Access tracking detection method, device, readable storage medium and electronic device

Abstract

The present disclosure provides a method, device, computer-readable storage medium and electronic device for access tracking detection, which relates to the field of information security technology. The method includes: obtaining page element information of a first visit to a site; obtaining page element information of a second visit to a site; determining the difference information of the page element information of the first visit to the site and the second visit to the site; calculating the correlation difference value based on the difference information of the page element information and the user operation element information; and determining the access tracking detection result based on the correlation difference value. The embodiment of the present disclosure can comprehensively judge whether there is access tracking on the site by analyzing the correlation between the content of the user's two visits to the site and the user's input operation, eliminating the page element information that remains unchanged in the two operations, and improving the accuracy and efficiency of access tracking detection.

Description

Background Art

[0002] With the rapid popularization of Web (World Wide Web) technology and services, more and more users have become inseparable from the Web. At the same time, Web sites and advertising service providers hope to make effective content recommendations and more accurate advertising through device recognition, but some advertisers "cooperate" with each other and sell user privacy information to achieve cross-domain user association and then analyze user behavior habits and preferences, which largely violates the user's privacy protection intentions.

[0003] At present, the main means of device identification based on the Web include Cookie (data stored on the user's local terminal) and browser fingerprint. Cookie is text information stored by the Web server on the user's browser. It can contain information related to the user and the device. Whenever the user visits a Web site, the server can access the Cookie information to obtain the user's browsing history and behavior; the browser fingerprint is composed of multiple browser, operating system and device hardware related attributes such as UserAgent, fonts, plug-ins, etc., and does not rely on a specific feature, so it has good robustness. For the privacy leakage threat brought by Web tracking, users can avoid it by directly disabling or regularly deleting Cookies through the browser; but the browser fingerprint recognition technology collects user information completely without the user's knowledge. At present, it can only be detected by monitoring the call of sensitive JavaScript APIs, but Web tracking uses new attack methods, which will bring the risk of privacy leakage.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides an access tracking detection method, device, computer-readable storage medium and electronic device, which at least to a certain extent overcome the problems of low efficiency and accuracy of access tracking detection in related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, there is provided an access tracking detection method, comprising:

[0008] Get the page element information of the first visit to the site;

[0009] Get the page element information of the second visit to the site;

[0010] Determine the difference information of page element information between the first visited site and the second visited site;

[0011] Calculate the correlation difference based on the page element information difference information and the user operation element information;

[0012] The access tracking detection result is determined based on the correlation difference.

[0013] In one embodiment of the present disclosure, it also includes:

[0014] The access tracking detection result is determined according to the correlation difference and the access interval coefficient.

[0015] In one embodiment of the present disclosure, it also includes:

[0016] Get the access time of the first visit to the site;

[0017] Get the access time of the second visit to the site;

[0018] Determine the time difference and the step count difference between the first visit to the site and the second visit to the site;

[0019] The access interval coefficient is determined according to the interval time difference and the step number difference.

[0020] In one embodiment of the present disclosure, it also includes:

[0021] Get user operation information;

[0022] Extract keywords and perform word segmentation processing on the user operation information;

[0023] Calculating the frequency of each keyword in the user operation information;

[0024] The user operation element information is determined according to the total number of web pages, the number of web pages containing keywords, and the frequency of keywords.

[0025] In one embodiment of the present disclosure, it also includes:

[0026] Get page content information of visited sites;

[0027] Extract keywords and perform word segmentation on the page content information;

[0028] Calculating the frequency of each keyword in the page content information;

[0029] The page element information is determined according to the total number of web pages, the number of web pages containing keywords, and the frequency of keywords.

[0030] In one embodiment of the present disclosure, the page content information includes text information and picture information;

[0031] The keyword extraction and word segmentation processing of the page content information includes:

[0032] Extract keywords and perform word segmentation on the text information;

[0033] The image information is converted into text information, and then keyword extraction and word segmentation are performed.

[0034] In one embodiment of the present disclosure, the user operation information includes browser side information and operating system side information.

[0035] In one embodiment of the present disclosure, it also includes:

[0036] When the number of components of the page element information difference information and the user operation element information are inconsistent, based on a repeated filling method, the number of components of the page element information difference information and the user operation element information are adjusted to be consistent.

