Method and device for evaluating a plurality of transactions, computer device and storage medium

Abstract

The application relates to an evaluation method and device of a polymerization transaction platform, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring a positioning sequence corresponding to each of a plurality of marked positioning markers; performing positioning marker feature extraction based on each positioning sequence to acquire a positioning marker feature corresponding to each positioning marker; performing similarity processing on each positioning marker feature to determine a similar positioning marker set similar to each to-be-judged positioning marker through a similarity result obtained; and determining a target interaction type of each to-be-judged positioning marker through a positioning marker with a judged interaction type in each similar positioning marker set. The method can improve the accuracy of the evaluation of the polymerization transaction platform.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to an evaluation method, apparatus, computer equipment, and storage medium for an aggregated trading platform. Background Technology

[0002] With the development of internet technology and the popularization of online payment, more and more merchants have integrated online payment functionality. Users can make online payments through third-party payment applications installed on their devices. As an extension of third-party payment, fourth-party payment, or aggregated payment, has also become one of the mainstream methods of online payment. How to effectively discover and determine the Uniform Resource Locators (URLs) of the continuously emerging aggregated payment systems is a problem that needs to be solved.

[0003] Currently, models can be built using machine learning and deep learning algorithms, using URL description text and embedded text as data sources to output the interaction type of the URL. However, due to the large number of aggregated payment platforms and the rapid changes in their URLs, the interaction types obtained from description text and embedded text are not accurate enough. Therefore, improving the accuracy of evaluating aggregated transaction platforms is an urgent problem to be solved. Summary of the Invention

[0004] Therefore, it is necessary to provide an evaluation method, apparatus, computer equipment, and storage medium for aggregated trading platforms that can improve the accuracy of evaluation of aggregated trading platforms, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a method for evaluating aggregated trading platforms. The method includes:

[0006] Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0007] Based on each locator sequence, locator features are extracted to obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0008] For each locator feature, a similarity calculation is performed, and the set of similar locators that are similar to each locator to be judged is determined based on the obtained similarity results.

[0009] By identifying the interaction type of each locator to be identified from the locators in each set of similar locators, determine the target interaction type of each locator to be identified.

[0010] Secondly, this application also provides an evaluation device for an aggregated trading platform. The device includes:

[0011] The sequence acquisition module is used to acquire the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0012] The feature extraction module is used to extract locator features based on each locator sequence, and obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0013] The similarity calculation module is used to perform similarity processing on each locator feature and determine the set of similar locators that are similar to each locator to be judged based on the obtained similarity results.

[0014] The interaction type determination module is used to determine the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators.

[0015] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0016] Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0017] Based on each locator sequence, locator features are extracted to obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0018] For each locator feature, a similarity calculation is performed, and the set of similar locators that are similar to each locator to be judged is determined based on the obtained similarity results.

[0019] By identifying the interaction type of each locator to be identified from the locators in each set of similar locators, determine the target interaction type of each locator to be identified.

[0020] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0021] Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0022] Based on each locator sequence, locator features are extracted to obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0023] For each locator feature, a similarity calculation is performed, and the set of similar locators that are similar to each locator to be judged is determined based on the obtained similarity results.

[0024] By identifying the interaction type of each locator to be identified from the locators in each set of similar locators, determine the target interaction type of each locator to be identified.

[0025] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0026] Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0027] Based on each locator sequence, locator features are extracted to obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0028] For each locator feature, a similarity calculation is performed, and the set of similar locators that are similar to each locator to be judged is determined based on the obtained similarity results.

[0029] By identifying the interaction type of each locator to be identified from the locators in each set of similar locators, determine the target interaction type of each locator to be identified.

