrieval object into the information source. Among them, the combined information can be information composed of multiple pieces of information.

[0055] S102. Extract at least one piece of feature information from the retrieval information based on a predefined feature information extraction method;

[0056] Among them, the feature information can be information reflecting the individual characteristics or attributes of the retrieval object. For example, when the retrieval object is a certain cyber attacker, the feature information can be the name of the cyber attacker or the IP address of the cyber attacker.

[0057] Optionally, the feature information extraction method can be a rule formulated by a technician to identify at least one feature word and extract the feature information corresponding to each identified feature word respectively; optionally, the feature information extraction method can also be a method of identifying at least one specified feature word through an existing feature information extraction tool and extracting the feature information corresponding to each identified feature word respectively.

[0058] Among them, the feature word can be a word pre-specified by a technician that can reflect the individual characteristics or attributes of the retrieval object. For example, when the retrieval object is a certain cyber attacker, the keyword can be "name" or "IP address".

[0059] Specifically, according to the feature information extraction method, the present invention can first identify one or more feature words in the retrieval information, and then extract the feature information corresponding to each feature word from the retrieval information respectively. For example, when a specified feature word is "name", the present invention can, according to the feature information extraction method, first identify "name" in the retrieval information, and then extract the sentence where "name" is located from the retrieval information and determine it as the feature information of "name".

[0060] Optionally, the feature information extraction method can also be a rule formulated by a technician that can directly identify the feature information from the retrieval information and extract the identified feature information, such as a rule for directly identifying and extracting nationality information.

[0061] Optionally, the present invention can also pre-define the identification methods of relevant feature information of the retrieval object in advance, such as pre-defining the identification methods of feature information such as mobile phone number, email, nationality, and address. Then, the present invention can use the pre-defined feature information identification method to identify and extract relevant feature information from the retrieval information for the retrieval object.

[0062] S103. According to the pre-defined weight assignment method, assign weights to each feature information respectively to determine the information weight value of each feature information;

[0063] Among them, the weight assignment method can be a method of assigning weights to feature information pre-defined by a technician according to the degree of association between the feature information and the retrieval object.

[0064] It should be noted that when the degree of association between the feature information and the retrieval object is higher, the information weight value of the feature information can be higher; when the degree of association between the feature information and the retrieval object is lower, the information weight value of the feature information can be lower.

[0065] Among them, if the pointing accuracy of the feature information to the retrieval object is higher, the degree of association between the feature information and the retrieval object is higher. For example, for the ID number and the name, since the ID number can point to a unique object, while the name may be repeated and cannot point to a unique object, therefore, compared with the name, the ID number has a higher degree of association with the retrieval object.

[0066] Specifically, the present invention can, after extracting each feature information from the retrieval information, assign weights to each feature information respectively according to the weight assignment method, and then determine the information weight value of each weighted feature information.

[0067] Optionally, for the same type of feature information extracted from the same retrieval information, the present invention may assign the information weight value only once. For example, when the present invention extracts two names of a retrieval object from the same retrieval information, the information weight value may be assigned only once for the names.

[0068] Optionally, the above step S103 may include:

[0069] Based on a predefined first relationship table that stores the feature information and the degree of association values, determine the degree of association values corresponding to each feature information respectively;

[0070] Based on the degree of association values corresponding to each feature information and a predefined second relationship table that stores the degree of association values and the information weight values, assign the corresponding information weight values to each feature information respectively.

[0071] Among them, the first relationship table may be a relationship table pre-made by a technician that stores the feature information and the degree of association values.

[0072] Among them, the second relationship table may be a relationship table pre-made by a technician that stores the degree of association values and the information weight values.

[0073] Specifically, after the present invention extracts each piece of feature information from the retrieval information, it may respectively search for the degree of association values corresponding to each piece of feature information in the first relationship table.

[0074] Specifically, after the present invention finds the degree of association values corresponding to each piece of feature information, it may respectively search for the information weight values corresponding to each degree of association value in the second relationship table, so as to determine the information weight values corresponding to each piece of feature information.