[0037] According to another aspect of the present disclosure, there is also provided an access tracking detection device, comprising:

[0038] A first site acquisition module, which acquires page element information of a site visited for the first time;

[0039] A second site acquisition module, which acquires page element information of the second visited site;

[0040] A difference information determination module is used to determine the difference information of page element information between the first visited site and the second visited site;

[0041] A correlation difference calculation module calculates a correlation difference based on the page element information difference information and the user operation element information;

[0042] The detection result determination module determines the access tracking detection result according to the correlation difference.

[0043] According to another aspect of the present disclosure, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above-mentioned access tracking detection methods by executing the executable instructions.

[0044] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the access tracking detection methods described above is implemented.

[0045] The access tracking detection method, device, computer-readable storage medium and electronic device provided by the embodiments of the present disclosure obtain page element information of a first visit to a site; obtain page element information of a second visit to the site, eliminate page element information that remains unchanged between the two operations, determine the difference information of the page element information between the first visit to the site and the second visit to the site, analyze the correlation between the difference information of the page element information and the user operation element information, thereby comprehensively judging whether there is access tracking for the site, and improving the accuracy and efficiency of access tracking detection.

[0046] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0048] Figure 1 A flow chart of an access tracking detection method in an embodiment of the present disclosure is shown;

[0049] Figure 2 A flow chart of a method for determining an access interval coefficient in an embodiment of the present disclosure is shown;

[0050] Figure 3 A flow chart of a method for obtaining page element information of a visited site in an embodiment of the present disclosure is shown;

[0051] Figure 4 A flow chart of a method for obtaining user operation element information in an embodiment of the present disclosure is shown;

[0052] Figure 5 A schematic diagram of an access tracking detection device in an embodiment of the present disclosure is shown;

[0053] Figure 6 A flow chart of another access tracking detection method in an embodiment of the present disclosure is shown;

[0054] Figure 7 A schematic diagram of a method for obtaining search content in an embodiment of the present disclosure is shown;

[0055] Figure 8 A schematic diagram of obtaining text information in an embodiment of the present disclosure is shown;

[0056] Fig. 9 A schematic diagram of reading clipboard information in an embodiment of the present disclosure is shown;

[0057] Fig.10 The access interval coefficient function image of t=2 in the embodiment of the present disclosure is shown;

[0058] Fig.11 The access interval coefficient function image of t=1 in the embodiment of the present disclosure is shown;

[0059] Fig.12 The access interval coefficient function image of t=0.2 in the embodiment of the present disclosure is shown;

[0060] Fig.13 A schematic diagram showing a step difference in an embodiment of the present disclosure is shown;

[0061] Fig.14 Another schematic diagram of step difference in the embodiment of the present disclosure is shown;

[0062] Fig.15 An access tracking automatic detection device according to an embodiment of the present disclosure is shown; and

[0063] Fig.16 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0064] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0065] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0066] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0067] First, an access tracking detection method is provided in an embodiment of the present disclosure. The method can be executed by any electronic device with computing and processing capabilities.

[0068] Figure 1 A flow chart of an access tracking detection method in an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the access tracking detection method provided in the embodiment of the present disclosure includes the following steps:

[0069] S102, obtaining page element information of the first visited site;

[0070] S104, obtaining page element information of the second visited site.

[0071] In one embodiment, the page content information of the first visit to the site and the second visit to the site are obtained respectively through the browser extension. The page content information includes text information and image information. The text information is subjected to keyword extraction and word segmentation processing; the image information is converted into text information, and then keyword extraction and word segmentation processing is performed; the word frequency of each keyword in the page content information is calculated; and the page element information is determined according to the total number of web pages, the number of web pages containing keywords, and the word frequency of keywords. It should be noted that the page content information includes but is not limited to text information and image information; the page content information includes but is not limited to the text description information and the image link URL corresponding to all links. For example, the page content information of the first visit to the site is obtained through the browser extension, and the page content information includes text information such as "jeans", the keyword "jeans" is extracted, and "jeans" is divided into "denim" and "trousers", the word frequency of "denim" in all keywords is calculated, and the number of all web pages and web pages containing the keyword "denim" is calculated. According to the word frequency of "denim" in all keywords and the number of all web pages and web pages containing the keyword "denim", it is determined that the first page element information includes "denim". For example, the page content information of the second visit to the site is obtained through the browser extension, the page content information includes picture information of "jeans", the keyword "jeans" is identified according to the image recognition technology, and then the keyword "jeans" is extracted, and "jeans" is divided into "denim" and "trousers", the word frequency of "denim" in all keywords is calculated, the number of all web pages and the number of web pages containing the keyword "denim" is calculated, and it is determined that the second page element information includes "denim" based on the word frequency of "denim" in all keywords and the number of all web pages and the number of web pages containing the keyword "denim".