[0030] The aforementioned evaluation method, apparatus, computer equipment, storage medium, and computer program product of the aggregated trading platform acquire locator sequences corresponding to multiple labeled locators. The labeled locators include locators to be determined and locators with determined interaction types. Each locator sequence includes multiple locators with interactive relationships, and each locator has corresponding locator element information. Based on this, locator feature extraction is performed on each locator sequence to obtain the locator features corresponding to each locator. The locator features include at least: element features corresponding to the locator element information of the locator, and intra-sequence association features between the locator and locators belonging to the same locator sequence. Similarity processing is performed on each locator feature, and the obtained similarity results determine a set of similar locators similar to each locator to be determined. Finally, the target interaction type of each locator to be determined is determined using the locators with determined interaction types in each set of similar locators. Because locators within the same locator sequence have interactive relationships, the locator features determined by the locator sequence can include not only the element features of the locator itself, but also the intra-sequence association features with other locators that have interactive relationships. This allows locator features to describe locators from more dimensions. Based on this, the locators with determined interaction types in the resulting set of similar locators have a high similarity to the interaction types of the locators to be determined. Therefore, the target interaction type of the locators to be determined is more accurate, thereby improving the accuracy of the evaluation of the aggregated trading platform. Attached Figure Description

[0031] Figure 1 This is a diagram illustrating the application environment of an evaluation method for an aggregated trading platform in one embodiment.

[0032] Figure 2 This is a flowchart illustrating the evaluation method of an aggregated trading platform in one embodiment;

[0033] Figure 3 This is a flowchart illustrating the process of extracting element features and intra-sequence association features from a locator sequence to obtain locator features in one embodiment.

[0034] Figure 4 This is a flowchart illustrating the process of obtaining multiple locator sequences in one embodiment;

[0035] Figure 5 This is a flowchart illustrating the process of obtaining a combination of locators in one embodiment;

[0036] Figure 6 This is a flowchart illustrating the process of obtaining a combination of locators in another embodiment;

[0037] Figure 7This is a schematic diagram illustrating the complete process of constructing a locator combination using request jump association triplets and access behavior association triplets in one embodiment.

[0038] Figure 8 This is a schematic diagram of the data preprocessing process in one embodiment;

[0039] Figure 9 This is a schematic diagram illustrating the complete process of obtaining the sequence of locators corresponding to each of multiple marked locators in one embodiment.

[0040] Figure 10 This is a partial flowchart illustrating the process of constructing a locator association graph and obtaining locator features based on the locator association graph in one embodiment.

[0041] Figure 11 This is a schematic diagram of an embodiment of the locator association graph;

[0042] Figure 12 This is a flowchart illustrating a method for constructing a locator association graph in one embodiment;

[0043] Figure 13 This is a schematic diagram of the process of obtaining locator features based on locator association graph in one embodiment;

[0044] Figure 14 This is a partial flowchart illustrating the process of creating a locator co-occurrence map and obtaining locator features based on the locator co-occurrence map in one embodiment.

[0045] Figure 15 This is a schematic diagram of an embodiment of the locator association graph;

[0046] Figure 16 This is a partial flowchart illustrating the similarity calculation using the nearest neighbor search algorithm in one embodiment.

[0047] Figure 17 This is a partial flowchart illustrating the similarity calculation process in one embodiment;

[0048] Figure 18 This is a flowchart illustrating the process of calculating feature similarity and element information similarity to obtain similarity results in one embodiment;

[0049] Figure 19 This is a partial flowchart illustrating the similarity calculation process in another embodiment;

[0050] Figure 20 This is a flowchart illustrating the process of calculating feature similarity and interaction device relevance to obtain similarity results in one embodiment;

[0051] Figure 21This is a flowchart illustrating the process of calculating feature similarity, element information similarity, and interaction device relevance to obtain similarity results in one embodiment.

[0052] Figure 22 This is a flowchart illustrating a method for determining marked locators in one embodiment;

[0053] Figure 23 This is a complete flowchart illustrating a method for determining marked locators in one embodiment;

[0054] Figure 24 This is a flowchart illustrating the process of determining the target interaction type for each locator to be determined in one embodiment.

[0055] Figure 25 This is a flowchart illustrating the information association process in one embodiment;

[0056] Figure 26 This is a schematic diagram illustrating the complete process of the evaluation method for an aggregated trading platform in one embodiment;

[0057] Figure 27 This is a structural block diagram of the evaluation device of an aggregated trading platform in one embodiment;

[0058] Figure 28 This is a structural block diagram of the evaluation device for an aggregated trading platform in another embodiment;

[0059] Figure 29 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] With the development of internet technology and the widespread adoption of online payments, an increasing number of merchants have integrated online payment functionality. Users can make online payments through third-party payment applications installed on their devices. As an extension of third-party payments, fourth-party payments, also known as aggregated payments, have become one of the mainstream online payment methods. Aggregated payments exist between third-party payment providers and merchants. Aggregated payment service providers do not require licenses; they are payment service integrators that combine third-party payments with multiple payment channels, providing comprehensive solutions such as fund collection, reconciliation, splitting, and settlement. However, due to the characteristics of aggregated payments, they are easily exploited by sensitive industries as payment platforms for fund transfers. Therefore, effectively identifying and mining the continuously emerging URLs of aggregated payments is a problem that needs to be addressed.