[0075] S104. Determine the additional weight value of the retrieval information based on the logical relationship between each piece of feature information;

[0076] It should be noted that there may be logical relationships of mutual confirmation, negation, or combination to derive more information among the feature information in the same retrieval information. The present invention can utilize this kind of logical relationship to determine the credibility of this retrieval information. Specifically, the present invention can assign corresponding information weights, that is, additional weight values, to the retrieval information according to the logical relationship between each piece of feature information.

[0077] Optionally, the above step S104 may include:

[0078] In the retrieval information, if there is a confirmation relationship between different feature information, determine that the additional weight value is a preset weight value greater than zero.

[0079] Specifically, if there is a corroborative relationship among at least two pieces of feature information in the retrieved information, the present invention can assign a preset weight value greater than zero to the retrieved information to increase the total weight of the retrieved information and improve the information value of the retrieved information.

[0080] Among them, the preset weight value can be a weight value set by a technician according to the actual situation, and the present invention does not limit this.

[0081] Specifically, for at least two pieces of feature information in a piece of retrieved information obtained from a certain information source, the present invention can determine whether there is a corroborative relationship among the at least two pieces of feature information on other information sources. For example, for the name and work unit in the first retrieved information obtained from the first information source, the present invention can check whether the retrieved object corresponding to the name works in the work unit on the official information release platform of the work unit. If so, it can be determined that there is a corroborative relationship between the name and the work unit; otherwise, it is determined that there is no corroborative relationship.

[0082] Optionally, if the number of pieces of feature information that can corroborate each other in the same retrieved information is larger, the preset weight value greater than zero assigned by the present invention to the retrieved information can be larger; conversely, it can be smaller.

[0083] Optionally, if there is no corroborative relationship among the respective pieces of feature information in the same retrieved information, the present invention can determine that the additional weight value of the retrieved information is zero, or can also determine that the additional weight value of the retrieved information is a predefined negative weight value.

[0084] Optionally, if in the same retrieved information, different pieces of feature information can be combined to derive more feature information, the present invention can also assign an additional weight value greater than zero to the retrieved information. Specifically, after the present invention extracts each piece of feature information from the retrieved information, if at least two pieces of feature information can be combined into combined information, and the present invention can use the combined information to further retrieve more retrieved information and obtain more feature information about the retrieved object in the information source, then the present invention can determine that the at least two pieces of feature information can be combined to derive more feature information.

[0085] Optionally, the above step S104 may include:

[0086] In the retrieved information, if there is a negative relationship among different pieces of feature information, determine that the additional weight value is a preset weight value less than zero.

[0087] Specifically, if there is a negative relationship between different feature information in the same retrieval information (for example, if there are multiple name information of the retrieval object in this retrieval information, there is a negative relationship between each name information), the present invention can assign a preset weight value less than zero to this retrieval information to reduce the total weight of the retrieval information and lower the information value of the retrieval information.

[0088] Among them, the above preset weight value less than zero can be set by those skilled in the art according to the actual situation, and the present invention does not limit this.

[0089] Optionally, for at least two feature information in a retrieval information obtained from a certain information source, the present invention can also determine whether there is a negative relationship between the at least two feature information on other information sources.

[0090] Optionally, if the number of mutually negative feature information in the same retrieval information is more, the preset weight value less than zero assigned by the present invention to the retrieval information can be smaller; on the contrary, it can be larger.

[0091] Optionally, if there is incorrect information in the feature information in the same retrieval information, the present invention can also assign a preset weight value less than zero to this retrieval information. For example, if a certain feature information in the retrieval information is an ID card information of 10 digits, the present invention can determine that this feature information has incorrect information and can assign a preset weight value less than zero to this retrieval information.

[0092] S105. Add the information weight value of each feature information and the additional weight value to obtain the total weight value of the retrieval information.

[0093] Specifically, after the present invention determines the information weight value of each feature information in the retrieval information and the additional weight value of the retrieval information, it adds the information weight value of each feature information in the retrieval information and the additional weight value, and determines the obtained added value as the total weight value of the retrieval information.