[0072] S106, determining the difference information of page element information between the first visit to the site and the second visit to the site.

[0073] In one embodiment, the page element difference information δ 1 and page element difference information δ 2 The calculation is as follows:

[0074]

[0075]

[0076] Among them, δ1 Indicates that the site is visited twice in succession, and the information set of the two common visited page information is removed based on the first page element information S1, δ 2 Indicates that the site is visited twice in succession, and the information set of the common page information of the two visits is removed based on the second page element information S2. For example, the first page element information S1 includes "jeans" but not "trousers", and the second page element information S2 includes "trousers" but not "jeans", then δ 1 Including "Cowboy", δ 2 Including "pants".

[0077] S108, calculating the correlation difference according to the page element information difference information and the user operation element information.

[0078] In one embodiment, the correlation value between the user operation element information U and the page element information difference value δ is calculated, and the TF-IDF algorithm is used to calculate the frequency and importance of the keywords, and the cosine similarity is used to calculate the correlation.

[0079] In one embodiment, the difference value δ between the user operation element information U and the page element information is calculated respectively. 1 and the page element information difference value δ 2 The correlation is calculated as follows:

[0080]

[0081] Among them, U i and δ j,i Represent vectors U and δ respectively j The components of U and δ j When the number of components i is inconsistent, the repeated filling method is used to fill it.

[0082] γ 1 is the correlation between the first page element information S1 and the user operation element information U of the two visits to the site; γ 2 is the correlation between the second page element information S2 and the user operation element information U of the two visits to the site; the correlation difference is γ 2 -γ 1 .

[0083] S110, determining the access tracking detection result according to the correlation difference.

[0084] In one embodiment, the access tracking detection result is determined according to the correlation difference and the access interval coefficient.

[0085] It should be noted that the access interval coefficient function decreases exponentially with the growth of parameter t and also decreases exponentially with the increase of integer n, that is, the longer the interval between two accesses or the more interval steps, the lower the correlation. The access tracking detection result is determined based on the correlation difference and the access interval coefficient.

[0086] In the above embodiment, a large amount of common information between the two previous visits is eliminated, data noise is eliminated, and the dilution of relevance by massive information of large websites and large web pages is avoided, thereby improving the effectiveness of access tracking detection, especially for the access results of large web pages, which will have a better detection effect.

[0087] Figure 2 A flow chart of a method for determining an access interval coefficient in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the method for determining the visit interval coefficient includes: S202, obtaining the visit time of the first visit to the site; S204, obtaining the visit time of the second visit to the site; S206, determining the interval time difference and the step number difference between the first visit to the site and the second visit to the site; S208, determining the visit interval coefficient based on the interval time difference and the step number difference.

[0088] In one embodiment, the correlation coefficient μ is obtained by calculating the correlation difference between the two page element information difference values ​​and multiplying it by the access interval coefficient. When the correlation coefficient μ exceeds a certain threshold, it can be determined that the site is tracking the user. The calculation formula of the correlation coefficient μ is as follows:

[0089]

[0090] in, is the access interval coefficient between two visits, γ 2 -γ 1 is the correlation difference.

[0091] Where t is the time difference between two visits to Web site A, in seconds. By obtaining the access time of the first visit to the site as T 1 , the second visit time to the site is T 2 ,The interval time difference t can be obtained by calculating the difference between the two times, that is,

[0092] t=T 2 -T 1 (5)

[0093] Among them, n is the step difference between two visits to the site, and n is a positive integer greater than or equal to 1. It should be noted that the step difference n can be calculated by obtaining the access records of the time-series pages. For example, after the user opens page A as the first step, he immediately refreshes the page. In this case, n=1; after the user opens page A as the first step, he then clicks a link to visit page B, and then clicks a return link to visit page A. In this case, n=2, and so on. The calculation method of the step difference n can be obtained by analogy.

[0094] In one embodiment, the correlation coefficient μ takes a value of 0.5.

[0095] In the above embodiment, starting from the effect of two consecutive visits by the user, the access interval coefficient of the two visits is designed for the situation that the operation information closer to the second operation is easier to be tracked and appears on the second visit page. The access interval coefficient function takes into account the interval time difference and the step number difference, thereby quantifying their correlation.

