Bad information website detection method, device and storage medium

Abstract

The present disclosure relates to a method, device and storage medium for detecting bad information websites. A method for detecting bad information websites comprises: collecting data from a website when a user visits the website; converting the data into a feature vector; determining a user identifier; obtaining a user score of the user through the user identifier; substituting the feature vector and the user score into a predetermined decision function to obtain a posterior probability value representing the probability that the visited website is a bad information website; comparing the posterior probability value with a predetermined threshold, and when the posterior probability value is greater than the predetermined threshold, determining the website to be a bad information website.

Description

Technical Field

[0001] The present disclosure generally relates to a method, device and storage medium for detecting harmful information websites. Background Art

[0002] In the network security situation awareness system, it is necessary to detect websites containing bad information from the network access data flow. Currently, the rule-based detection method is usually used, which has at least the following problems:

[0003] There are a large number of websites on the Internet, and the webpage content is diverse. Among them, the base number of illegal words related to pornography, gambling and drugs is huge and often contains disguised words, so the recognition rate is low;

[0004] It takes a lot of manual work to mark and configure rules, and many rules will inevitably be missed, and it is difficult to update new rules. Summary of the invention

[0005] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0006] According to one aspect of the present disclosure, a method for detecting bad information websites is provided, comprising: collecting data from a website when a user visits the website; converting the data into a feature vector; determining a user identifier; obtaining a user score of the user through the user identifier; substituting the feature vector and the user score into a predetermined decision function to obtain a posterior probability value representing the probability that the visited website is a bad information website; comparing the posterior probability value with a predetermined threshold, and when the posterior probability value is greater than the predetermined threshold, determining the website to be a bad information website.

[0007] According to another aspect of the present disclosure, a device for detecting harmful information websites is provided, comprising: a memory on which instructions are stored; and a processor configured to execute the instructions stored in the memory to perform the method as described above.

[0008] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0010] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0011] Figure 1 The flowchart shows a method for detecting harmful information websites according to an embodiment of the present disclosure.

[0012] Figure 2 An exemplary configuration of a computing device that can implement an embodiment according to the present disclosure is shown. DETAILED DESCRIPTION

[0013] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0014] In order to solve one or more of the above-mentioned technical problems of the prior art, the inventor of the present application proposes to use a decision function to determine the posterior probability that the website visited by the user is a bad information website, and dynamically optimize the decision function according to the user's past visits to bad information websites (the determined results).

[0015] Figure 1 The flowchart of a method 100 for detecting a bad information website according to an embodiment of the present disclosure is shown. The method comprises: collecting data from a website when a user visits the website (101); converting the data into a feature vector (102); determining a user identifier (103); obtaining a user score of the user through the user identifier (104); substituting the feature vector and the user score into a predetermined decision function to obtain a posterior probability value representing the probability that the visited website is a bad information website (106); comparing the posterior probability value with a predetermined threshold, and when the posterior probability value is greater than the predetermined threshold, determining the website to be a bad information website (106).

[0016] In the above step 101, the data received by the user from a certain website in a session can be used as the data. Alternatively, a part or all of the data on a page on a certain website visited by the user can be used as the data. The data can include any character data obtained from the website (the character data can include text data in any language), and can also include image data or video data obtained from the website, and the image data or video data can be incomplete image data or video data (for example, a segment of image data stream or video data stream).

[0017] In step 102, the data may be converted into a feature vector by any suitable model. For example, the model may include models such as LSI (Latent Semantic Indexing), neural network-based models (such as BERT), Doc2Vec models, Word2Vec models, Fasttext models, etc. The above various models may include statistics and calculations based on TF (term frequency) and IDF (inverse document frequency). For data including image data or video data, a model that converts the image data or video data into a feature vector may be additionally used.

[0018] In step 103, any information that can uniquely identify the user (eg, the user's broadband user account, the IP address of a dedicated line user, the International Mobile Subscriber Identity (IMSI) of a mobile phone user, etc.) can be used as the user identifier.

[0019] In the above decision function, the user dimension features are added. That is, users are scored based on their past visits to websites with bad information. The decision function is optimized by using the user's ratings, which improves the recognition rate of the model.