[0094] It should be noted that the present invention can evaluate the information value and importance of the retrieval information for determining the identity information of the retrieval information based on the total weight value of the retrieval information, and effectively realize the quantitative evaluation of the information value and importance of the retrieval information. Specifically, if the total weight value of the retrieval information is larger, the present invention can consider that the information value and importance of the retrieval information for determining the identity information of the retrieval object are higher; if the total weight value of the retrieval information is smaller, the present invention can consider that the information value and importance of the retrieval information for determining the identity information of the retrieval object are lower.

[0095] It can be understood that the present invention can be applied to the information retrieval scenario for tracing network attackers. At this time, the present invention can determine the network attacker as the retrieval object and execute Figure 1 the steps shown to determine the total weight value of the retrieval information for the network attacker, so as to determine the information value and importance degree of the retrieval information for determining the identity information of the network attacker.

[0096] The information processing method proposed in this embodiment, by obtaining a piece of retrieval information for the retrieval object, extracting at least one feature information from the retrieval information based on a predefined feature information extraction method, assigning weights to each feature information respectively according to a predefined weight assignment method, determining the information weight value of each feature information, determining the additional weight value of the retrieval information based on the logical relationship between each feature information, and adding the information weight value of each feature information and the additional weight value to obtain the total weight value of the retrieval information. The present invention can evaluate the information value and importance degree of the retrieval information for determining the identity information of the retrieval information based on the calculated total weight value of the retrieval information, and effectively realize the quantitative evaluation of the information value and importance degree of the retrieval information.

[0097] Based on Figure 1 the steps shown, as Figure 2 shown, the second information processing method is proposed in this embodiment. In this method, the following steps may further be included:

[0098] S201. Obtain multiple pieces of retrieval information for the retrieval object;

[0099] Among them, the multiple pieces of retrieval information may be at least two pieces of retrieval information obtained by retrieving information for the retrieval object from different information sources. For example, the multiple pieces of retrieval information may be five pieces of retrieval information, two of which may be retrieved from the first information source, one may be retrieved from the second information source, and the remaining two may be retrieved from the third information source.

[0100] It can be understood that the above multiple pieces of retrieval information may include Figure 1 the retrieval information in the steps shown, or may not include Figure 1 the retrieval information in the steps shown.

[0101] S202. Determine the total weight value of each retrieval information respectively;

[0102] Specifically, after obtaining the above multiple pieces of retrieval information, the present invention can, according to Figure 1 the steps shown, determine the total weight value of each piece of retrieval information in the multiple pieces of retrieval information respectively. For example, when the multiple pieces of retrieval information include three pieces of retrieval information, the present invention can, according to Figure 1For the steps shown above, first determine the total weight value of the first retrieval information among the three retrieval information, then determine the total weight value of the second retrieval information among the three retrieval information, and finally determine the total weight value of the third retrieval information among the three retrieval information.

[0103] S203. Sort each retrieval information in descending order of the total weight value, and output the sorting result of each retrieval information.

[0104] Specifically, after obtaining the total weight value of each retrieval information in the above-mentioned multiple retrieval information, the present invention can sort each retrieval information in descending order of the total weight value and output the sorting result.

[0105] Optionally, the present invention can output the sorting result to a corresponding database for storage.

[0106] Optionally, each retrieval information in the sorting result can carry the corresponding total weight value.

[0107] Optionally, when the present invention is applied to the information retrieval scenario of tracing the source of a network attacker, it can output the sorting result of multiple retrieval information for the network attacker. At this time, the sorting result is conducive to technicians intuitively evaluating the information value of each retrieval information for tracing the source of the network attacker, thereby improving the tracing accuracy and tracing efficiency.

[0108] Optionally, in the sorting result, if in the A retrieval information with a lower total weight value, there are one or more characteristic information in the B retrieval information with a higher total weight value, and the A retrieval information contains characteristic information not included in the B retrieval information, then the present invention can, when outputting the sorting result, arrange the A retrieval information in the order corresponding to the B retrieval information and output it together with the B retrieval information, that is, display the A retrieval information and the B retrieval information in a combined manner to intuitively show it to technicians. For example, the A retrieval information contains the mobile phone number and email of the retrieval object, and the B retrieval information contains the mobile phone number and name of the retrieval object. At this time, there is the mobile phone number in the B retrieval information in the A retrieval information, and there is an email in the A retrieval information that is not included in the B retrieval information. At this time, the present invention can arrange the A retrieval information in the same arrangement order as the B retrieval information and output it.