[0096] Figure 3 A flow chart of a method for obtaining page element information of a visited site in an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the method for obtaining page element information of a visited site includes: S302, obtaining page content information of the visited site; S304, performing keyword extraction and word segmentation processing on the page content information; S306, calculating the frequency of each keyword in the page content information; S308, determining the page element information according to the total number of web pages and the number of web pages containing the keywords, and the frequency of the keywords.

[0097] In one embodiment, the text information can be subjected to keyword extraction and word segmentation processing by a text analysis tool. When extracting keywords, only words with substantial meanings such as nouns, verbs, and adjectives can be focused on, while prepositions, numerals, and quantifiers, which are unimportant information that should be deleted, can be ignored. Technologies such as image recognition algorithms and machine learning algorithms can be used to identify the pictures clicked by users and all pictures on the page, convert the information in the pictures into text information, and then perform keyword extraction and word segmentation processing using the method for processing text information.

[0098] In the above embodiment, keyword extraction and word segmentation processing are performed on the text information and image information in the page content information respectively, so as to improve the timeliness of access tracking detection.

[0099] In one embodiment, the keyword t in the page content information i For example, the keyword t i The word frequency can be expressed as:

[0100]

[0101] Among them, n i,j The keyword t iThe number of occurrences in the page content information, ∑ k n k,j It is the sum of the number of occurrences of all keywords in the page content information.

[0102] It should be noted that the inverse document frequency (IDF) is a measure of the general importance of a word, that is, a measure of the importance of a word to the entire corpus. For the IDF of a specific keyword in the page content information, the total number of web pages in all detected web pages divided by the number of web pages containing the keyword, and then taking the logarithm of the quotient is obtained:

[0103]

[0104] Where |D| is the total number of web pages in all detected web pages, and the denominator |{j:t i ∈d j}| is a string containing the keyword t i If the word is not in the corpus, the denominator will be zero, so 1+|{j:t i ∈d j}|.

[0105] For the page element information S j Keywords in t i The importance of TF-IDF is calculated as follows:

[0106] S j =TF i,j ×IDF i (8)

[0107] The page element information S1 of the first visit to the site and the page element information S2 of the second visit to the site are obtained.

[0108] In the above embodiment, the page content information of the accessed site can be quickly extracted and segmented, and the page element information can be determined according to the total number of web pages and the number of web pages containing keywords, as well as the frequency of keywords, thereby improving the efficiency and accuracy of the operation.

[0109] Figure 4 A flow chart of a method for obtaining user operation element information in an embodiment of the present disclosure is shown as follows: Figure 4 As shown, the method for obtaining user operation element information includes: S402, obtaining user operation information; S404, performing keyword extraction and word segmentation processing on the user operation information; S406, calculating the frequency of each keyword in the user operation information; S408, determining the user operation element information according to the total number of web pages and the number of web pages containing the keywords, and the frequency of the keywords.

[0110] It should be noted that user operation information includes information on the browser side and the operating system side. The text information in the user operation information is subjected to keyword extraction and word segmentation processing through text analysis tools. Among them, when extracting keywords, only nouns, verbs, adjectives and other words with substantive meanings can be focused on, while prepositions, numerals, quantifiers and other unimportant information, that is, words that should be deleted, are ignored. Use image recognition algorithms, machine learning algorithms and other technologies to identify the image information in the user operation information, convert the image information into text information, and use the method of processing text information to perform keyword extraction and word segmentation processing.

[0111] In the above embodiment, keyword extraction and word segmentation processing can be quickly performed on user operation information, and page operation element information can be determined according to the total number of web pages and the number of web pages containing keywords, as well as the word frequency of keywords, thereby improving the efficiency and accuracy of calculations.

[0112] Based on the same inventive concept, the present disclosure also provides an access tracking detection device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0113] Figure 5 A schematic diagram of an access tracking detection device in an embodiment of the present disclosure is shown. Figure 5 As shown, the access tracking detection device 5 includes: a first site acquisition module 501, a second site acquisition module 502, a differential information determination module 503, a correlation difference calculation module 504 and a detection result determination module 505; the first site acquisition module 501, the second site acquisition module 502, the differential information determination module 503, the correlation difference calculation module 504 and the detection result determination module 505 are connected in sequence.