[0020] In one embodiment, the user score may include a positive sample cumulative score P and a negative sample cumulative score N, where the positive sample cumulative score P represents the cumulative number of bad information websites visited by the user in the past specific period, and the negative sample cumulative score N represents the opposite of the cumulative number of normal websites visited by the user in the past specific period, where P is greater than or equal to 0, and N is less than or equal to 0. For example, if the cumulative number of normal websites visited by the user in the past specific period is 100, then N = -100. The past specific period can be, for example, a time period of any length in the past, such as the past month, year, two years, and so on.

[0021] In step 104, if the user identification cannot be determined or there is no user rating corresponding to the determined user identification, a default user rating may be used. As just one example, the default user rating may include N=-10, P=0.

[0022] In one embodiment, the predetermined decision function can be obtained by training a training set using a neural network-based model. The training set may include a plurality of vectors (x ) obtained by converting a plurality of website data (e.g., web page data on a plurality of websites, which may include any one or more of text data, character data, image data, and video data on the web page) as samples using the conversion model described above. l , l is an integer from 1 to M, M is the number of vectors in the training set), and the classification label (y l ), where the classification label y of the website data of bad information websites l is 1, indicating that it is a positive sample, while the classification mark y of the website data of normal information websites l is -1, indicating that it is a negative sample.

[0023] In one embodiment, based on the principle of support vector machine (SVM), the classification hyperplane can be trained by using the training set as described above, thereby obtaining the following function:

[0024]

[0025] Where x is the eigenvector, x i is the i-th support vector among the n support vectors obtained through the training set, i is an integer from 1 to n, y i For x i The corresponding classification label, y i ∈{+1,-1},y i When it is equal to +1, it means x i is a positive sample, that is, x i is the vector corresponding to the data from the bad information website, y i When it is equal to -1, it means x i is a negative sample, a i is the Lagrange multiplier obtained through the training set, a i ≥0, k is the kernel function, b is a constant vector. n<M, that is, the number of support vectors is less than the number of vectors in the training set.

[0026] The value of the above function f(x) represents a quantity proportional to the distance from the feature vector x to the classification hyperplane in a multidimensional space (the dimension of the space is equal to the dimension of the feature vector x). When x is above the classification hyperplane, f(x)>0, indicating that x is on the positive sample side. On the contrary, when x is below the classification hyperplane, f(x)<0, indicating that x is on the negative sample side.

[0027] In one embodiment, as an example of a decision function, the following decision function may be constructed using the function f(x):

[0028]

[0029] Among them, P(x) represents the posterior probability value calculated using the decision function, exp represents an exponential function with the natural constant e as the base, α and β are optimization parameters calculated based on the cumulative score P of positive samples and the cumulative score N of negative samples, and A and B are real numbers greater than 0 obtained through the training set.

[0030] In one embodiment, A and B can be set to a predetermined range (for example, 2 -8 ≤A≤2 8 , 2 -8 ≤B≤2 8 ) and train the above decision function through the training set to determine the optimal values ​​of A and B.

[0031] In one embodiment, when the user identity cannot be determined or there is no user rating, both α and β may be set equal to 1.

[0032] In one embodiment, when the decision function is trained using a training set to determine the optimal values ​​of A and B, both α and β may be set equal to 1.

[0033] In one embodiment, for users with user ratings, appropriate optimization parameters α and β can be selected so that the more times a user visits bad websites, the larger the posterior probability value P(x) calculated using the above decision function. On the contrary, the fewer times a user visits bad websites, the smaller the posterior probability value P(x) calculated using the above decision function.

[0034] In one embodiment, it is possible to

[0035] Where tanh is the hyperbolic tangent function, and c is a real number greater than zero.

[0036] In one embodiment, β=10*tanh(P+N) may be taken.

[0037] By taking the above optimization parameters α and β, the above optimization adjustment of the posterior probability value P(x) can be achieved.

[0038] The specific value of c can be optimized through training sets, experience or actual monitoring data. In one embodiment, c can be any positive real number between 1 and 20.

[0039] In one embodiment, when the user type is a mobile phone user, c can be 10; when the user type is a broadband user, c can be 5; when the user type is a dedicated line user, c can be 1. In this embodiment, users are classified so that more targeted bad information websites can be determined, monitored and controlled for different types of users. For example, if mobile phone users are the most, then by increasing the c value corresponding to mobile phone users, mobile phone users' visits to bad information websites can be more strictly monitored.