[0109] The information processing method proposed in this embodiment can obtain multiple retrieval information for the retrieval object, calculate the total weight value of each retrieval information respectively, sort each retrieval information based on the size of the total weight value and output the sorting result, quantitatively display the information value and importance of each retrieval information for determining the identity information of the retrieval object, and improve the retrieval efficiency and retrieval accuracy for the retrieval object.

[0110] And Figure 1corresponding to the method shown, such as Figure 3 As shown in Figure 3 , in this embodiment, a first information processing device is proposed. The device may include: a first obtaining unit 101, a first extracting unit 102, a first weighting unit 103, a first determining unit 104, a second determining unit 105, a first adding unit 106, and a second obtaining unit 107; where:

[0111] The first obtaining unit 101 is configured to obtain a piece of retrieval information for a retrieval object.

[0112] Among them, the retrieval object may be an object that needs to obtain relevant information by performing information retrieval in at least one information source (such as an information retrieval platform). For example, the retrieval object may be a network attacker who needs to perform identity information retrieval in multiple information sources to obtain identity information.

[0113] Among them, the retrieval information may be a piece of result information retrieved by performing information retrieval on the retrieval object in a certain information source.

[0114] Optionally, the retrieval information may include information such as the name, mobile phone number, ID number, and / or nationality of the retrieval object.

[0115] It should be noted that the present invention can initiate information retrieval on the retrieval object by inputting a certain information or combined information of the retrieval object into the information source. Among them, the combined information may be information composed of multiple pieces of information.

[0116] The first extracting unit 102 is configured to extract at least one piece of feature information from the retrieval information based on a predefined feature information extraction method.

[0117] Among them, the feature information may be information reflecting the individual characteristics or attributes of the retrieval object. For example, when the retrieval object is a certain network attacker, the feature information may be the name of the network attacker or the IP address of the network attacker.

[0118] Optionally, the feature information extraction method may be a rule formulated by a technician to identify at least one feature word and extract the feature information corresponding to each identified feature word respectively; optionally, the feature information extraction method may also be a method of identifying at least one specified feature word through an existing feature information extraction tool and extracting the feature information corresponding to each identified feature word respectively.

[0119] Among them, the feature word may be a word pre-specified by a technician that can reflect the individual characteristics or attributes of the retrieval object. For example, when the retrieval object is a certain network attacker, the keyword may be "name" or "IP address".

[0120] Specifically, according to the feature information extraction method, the present invention can first identify one or more feature words in the retrieval information, and then extract the feature information corresponding to each feature word from the retrieval information respectively. For example, when a specified feature word is "name", the present invention can, according to the feature information extraction method, first identify "name" in the retrieval information, and then extract the sentence where "name" is located from the retrieval information as the feature information of "name".

[0121] Optionally, the feature information extraction method can also be a rule formulated by a technician that can directly identify the feature information from the retrieval information and extract the identified feature information, such as a rule for directly identifying and extracting nationality information.

[0122] Optionally, the present invention can also pre-define the identification methods of relevant feature information of the retrieval object in advance, such as pre-defining the identification methods of feature information such as mobile phone numbers, email addresses, nationalities, and addresses. Then, the present invention can use the pre-defined feature information identification method to identify and extract relevant feature information from the retrieval information for the retrieval object.

[0123] The first weighting unit 103 is used to weight each feature information respectively according to the pre-defined weight assignment method;

[0124] The first determination unit 104 is used to determine the information weight value of each feature information;

[0125] Among them, the weight assignment method can be a method pre-defined by a technician for weighting feature information according to the degree of association between the feature information and the retrieval object.

[0126] It should be noted that when the degree of association between the feature information and the retrieval object is higher, the information weight value of the feature information can be higher; when the degree of association between the feature information and the retrieval object is lower, the information weight value of the feature information can be lower.