[0114] The first site acquisition module 501 acquires page element information of the site visited for the first time;

[0115] The second site acquisition module 502 acquires page element information of the second visited site;

[0116] The difference information determination module 503 determines the difference information of the page element information between the first visit to the site and the second visit to the site;

[0117] A correlation difference calculation module 504 calculates a correlation difference based on the page element information difference information and the user operation element information;

[0118] The detection result determination module 505 determines the access tracking detection result according to the correlation difference.

[0119] In the above embodiment, by analyzing the correlation between the page element information and the user operation element information of the user's two visits to the site, the unchanged information of the two operations is eliminated and the time difference between the two operations is considered, and a comprehensive judgment is made as to whether the site uses tracking technology to collect user information; even if the tracking technology is constantly updated, as long as the site uses it to recommend advertisements related to the user, it can be detected by the present invention, avoiding the problem that the prior art needs to constantly update the prior knowledge of tracking technology, and combined with manual code analysis, it is also helpful to discover new tracking technologies.

[0120] Figure 6 A flow chart of another access tracking detection method in the embodiment of the present disclosure is shown as follows: Figure 6 As shown, the access tracking detection method provided in the embodiment of the present disclosure includes the following steps:

[0121] S602, collecting user page content information and user operation information;

[0122] In one embodiment, when a user visits a Web site for the first time, page content information is obtained through a browser extension, and user operation information is collected through a browser during an interval; when the user visits the Web site for the second time, page content information is obtained again through a browser extension.

[0123] It should be noted that obtaining the page content information includes but is not limited to obtaining the HTML source code of the page, which can be obtained through the JavaScript API. By simulating the scroll wheel operation through JavaScript (window.scrollTo), the visited website page can be fully loaded, avoiding the situation where the user cannot obtain the complete HTML source code when the website page is just opened due to the dynamic loading technology used by some websites.

[0124] It should be noted that user operation information includes but is not limited to browser side information and operating system side information. The present disclosure embodiment takes browser side information and operating system side information as examples for introduction. Browser side information includes but is not limited to the search content entered, the text description information corresponding to the clicked link, and the link URL corresponding to the clicked image;

[0125] Figure 7 A schematic diagram of a method for obtaining search content in an embodiment of the present disclosure is shown. Figure 7 As shown, the input search content is obtained by adding a monitor to dynamically check the real-time changes of the input tag.

[0126] Figure 8 A schematic diagram of obtaining text information in an embodiment of the present disclosure is shown. Figure 8As shown, the text description information corresponding to the clicked link and the link URL corresponding to the clicked image are obtained by monitoring the user's click behavior and obtaining the link of the clicked object and the contextual text description information; since the clicked object usually corresponds to a tag, only the useful attributes under the tag and the text information under the tag are obtained; the useful attributes under the tag include src, alt, and title; the text information under the tag is obtained through innerText.

[0127] Operating system side information includes but is not limited to clipboard information, Fig. 9 A schematic diagram of reading clipboard information in an embodiment of the present disclosure is shown. Fig. 9 As shown, due to security and privacy issues, the data in the clipboard cannot be read directly in the browser. The data in the clipboard can only be read when a paste operation is initiated; this paste event is triggered as long as ctrl+c is pressed in the page, even if there is no input box in the web page.

[0128] S604, extracting page content information and user operation information, and generating page element information and user operation element information.

[0129] In one embodiment, the page content information is the sum of text information T and picture information P:

[0130] In one embodiment, extracting text information T includes: extracting keywords and performing word segmentation on the text information through a text analysis tool. When extracting keywords, only words with substantial meanings such as nouns, verbs, and adjectives can be focused on, while prepositions, numerals, and quantifiers, which are unimportant information or words that should be deleted, are ignored.

[0131] In one embodiment, extracting image information P includes: using image recognition algorithms, machine learning algorithms and other technologies to identify the image clicked by the user and all the images on the page, converting the information in the image into text information, and using the method for processing text information T to perform keyword extraction and word segmentation calculations to obtain the image information P.

[0132] In one embodiment, the text information in the user operation information is subjected to keyword extraction and word segmentation processing through a text analysis tool. When extracting keywords, only words with substantial meanings such as nouns, verbs, and adjectives can be focused on, while prepositions, numerals, and quantifiers, which are unimportant information that should be deleted, are ignored. The image information in the user operation information is identified using technologies such as image recognition algorithms and machine learning algorithms, and the image information is converted into text information. The keyword extraction and word segmentation processing are then performed using the method for processing text information.