[0062] Currently, URLs can be manually reviewed and feedback provided. However, manual review is inefficient, costly, and prone to human error. Alternatively, URL descriptions and embedded text can be used as data sources to build models using machine learning and deep learning algorithms, outputting the URL's interaction type. However, due to the large number of aggregated payment platforms and the rapid changes in their URLs, the interaction types obtained from descriptions and embedded text are not accurate enough. Therefore, improving the accuracy of aggregated transaction platform evaluation is a pressing issue. Based on this, the evaluation method for aggregated transaction platforms provided in this application can improve the accuracy of aggregated transaction platform evaluation.

[0063] The evaluation method for aggregated trading platforms provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another server.

[0064] Specifically, taking server 104 as an example, server 104 can obtain locator sequences corresponding to multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interactive relationships, and each locator has corresponding locator element information. In this embodiment, the locators described are all URLs. Next, server 104 extracts locator features based on each locator sequence, obtaining locator features corresponding to each locator. Locator features include at least: element features corresponding to the locator element information of the locator, and intra-sequence association features between the locator and locators belonging to the same locator sequence, thereby obtaining locator features describing the locator from more dimensions. Based on this, the server performs similarity processing on each locator feature, determines a set of similar locators similar to each locator to be determined through the obtained similarity results, and finally determines the target interaction type of each locator to be determined through the locators with determined interaction types in each set of similar locators. By identifying the interaction types of locators with determined interaction types in the similarity locator set and the interaction types of the locator to be determined, the accuracy of the aggregated trading platform's evaluation can be improved.

[0065] The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0066] Based on this, the evaluation method for aggregated transaction platforms provided in this application embodiment can be specifically applied to scenarios such as aggregated payment URL discovery and aggregated payment security identification. That is, the evaluation of aggregated transaction platforms can include: identifying whether it is an aggregated payment URL that indicates an aggregated payment platform, and further evaluating whether the aggregated payment URL is related to or used by sensitive industries based on the identification of the aggregated payment URL, so as to complete the risk assessment of the aggregated interaction platform.

[0067] To facilitate understanding, we will first take the scenario of URL mining for aggregated payments as an example. Since aggregated payment service providers do not require licenses and are merely payment service integrators, aggregated payment platforms can be created and added relatively easily and frequently. Using the evaluation method for aggregated transaction platforms provided in this application embodiment, we first obtain the locator sequences corresponding to multiple marked locators, and then extract locator features based on each locator sequence to obtain the locator features corresponding to each locator. These locator features consider the element features corresponding to the locator element information of the URL. For URLs of the aggregated payment type, the locator element information includes at least: URL text information, image information, structural information, interactive device information, and other relevant information. Furthermore, the locator features also consider intra-sequence association features. Based on the characteristic that aggregated payment platforms exist between third-party payment platforms and merchants, it is known that there is an interactive association relationship between aggregated payment URLs and third-party payment URLs, as well as an interactive association relationship with merchant URLs. Therefore, for URLs of the aggregated payment type, the intra-sequence association features of aggregated payments can describe the association with URLs that have interactive association relationships, thereby obtaining locator features describing the URL from more dimensions.

[0068] Furthermore, similarity processing is performed on each locator feature. The resulting similarity results determine a set of similar locators similar to each locator to be determined. URLs in this set have a higher similarity to their associated URLs than URLs not belonging to this set. Therefore, for URLs related to aggregated payment types, if most URLs in the set of similar locators associated with aggregated payment types are also of aggregated payment type, then for tagged locators, a set of similar locators can also be obtained. By using the locators in this set whose interaction types have been determined, the interaction type of the tagged locator can be accurately described. That is, if all locators in the set whose interaction types have been determined are of aggregated payment type, then the interaction type of the tagged locator can be confirmed as aggregated payment type, thus completing the discovery of aggregated payment URLs.