[0127] Among them, if the pointing accuracy of the feature information to the retrieval object is higher, the degree of association between the feature information and the retrieval object is higher. For example, for an ID number and a name, since an ID number can point to a unique object, while a name may be repeated and cannot point to a unique object, therefore, compared with a name, the degree of association between an ID number and the retrieval object is higher.

[0128] Specifically, the present invention can, after extracting each feature information from the retrieval information, weight each feature information respectively according to the weight assignment method, and then determine the information weight value of each weighted feature information.

[0129] Optionally, for the same type of feature information extracted from the same retrieval information, the present invention may assign the information weight value only once. For example, when the present invention extracts two names of the retrieval object from the same retrieval information, the information weight value may be assigned only once for the names.

[0130] Optionally, the first weighting unit 103 includes: a fourth determination unit and a second weighting unit;

[0131] The fourth determination unit is configured to respectively determine the association degree values corresponding to the respective feature information based on a predefined first relationship table that stores the feature information and the association degree values.

[0132] The second weighting unit is configured to respectively assign the corresponding information weight values to the respective feature information based on the association degree values corresponding to the respective feature information and a predefined second relationship table that stores the association degree values and the information weight values.

[0133] Wherein, the first relationship table may be a relationship table pre-made by a technician that stores the feature information and the association degree values.

[0134] Wherein, the second relationship table may be a relationship table pre-made by a technician that stores the association degree values and the information weight values.

[0135] Specifically, after the present invention extracts each piece of feature information from the retrieval information, it may respectively search for the association degree values corresponding to each piece of feature information in the first relationship table.

[0136] Specifically, after the present invention finds out the association degree values corresponding to each piece of feature information, it may respectively search for the information weight values corresponding to the respective association degree values in the second relationship table, so as to determine the information weight values corresponding to each piece of feature information.

[0137] The second determination unit 105 is configured to determine the additional weight value of the retrieval information based on the logical relationship between the respective feature information.

[0138] It should be noted that among the respective feature information in the same retrieval information, there may be logical relationships such as mutual verification, negation, or combination to derive more information. The present invention can utilize this kind of logical relationship to determine the credibility of this retrieval information. Specifically, the present invention may assign the corresponding information weight, that is, the additional weight value, to the retrieval information according to the logical relationship between the respective feature information.

[0139] Optionally, the second determination unit 105 is configured to, in the retrieval information, if there is a verification relationship between different feature information, determine that the additional weight value is a preset weight value greater than zero.

[0140] Specifically, if there is a corroborative relationship between at least two pieces of feature information existing in the retrieved information, the present invention can assign a preset weight value greater than zero to the retrieved information to increase the total weight of the retrieved information and improve the information value of the retrieved information.

[0141] Among them, the preset weight value can be a weight value set by a technician according to the actual situation, and the present invention does not limit this.

[0142] Specifically, for at least two pieces of feature information in a piece of retrieved information obtained from a certain information source, the present invention can determine whether there is a corroborative relationship between the at least two pieces of feature information on other information sources. For example, for the name and work unit in the first retrieved information obtained from the first information source, the present invention can search on the official information release platform of the work unit to find whether the retrieved object corresponding to the name works in the work unit. If so, it can be determined that there is a corroborative relationship between the name and the work unit; otherwise, it is determined that there is no corroborative relationship.

[0143] Optionally, if the number of pieces of feature information that can corroborate each other in the same retrieved information is larger, the preset weight value greater than zero assigned by the present invention to the retrieved information can be larger; conversely, it can be smaller.

[0144] Optionally, if there is no corroborative relationship between the respective pieces of feature information in the same retrieved information, the present invention can determine that the additional weight value of the retrieved information is zero, or can also determine that the additional weight value of the retrieved information is a predefined negative weight value.