[0133] In one embodiment, when a user visits website A for the first time, the page content information and user operation information of website A are recorded. When the user visits website A for the second time, the page content information is recorded again. j The calculation method is as follows TF-IDF algorithm:

[0134] For keywords in the page content information i For example, the keyword t i The word frequency can be expressed as:

[0135]

[0136] Among them, n i,j The keyword t i The number of occurrences in the page content information. The denominator is the sum of the number of occurrences of all keywords in the page content information.

[0137] It should be noted that the inverse document frequency (IDF) is a measure of the general importance of a word, that is, a measure of the importance of a word to the entire corpus. For the IDF of a specific keyword in the page content information, the total number of web pages in all detected web pages divided by the number of web pages containing the keyword, and then taking the logarithm of the quotient is obtained:

[0138]

[0139] Where |D| is the total number of web pages in all detected web pages, and the denominator |{j:t i ∈d j}| is a string containing the keyword t i If the word is not in the corpus, the denominator will be zero, so 1+|{j:t i ∈d j}|.

[0140] For the page element information S j Keywords in t i The importance of TF-IDF is calculated as follows:

[0141] S j =TF i,j ×IDF i (8)

[0142] The page element information S1 and the page element information S2 are obtained by calculation. Similarly, the user operation element information U can be obtained by calculation.

[0143] S606, performing Web tracking detection and determination according to the page element information and the user operation element information.

[0144] In one embodiment, by comparing the correlation value between the difference information of the element information of the two visited pages and the element information of the user operation, it is determined whether the website is tracking the user.

[0145] In one embodiment, the page element information S is calculated 1 and page element information S 2 The cosine degree is used to calculate the correlation coefficient between the user operation element information U and the two previous and subsequent ones, and the correlation value between the user operation element information U and the page element information difference value δ is calculated. The TF-IDF algorithm is used to calculate the frequency and importance of keywords, and the cosine similarity is used to calculate the correlation.

[0146]

[0147]

[0148] Calculate the difference value δ between the user operation element information U and the page element information respectively 1 and the page element information difference value δ 2 The correlation is calculated as follows:

[0149]

[0150] Among them, U i and δ j,i Represent vectors U and δ respectively j The components of U and δ j When the number of components i is inconsistent, the repeated filling method is used to fill it.

[0151] where δ 1 Indicates that Web site A is visited twice in succession. The information set of the two common visited pages is removed based on the first page element information S1. 1 is the correlation between the information set and the user operation element information U of visiting Web site A twice; 2 Indicates that Web site A is visited twice in succession. Based on the second page element information S2, the information set of the two common visited page information is removed. γ 2 It is the correlation between the information set and the user operation element information U of visiting the website A twice.

[0152] The correlation coefficient μ is obtained by calculating the correlation difference of the two page element information difference values ​​and multiplying it by the access interval coefficient.

[0153]

[0154] Among them, γ 2 -γ 1 is the correlation difference between the two page element information difference values, is the access interval coefficient between two visits. The access interval coefficient function decreases exponentially with the growth of parameter t and also decreases exponentially with the increase of integer n. That is, the longer the interval between two visits or the more interval steps, the lower the correlation. The image of the access interval coefficient function can be referred to Figures 10 to 12 , Fig.10 The access interval coefficient function image of t=2 in the embodiment of the present disclosure is shown. Fig.11 The access interval coefficient function image of t=1 in the embodiment of the present disclosure is shown. Fig.12 The access interval coefficient function graph of t=0.2 in the embodiment of the present disclosure is shown.

[0155] Where t is the time difference between the two visits to Web site A, in seconds. By obtaining the first visit time to Web site A as T 1 , the second visit to Web site A takes place at T 2 ,The interval time difference t can be obtained by calculating the difference between the two times, that is,

[0156] t=T 2 -T 1 (5)

[0157] Wherein, n is the step difference between two visits to the website A, and n is a positive integer greater than or equal to 1. The step difference n can be calculated by obtaining the visit records of the time-series pages.

[0158] Fig.13 A schematic diagram of a step difference in an embodiment of the present disclosure is shown, such as Fig.13 As shown, S1302, the user first opens page A; S1304, then refreshes page A, in this case n=1; Fig.14 Another schematic diagram of step difference in the embodiment of the present disclosure is shown as follows: Fig.14 As shown, S1402, the user first opens page A; S1404, then clicks on a link to access page B; S1406, then clicks on a return link to access page A. In this case, n=2, and the method for calculating the step difference n can be obtained by analogy.