[0040] Based on the judgment results of the bad information websites, subsequent disposal or control can be carried out.

[0041] The predetermined threshold value may be a value between 0 and 1. In one embodiment, the predetermined threshold value may be 0.5. In one embodiment, if it is desired to more strictly monitor the user's visit to the bad information website, the predetermined threshold value may be set to a smaller value (e.g., less than 0.5), otherwise it may be set to a larger value.

[0042] In one embodiment, the user score of the user can be updated according to the determination result of the website visited by the user, so as to further optimize the above decision function by using the updated user score. For example, if the determination result is a bad information website, the value of P in the user score of the user can be increased by 1.

[0043] Thus, users can be continuously rated according to the detection (determination) results of the constructed detection model. The user rating results are dynamically input into the detection model, and a personalized optimized detection model suitable for each user can be constructed.

[0044] The above method can automatically monitor and identify the data flow of the existing network, and is implemented based on the open source basic class library. It has formed compiled software and can be deployed and implemented in the existing network.

[0045] Figure 2 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0046] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0047] like Figure 2As shown, the computing device 1200 may include one or more elements that can be connected or communicated with the bus 1202 via one or more interfaces. The bus 1202 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus, etc. The computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. The one or more processors 1204 may be any kind of processor, and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 1204 may be configured to implement the bad information website detection method described above, for example. The input device 1206 may be any type of input device capable of inputting information to the computing device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. The output device 1208 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer.

[0048] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0049] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0050] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0051] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0052] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0053] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be completed with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0054] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0055] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0056] Similarly, while operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A method for detecting harmful information websites, comprising: Collect data from websites when users visit said websites; converting the data into a feature vector; Determine user identification; Obtaining a user score of the user through the user identifier, wherein the user score includes a positive sample cumulative score P and a negative sample cumulative score N, the positive sample cumulative score P represents the cumulative number of bad information websites visited by the user in the past specific period of time, and the negative sample cumulative score N represents the opposite of the cumulative number of normal websites visited by the user in the past specific period of time, P is greater than or equal to 0, and N is less than or equal to 0; Substituting the feature vector and the user score into a predetermined decision function, thereby obtaining a posterior probability value representing the probability that the visited website is a bad information website; and Comparing the posterior probability value with a predetermined threshold, and when the posterior probability value is greater than the predetermined threshold, determining the website as a bad information website; The following decision function is used to calculate the posterior probability value: Wherein, exp represents an exponential function with the natural constant e as the base, α and β are optimization parameters calculated according to the cumulative score P of positive samples and the cumulative score N of negative samples, and α and β make the posterior probability value P(x) calculated by the decision function larger for users who visit bad websites more times, and smaller for users who visit bad websites less times, x is the feature vector, A and B are real numbers greater than 0 obtained through the training set, and f(x) is a function obtained through training of the training set based on the support vector machine principle, Among them, x i is the i-th support vector among the n support vectors obtained through the training set, i is an integer from 1 to n, y i For x i The corresponding classification label, y i ∈{+1,-1},y i When it is equal to +1, it means x i is a positive sample, y i When it is equal to -1, it means x i is a negative sample, a i is the Lagrange multiplier obtained through the training set, a i ≥0, k is the kernel function, and b is a constant vector.

2. The method according to claim 1, wherein: Where tanh is the hyperbolic tangent function, and c is a real number greater than zero.

3. The method according to claim 2, wherein: When the user type is a mobile phone user, c=10, When the user type is a broadband user, c = 5, and When the user type is a dedicated line user, c=1.

4. The method according to claim 1, wherein: β = 10*tanh(P+N).

5. The method according to claim 1, wherein: When the user identity cannot be determined or there is no user rating, let α and β both equal 1.

6. The method according to claim 1, wherein: The user score of the user is updated according to the determination result of the website visited by the user.

7. A device for detecting harmful information websites, comprising: a memory having instructions stored therein; as well as A processor configured to execute instructions stored on the memory to perform the method according to any one of claims 1 to 6.

8. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 6.

Images