[0069] Secondly, taking the scenario of security identification of aggregated payment as an example, the evaluation method of the aggregated transaction platform provided in this application embodiment can be used to determine whether the interaction type of the locator to be determined is the aggregated payment type. In this case, the interaction type of the locator included in the locator sequence corresponding to the locator to be determined can be used to determine whether the aggregated payment URL is associated with a sensitive industry. That is, when the locator sequence corresponding to the aggregated payment type includes a URL with a sensitive interaction type, it may be that the aggregated payment URL is used by a sensitive industry, or the third-party payment platform associated with the aggregated payment URL is not a legitimate payment platform. Therefore, it can also be determined that the payment service URL has a payment security risk, and in actual application, interaction security notifications and other reminders for aggregated payment security can be issued.

[0070] It is understood that, in practical applications, the evaluation method of the aggregated trading platform provided in this application embodiment can also be applied to sensitive industry discovery, sensitive payment service discovery, sensitive interactive webpage discovery, and sensitive interactive APP discovery, etc. Therefore, the foregoing embodiments are only used to understand the applicable scenarios of this application embodiment and should not be construed as limiting this solution.

[0071] In one embodiment, such as Figure 2 As shown, an evaluation method for aggregated trading platforms is provided, which can be applied to... Figure 1 Using a server as an example, it can be understood that this method can also be applied to systems including terminals and servers, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0072] Step 202: Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0073] The marked locators include locators to be determined and locators with determined interaction types. The marked locators are locators with interaction types to be determined, and locators with determined interaction types can be locators determined to be aggregated interaction types. Secondly, the interaction associations include at least: request redirection associations and access behavior associations. The request redirection association describes a jump from an access address indicated by one locator to an access address indicated by a marked locator, and then a jump from the access address indicated by the marked locator to an access address indicated by another locator. Secondly, the access behavior association describes continuous access behavior within a preset time window, that is, within the preset time window: there is access behavior that accesses multiple access addresses indicated by locators. The preset time window is usually a short time interval window, such as 30 seconds (s), 1 minute (min), and 5 minutes. It should be understood that the locators described in this embodiment are all URLs.

[0074] Based on this, a locator sequence must include at least three locators with interactive relationships. Because of these interactive relationships, there is also an interaction order among the locators. Therefore, a locator sequence includes multiple locators with request redirection relationships, and in this case, there is a request order among the locators. Similarly, a locator sequence includes multiple locators with access behavior relationships, and in this case, there is an access order among the locators, which needs to be based on access time. Secondly, the locator element information corresponding to each locator includes at least: URL text information, image information, structural information, interactive device information (which may include interactive device identifiers, etc.), and other relevant information built into the URL, as well as visually relevant information in the access address indicated by the URL, which is not limited here.

[0075] Specifically, a server can construct a locator sequence using multiple locators that have a request jump association with the tagged locator. For example, if an interactive device jumps from the access address indicated by locator A1 to the access address indicated by the tagged locator, and then jumps from the access address indicated by the tagged locator to the access address indicated by locator A2, then the locator sequence includes locator A1, the tagged locator, and locator A2, and the interaction order between the aforementioned locators is: locator A1 to tagged locator to locator A2.

[0076] Similarly, the server can also construct a locator sequence using multiple locators that have access behavior associations with the marked locator. For example, within a preset time window: there are access behaviors that access locators A1 to A3, as well as the access addresses indicated by the marked locators, and the access time for accessing the access address indicated by locator A1 is 17:20:00, the access time for accessing the access address indicated by locator A2 is 17:20:10, the access time for accessing the access address indicated by locator A3 is 17:20:50, and the access time for accessing the access address indicated by the marked locator is 17:20:25. The access order among the aforementioned locators is: locator A1 to locator A2, marked locator to locator A3.

[0077] Step 204: Extract locator features based on each locator sequence to obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0078] The locator features include at least: element features corresponding to the locator element information, and intra-sequence association features between the locator and locators belonging to the same locator sequence. The aforementioned element features describe the features of the locator itself, while the intra-sequence association features describe the interaction association features between the locator and locators with interactive association relationships.