[0159] When the correlation coefficient μ exceeds a certain threshold, it can be determined that Website A is tracking users.

[0160] In one embodiment, the correlation coefficient μ takes a value of 0.5.

[0161] In the above embodiment, by analyzing the correlation between the page element information and the user operation element information of the user's two visits to the site, the unchanged information of the two operations is eliminated, and the time difference and step difference of the two operations are considered to quantify their correlation, and a comprehensive judgment is made as to whether the site uses tracking technology to collect user information; even if the tracking technology is constantly updated, as long as the site uses it to recommend advertisements related to the user, it can be detected by the present invention, avoiding the problem that the prior art needs to constantly update the prior knowledge of tracking technology, and combined with manual code analysis, it is also helpful to discover new tracking technologies.

[0162] Fig.15 An access tracking automatic detection device according to an embodiment of the present disclosure is shown; Fig.15 As shown, the access tracking automated detection device includes a browser 1501, a browser extension 1502, a data storage and analysis module 1503, a Web site 1504, and a terminal peripheral 1505; the task manager is responsible for controlling the number of concurrent processes of the entire process and distributing tasks to each process, i.e., the browser 1501 automated testing tool; the tasks include but are not limited to specifying the URL of the Web site 1504 to be visited, configuring the browser 1501, etc.; each process is responsible for configuring and starting the browser 1501, installing the browser extension 1502, simulating user operations, and cooperating with multi-process automated scripts to realize automated processes.

[0163] For the URL set S of the Web site 1504 to be detected, the steps include: (1) selecting a URL from the URL set S through the browser 1501 to access the Web site 1504, simulating a mouse click on a blank space on the page to cancel the suspended login window, simulating a scroll wheel operation to scroll to the bottom of the page to fully load the page, and recording the page source code. (2) Extracting the search box in the homepage, i.e. <input> Tag, simulate the user input search items, simulate the enter operation, randomly select 3 picture links in the page that jumps to click, and record the search item content, where the search items can be of different types and are expandable. (3) Extract the text links and picture links in the homepage, and randomly click them 3 times respectively, and record the relevant content of the clicked links. (4) Close all windows. If there are still Web site 1504 URLs to be detected in the URL set S, repeat operation (1), otherwise proceed to step (5). (5) For the Web site 1504 data recorded in the above steps, the simulated user operation element information and page element information are obtained.

[0164] The data storage and analysis module 1503 stores the loading tracking detection method, receives the peripheral operation information transmitted through the terminal peripheral 1505, and receives the user operation element information and the page element information, and obtains the set of Web sites 1504 that are tracking the user.

[0165] In the above embodiment, by storing the loading tracking detection method through the data storage and analysis module 1503, receiving the peripheral operation information transmitted through the terminal peripheral 1505, and receiving the user operation element information and page element information, it is possible to more effectively determine the set of Web sites 1504 that are tracking the user and improve the efficiency of access tracking detection.

[0166] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0167] Refer to the following Fig.16 1600 according to this embodiment of the present disclosure is described. Fig.16 The electronic device 1600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0168] like Fig.16 As shown, the electronic device 1600 is in the form of a general computing device. The components of the electronic device 1600 may include but are not limited to: at least one processing unit 1610, at least one storage unit 1620, and a bus 1630 connecting different system components (including the storage unit 1620 and the processing unit 1610).

[0169] The storage unit stores a program code, which can be executed by the processing unit 1610, so that the processing unit 1610 executes the steps described in the "Exemplary Method" section of the specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 1610 can execute the following steps of the above method embodiment: obtaining page element information of the first visit site; obtaining page element information of the second visit site; determining the difference information of the page element information of the first visit site and the second visit site; calculating the correlation difference value based on the difference information of the page element information and the user operation element information; determining the access tracking detection result based on the correlation difference value. .

[0170] For example, the processing unit 1610 can execute the following steps of the above method embodiment: obtain the visit time of the first visit to the site; obtain the visit time of the second visit to the site; determine the interval time difference and the step difference between the first visit to the site and the second visit to the site; determine the visit interval coefficient based on the interval time difference and the step difference.

[0171] For example, the processing unit 1610 can execute the following steps of the above method embodiment: obtaining user operation information; performing keyword extraction and word segmentation processing on the user operation information; calculating the word frequency of each keyword in the user operation information; and determining the user operation element information based on the total number of web pages and the number of web pages containing the keywords, and the word frequency of the keywords.