[0145] Optionally, if in the same retrieved information, more feature information can be derived through combination between different pieces of feature information, the present invention can also assign an additional weight value greater than zero to the retrieved information. Specifically, after the present invention extracts each piece of feature information from the retrieved information, if at least two pieces of feature information can further retrieve more retrieved information and obtain more feature information about the retrieved object in the information source after being combined into combined information, the present invention can determine that the at least two pieces of feature information can derive more feature information through combination.

[0146] Optionally, the second determination unit 105 is configured to, in the retrieved information, if there is a negative relationship between different pieces of feature information, determine that the additional weight value is a preset weight value less than zero.

[0147] Specifically, if in the same piece of retrieved information, there is a negative relationship between different pieces of feature information (for example, if there are multiple name information of the retrieved object in the piece of retrieved information, there is a negative relationship between the name information), the present invention can assign a preset weight value less than zero to the retrieved information to reduce the total weight of the retrieved information and lower the information value of the retrieved information.

[0148] Among them, the preset weight value less than zero can be set by those skilled in the art according to the actual situation, and the present invention does not limit this.

[0149] Optionally, for at least two pieces of feature information in a piece of retrieval information obtained from a certain information source, the present invention can also determine whether there is a negative relationship between the at least two pieces of feature information on other information sources.

[0150] Optionally, if the number of mutually negative feature information in the same retrieval information is larger, the preset weight value less than zero given by the present invention to the retrieval information can be smaller; conversely, it can be larger.

[0151] Optionally, if there is incorrect information in the feature information in the same retrieval information, the present invention can also give a preset weight value less than zero to the retrieval information. For example, if a certain piece of feature information in the retrieval information is an ID card information of 10 digits, the present invention can determine that the feature information has incorrect information and can give a preset weight value less than zero to the retrieval information.

[0152] The first adding unit 106 is configured to add the information weight value of each piece of feature information and the additional weight value.

[0153] The second obtaining unit 107 is configured to obtain the total weight value of the retrieval information.

[0154] Specifically, after the present invention determines the information weight value of each piece of feature information in the retrieval information and the additional weight value of the retrieval information, it adds the information weight value of each piece of feature information in the retrieval information and the additional weight value, and determines the obtained value as the total weight value of the retrieval information.

[0155] The information processing device proposed in this embodiment can evaluate the information value and importance of the retrieval information for determining the identity information of the retrieval information based on the calculated total weight value of the retrieval information, and effectively realize the quantitative evaluation of the information value and importance of the retrieval information.

[0156] Based on Figure 3 , the second information processing device is proposed in this embodiment. The device may further include: a third obtaining unit, a third determining unit, a sorting unit and an output unit;

[0157] The third obtaining unit is configured to obtain multiple pieces of retrieval information for a retrieval object;

[0158] The third determining unit is configured to respectively determine the total weight value of each piece of retrieval information;

[0159] The sorting unit is configured to sort each piece of retrieval information in descending order of the total weight value;

[0160] An output unit for outputting the sorting results of each retrieval information.

[0161] Among them, multiple retrieval information may be at least two retrieval information obtained from different information sources for information retrieval of a retrieval object. For example, the multiple retrieval information may be five retrieval information, two of the five retrieval information may be retrieved from a first information source, one may be retrieved from a second information source, and the remaining two may be retrieved from a third information source.

[0162] Specifically, after obtaining the above-mentioned multiple retrieval information, the present invention can respectively determine the total weight value of each retrieval information in the multiple retrieval information.

[0163] Specifically, after obtaining the total weight value of each retrieval information in the above-mentioned multiple retrieval information, the present invention can sort each retrieval information according to the order from largest to smallest of the total weight value and output the sorting result.

[0164] Optionally, the present invention can output the sorting result to a corresponding database for storage.

[0165] Optionally, each retrieval information in the sorting result can carry the corresponding total weight value.

[0166] Optionally, when the present invention is applied to an information retrieval scenario for tracing network attackers, it can output the sorting results of multiple retrieval information for network attackers. At this time, the sorting result is beneficial for technicians to intuitively evaluate the information value of each retrieval information for tracing network attackers, thereby improving the tracing accuracy and tracing efficiency.