[0079] Specifically, the server extracts locator features for each locator sequence, obtaining the locator features corresponding to each locator. During feature extraction, a locator sequence can be viewed as information composed of multiple word segments, and each locator in the sequence can be considered a word segment. Therefore, the server specifically extracts the element features of each locator in the locator sequence based on word2vec, that is, embedding the locator into a word vector at the word segmentation granularity to generate word vectors (i.e., element features). Based on this, since the server ignores word order (i.e., the interaction and association relationships between each locator in the same locator sequence) during word2vec, the server needs to specifically extract the intra-sequence association features between locators in the locator sequence based on doc2vec, that is, embedding the locator into a sentence vector at the sentence granularity to generate sentence vectors (i.e., intra-sequence association features). This allows the word order information (i.e., interaction and association relationships) to be compensated for at the sentence granularity.

[0080] Furthermore, the server performs embedding vector averaging on the word vectors (i.e., element features) extracted from word2vec and the sentence vectors (i.e., intra-sequence association features) extracted from doc2vec to obtain locator features. Specifically, as follows... Figure 3 As shown, the server extracts element features 302 of each locator in the locator sequence 301 based on word2vec, and extracts intra-sequence association features 303 between locators in the locator sequence 301 based on doc2vec. Then, the element features 302 and the intra-sequence association features 303 are averaged using embedding vectors 304 to obtain locator features 305.

[0081] Furthermore, the aforementioned Embedding vector averaging process is specifically a weighted averaging process, which is based on the weights of element features and element features, and the weights of intra-sequence correlation features and intra-sequence correlation features. In practical applications, the weights of element features are set to be greater than the weights of intra-sequence correlation features.

[0082] Step 206: Perform similarity processing on each locator feature, and determine the set of similar locators that are similar to each locator to be determined based on the obtained similarity results.

[0083] The similarity calculation is used to: calculate the feature similarity between each locator feature, and since locator features include at least element features and intra-sequence association features, the similarity calculation is used at least to: calculate the element feature similarity between element features in each locator feature, and the intra-sequence association feature similarity between intra-sequence association features in each locator feature, wherein the feature similarity between each locator feature includes at least: element feature similarity and association feature similarity.

[0084] Based on this, the similarity locator set includes at least one locator, and the locator features of the locators in the similarity locator set have a high feature similarity to the locator features of the locator to be determined. For example, the feature similarity between the locator features of the locators in the similarity locator set and the locator features of the locator to be determined is greater than the minimum feature similarity value, which can be 60%, 70%, or 80%, etc., and is not limited here. Alternatively, the feature similarity between the locator features of the locator to be determined and the locator features of each locator can be sorted, and the locators with the highest feature similarity are selected to generate a similarity locator set similar to the locator to be determined. The number of similar locators can be 3, 5, or 7, etc., and is not limited here.

[0085] Specifically, the server performs similarity calculations on each locator feature to obtain a similarity result. That is, the similarity result includes the feature similarity between each locator feature. Since the locator feature includes at least element features and intra-sequence association features, the server calculates the element feature similarity between element features in each locator feature and the intra-sequence association feature similarity between intra-sequence association features in each locator feature. Thus, the feature similarity in the obtained similarity result can specifically include element feature similarity and association feature similarity.

[0086] Furthermore, since the server can obtain the feature similarity between the locator features of each labeled locator, and since multiple labeled locators also include multiple locators to be determined, the server can also obtain the feature similarity between the locator features of each locator to be determined and other locator features. Based on this, the server determines the locator features with high feature similarity to the locator features of each locator to be determined by using the feature similarity between the locator features of each locator to be determined and other locator features, and then constructs a set of similar locators similar to the locator to be determined by using the locators corresponding to the locator features with high feature similarity.

[0087] In one possible method for constructing a set of similar locators, the server specifically identifies locator features whose feature similarity to the locator features of each locator to be determined is greater than the minimum feature similarity value as similar locator features, and then constructs a set of similar locators that are similar to the locator to be determined by the locator features corresponding to the similar locator features.