[0172] For example, the processing unit 1610 can execute the following steps of the above method embodiment: obtain page content information of the visited site; perform keyword extraction and word segmentation processing on the page content information; calculate the word frequency of each keyword in the page content information; determine the page element information based on the total number of web pages and the number of web pages containing keywords, and the word frequency of keywords.

[0173] The storage unit 1620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 16201 and / or a cache storage unit 16202 , and may further include a read-only storage unit (ROM) 16203 .

[0174] The storage unit 1620 may also include a program / utility 16204 having a set (at least one) of program modules 16205, such program modules 16205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0175] Bus 1630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0176] The electronic device 1600 may also communicate with one or more external devices 1640 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1600, and / or communicate with any device that enables the electronic device 1600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1650. Furthermore, the electronic device 1600 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1660. As shown, the network adapter 1660 communicates with other modules of the electronic device 1600 via a bus 1630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0177] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0178] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0179] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0180] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0181] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0182] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0183] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0184] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0185] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0186] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. An access tracking detection method, characterized in that: include: Get the page element information of the first visit to the site; Get the page element information of the second visit to the site; Determine the difference information of page element information between the first visited site and the second visited site; Calculate the correlation difference based on the page element information difference information and the user operation element information; Determine the access tracking detection result according to the correlation difference; The step of determining the access tracking detection result according to the correlation difference includes: The correlation coefficient μ is obtained by calculating the correlation difference of the two page element information difference values ​​and multiplying it by the access interval coefficient. When the correlation coefficient μ exceeds a certain threshold, it is determined that the site is tracking users. The calculation formula of the correlation coefficient μ is as follows: in, is the access interval coefficient between two visits, γ2-γ1 is the correlation difference; t is the time difference between two visits to Web site A; n is the difference in the number of steps between the two visits to the site.

2. The access tracking detection method according to claim 1, characterized in that: Also includes: Get the access time of the first visit to the site; Get the access time of the second visit to the site; Determine the time difference and the step count difference between the first visit to the site and the second visit to the site; The access interval coefficient is determined according to the interval time difference and the step number difference.

3. The access tracking detection method according to claim 1, characterized in that: Also includes: Get page content information of visited sites; Extract keywords and perform word segmentation on the page content information; Calculating the frequency of each keyword in the page content information; The page element information is determined according to the total number of web pages, the number of web pages containing keywords, and the frequency of keywords.

4. The access tracking detection method according to claim 3, characterized in that: The page content information includes text information and picture information; The keyword extraction and word segmentation processing of the page content information includes: Extract keywords and perform word segmentation on the text information; The image information is converted into text information, and then keyword extraction and word segmentation are performed.

5. The access tracking detection method according to claim 1, characterized in that: Also includes: Get user operation information; Extract keywords and perform word segmentation processing on the user operation information; Calculating the frequency of each keyword in the user operation information; The user operation element information is determined according to the total number of web pages, the number of web pages containing keywords, and the frequency of keywords.

6. The access tracking detection method according to claim 5, characterized in that: The user operation information includes browser side information and operating system side information.

7. The access tracking detection method according to claim 1, characterized in that: Also includes: When the number of components of the page element information difference information and the user operation element information are inconsistent, based on a repeated filling method, the number of components of the page element information difference information and the user operation element information are adjusted to be consistent.

8. An access tracking detection device, characterized in that: include: A first site acquisition module, which acquires page element information of a site visited for the first time; A second site acquisition module, which acquires page element information of the second visited site; A difference information determination module is used to determine the difference information of page element information between the first visited site and the second visited site; A correlation difference calculation module calculates a correlation difference based on the page element information difference information and the user operation element information; A detection result determination module determines the access tracking detection result according to the correlation difference; The detection result determination module is further used to obtain a correlation coefficient μ by calculating the correlation difference between two page element information difference values ​​and multiplying the access interval coefficient. When the correlation coefficient μ exceeds a certain threshold, it is determined that the site is tracking the user. The calculation formula of the correlation coefficient μ is as follows: in, is the access interval coefficient between two visits, γ2-γ1 is the correlation difference; t is the time difference between two visits to Web site A; n is the difference in the number of steps between the two visits to the site.

9. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the access tracking detection method according to any one of claims 1 to 7 by executing the executable instructions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access tracking detection method according to any one of claims 1 to 7 is implemented.

Images