[0167] The information processing device proposed in this embodiment can obtain multiple retrieval information for a retrieval object, respectively calculate the total weight value of each retrieval information, sort each retrieval information based on the size of the total weight value and output the sorting result, quantitatively display the information value and importance of each retrieval information for determining the identity information of the retrieval object, and improve the retrieval efficiency and retrieval accuracy of the retrieval object.

[0168] It should also be noted that the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, commodity or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of another identical element in the process, method, commodity or device including the element.

[0169] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims

1. An information processing method, characterized in that, Including: Obtaining a piece of retrieval information for a retrieval object; The retrieval information is a piece of result information retrieved by performing information retrieval on the retrieval object on a certain information source; Extracting at least one piece of feature information from the retrieval information based on a predefined feature information extraction method; The feature information is information reflecting the individual features or attributes of the retrieval object; Assigning weights to each of the feature information respectively according to a predefined weight assignment method to determine the information weight values of each of the feature information; the step of assigning weights to each of the feature information respectively according to a predefined weight assignment method includes: determining the association degree values corresponding to each of the feature information respectively based on a predefined first relationship table storing the feature information and the association degree values; the association degree value represents the pointing accuracy of the feature information to the retrieval object; based on the association degree values corresponding to each of the feature information and a predefined second relationship table storing the association degree values and the information weight values, assigning corresponding information weight values to each of the feature information respectively; Determining an additional weight value of the retrieval information based on the logical relationship between each of the feature information, including: if there is a corroboration relationship between different feature information in the retrieval information, determining that the additional weight value is a preset weight value greater than zero; if there is a negation relationship between different feature information in the retrieval information, determining that the additional weight value is a preset weight value less than zero; Adding the information weight values of each of the feature information and the additional weight value to obtain the total weight value of the retrieval information.

2. The information processing method according to claim 1, wherein The method further includes: Obtaining multiple pieces of retrieval information for the retrieval object; Respectively determining the total weight values of each of the retrieval information; Sorting each of the retrieval information in descending order of the total weight value and outputting the sorting result of each of the retrieval information.

3. An information processing apparatus, characterized in that, Including: A first obtaining unit, a first extracting unit, a first weighting unit, a first determining unit, a second determining unit, a first adding unit and a second obtaining unit; wherein: The first obtaining unit is configured to obtain a piece of retrieval information for a retrieval object; the retrieval information is a piece of result information retrieved by performing information retrieval on the retrieval object on a certain information source; The first extracting unit is configured to extract at least one piece of feature information from the retrieval information based on a predefined feature information extraction method; the feature information is information reflecting the individual features or attributes of the retrieval object; The first weighting unit is configured to assign weights to each of the feature information respectively according to a predefined weight assignment method; The first weighting unit includes: a fourth determining unit and a second weighting unit; The fourth determining unit is configured to determine the association degree values corresponding to each of the feature information respectively based on a predefined first relationship table storing the feature information and the association degree values; the association degree value represents the pointing accuracy of the feature information to the retrieval object; The second weighting unit is configured to assign corresponding information weight values to each of the feature information respectively based on the correlation degree values corresponding to the feature information and a predefined second relation table storing the correlation degree values and information weight values; The first determination unit is configured to determine the information weight values of each of the feature information; The second determination unit is configured to determine an additional weight value of the retrieval information based on the logical relationship between each of the feature information; The second determination unit is configured to, in the retrieval information, if there is a corroboration relationship between different feature information, determine that the additional weight value is a preset weight value greater than zero; and if there is a negative relationship between different feature information, determine that the additional weight value is a preset weight value less than zero; The first addition unit is configured to add the information weight values of each of the feature information and the additional weight value; The second obtaining unit is configured to obtain the total weight value of the retrieval information.

4. The information processing apparatus according to claim 3, wherein The apparatus further includes: a third obtaining unit, a third determination unit, a sorting unit, and an output unit; The third obtaining unit is configured to obtain multiple pieces of retrieval information for the retrieval object; The third determination unit is configured to respectively determine the total weight values of each of the retrieval information; The sorting unit is configured to sort each of the retrieval information in descending order of the total weight value; The output unit is configured to output the sorting result of each of the retrieval information.

Images