[0088] In another possible method for constructing a set of similar locator features, the server sorts the feature similarity between the locator features and the locator features to be determined for each locator. Then, it selects a predetermined number of locator features with the highest similarity to be identified as similar locator features. Finally, it constructs a set of similar locator features that are similar to the locator to be determined. It is understood that the sorting method can be either descending or ascending, and the specific sorting method does not affect the result. That is, when choosing a descending sorting method, the locator features with the highest number of similar locator features are selected as similar locator features. When choosing an ascending sorting method, the locator features with the lowest number of similar locator features are selected as similar locator features; therefore, no specific limitation is made.

[0089] Step 208: Determine the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators.

[0090] Among them, the locator whose interaction type has been determined can be determined by performing aggregate interaction determination on multiple locators based on aggregate interaction determination conditions. In this case, the locator can be determined as an aggregate interaction type.

[0091] Secondly, the locator whose interaction type has been determined can also be a locator associated with sensitive information. In this case, the locator can be determined as a sensitive interaction type. Sensitive interaction types include at least: sensitive interaction information type and sensitive interaction service type. The sensitive information is information related to sensitive industries, and the sensitive information includes at least: sensitive accounts, sensitive web pages, and sensitive applications, etc., without further limitation.

[0092] Specifically, the server determines the target interaction type for each locator to be determined by using the locators whose interaction types have already been determined in each set of similar locators. That is, the server can determine the interaction type of the locator to be determined as the target interaction type of the locator that pre-determines the majority of locators in the set of similar locators. Alternatively, it can determine the target interaction type of the locator to be determined as the only interaction type included in the set of similar locators.

[0093] Based on this, the target interaction type is used to describe whether the locator to be determined is an aggregated interaction type. Therefore, the target interaction type can be used to determine whether the locator to be determined is used to indicate an aggregated interaction platform. If so, the identification of the aggregated interaction platform is completed. Furthermore, in practical applications, it can be further determined whether locators with interactive relationships with the locator to be determined are associated with sensitive information, thereby completing the risk assessment of the aggregated interaction platform. It should be understood that all examples in this embodiment are only for understanding this solution and should not be construed as limiting this solution.

[0094] In the aforementioned evaluation method for aggregated trading platforms, since locators within the same locator sequence have interactive relationships, the locator features determined through the locator sequence can include not only the elemental features of the locator itself, but also the intra-sequence association features with other locators that have interactive relationships. This allows the locator features to describe the locator from more dimensions. Based on this, the locators with determined interaction types in the resulting set of similar locators have a high similarity to the interaction types of the locators to be determined. Therefore, the target interaction type of the locators to be determined is more accurate, thereby improving the accuracy of the evaluation of the aggregated trading platform.

[0095] The following describes in detail how to obtain the locator sequence: In one embodiment, such as Figure 4 As shown, the sequence of locators corresponding to each of the multiple tagged locators is obtained, including:

[0096] Step 402: Obtain the locator combination corresponding to each marked locator. The locator combination includes multiple locators that have interactive relationships with the marked locators.

[0097] The locator combination includes multiple locators that have interactive relationships with the marked locator. The locator combination may also specifically include locator element information corresponding to each locator, meaning that the locator element information corresponding to each locator belongs to the sequence data corresponding to the locator combination. Secondly, the locator combination can specifically be in the form of a triple, such as locator A1—marked locator—locator A2. As seen in the foregoing embodiments, the interactive relationships at least include request redirection relationships and access behavior relationships. Therefore, the locator combination can include multiple locators with request redirection relationships, and there is a request order among the locators within the locator combination. In this case, the locator combination specifically includes an interactive information locator, a marked locator, and an interactive service locator. The request order is: interactive information locator to marked locator to interactive service locator. If described in triple form, the locator combination is: interactive information locator—marked locator—interactive service locator. Similarly, the locator combination can also include multiple locators with access behavior relationships, and there is an access order among the locators within the locator combination.

[0098] Specifically, the server obtains the locator combination corresponding to each marked locator. This locator combination can be obtained by analyzing the request detection data corresponding to each marked locator, or by determining continuous access behavior within a preset time window, or by a combination of both methods. The preset time window is typically a short time interval, such as 30 seconds, 1 minute, or 5 minutes. The specific method for obtaining the locator combination is not limited here.

[0099] Step 404: Perform data preprocessing on each locator combination to obtain multiple locator sequences.

[0100] The data preprocessing includes at least the following: interactive order arrangement processing, length threshold truncation processing, data desensitization processing, and normalization processing. The data preprocessing specifically processes the locator element information of the locator.

[0101] Specifically, the server performs data preprocessing on each locator combination to obtain multiple locator sequences. Since data preprocessing involves processing the locator element information of each locator, the server needs to perform data preprocessing on the locator element information of each locator in each locator combination to obtain multiple locator sequences. It should be understood that all examples in this embodiment are for understanding the solution only and should not be construed as limiting the solution.

[0102] In this embodiment, the combination of locators corresponding to the marked locators is obtained by requesting detection data or access behavior to ensure that there is a reliable and real interactive relationship between the locators in the locator combination. Secondly, considering that the original data may have abnormal values ​​or data inconsistencies due to different data sources, the locator combination is preprocessed to further ensure the reliability and accuracy of the data between each locator sequence, and also to ensure the efficiency of subsequent data processing, that is, to improve the accuracy and efficiency of the overall aggregated trading platform evaluation.

[0103] The following describes in detail how to obtain the locator combination by analyzing the request detection data corresponding to each tagged locator: In one embodiment, such as Figure 5 As shown, the method for obtaining the locator combination corresponding to each marked locator includes:

[0104] Step 502: Obtain the request detection data corresponding to each marked locator. The request detection data includes at least: request detection logs and request redirection access data.

[0105] The request detection data includes at least two components: request detection logs and request redirection data. The request detection logs are those associated with the marked locators, meaning they can include request detection logs associated with locators to be determined and request detection logs associated with locators whose interaction types have been determined. Secondly, the request redirection data specifically refers to the forward and backward redirection relationships associated with locators among the marked locators that have been determined to be of the aggregate interaction type; that is, the request redirection data constructed based on the redirection logic of the aggregate interaction type locators themselves.

[0106] Specifically, the server obtains request detection logs associated with the marked locators, as well as the previous and next jump access relationships associated with locators that have been determined to be of the aggregation interaction type, to form request detection data.

[0107] Step 504: Perform request redirection analysis on each request detection data, determine the interaction information locator and interaction service locator that have request redirection association with the marked locator, and construct a locator combination, which includes the interaction information locator, the marked locator, and the interaction service locator.

[0108] Among them, the interaction relationship includes at least the request redirection relationship.

[0109] As can be seen from the aforementioned embodiments, the locator of the aggregated interaction type exists between the third-party payment service and the merchant. That is, it is necessary to jump to the access address indicated by the locator of the aggregated interaction type through the interaction request, and then jump to the access address indicated by the locator of the interaction service. Therefore, the request jump analysis is used to analyze whether the marked locator has a request jump relationship with the interaction information locator and the interaction service locator.

[0110] Based on this, the locator combination constructed through request redirection analysis includes interaction information locators, tagged locators, and interaction service locators. Interaction information locators are locators of interaction information type, which includes at least: interaction accounts, interaction web pages, and interaction applications. Interaction service locators are locators of interaction service type, that is, locators specifically used for payment services in practical applications.

[0111] Specifically, the server performs request redirection analysis on each request detection data to determine the interaction information locators and interaction service locators that have request redirection relationships with the marked locators. That is, the server specifically performs request redirection analysis on the request detection logs associated with the marked locators, identifying the interaction information locators and interaction service locators with request redirection relationships within the request detection logs. Furthermore, the server also needs to perform request redirection analysis on the preceding and following redirection access relationships associated with locators determined to be of the aggregated interaction type, identifying the interaction information locators and interaction service locators with request redirection relationships with the marked locators within the preceding and following redirection access relationships.

[0112] It is understandable that, in practical applications, from a business request perspective, the relationship between the aggregated payment platform and the preceding URL redirection (i.e., the request redirection association with the interaction information locator) can be used to detect whether there are suspicious sensitive link requests, and the following URL redirection relationship (i.e., the request redirection association with the interaction service locator) can be used to determine whether the involved third-party payment service platform is legitimate and whether it is related to sensitive chains. Based on this, if the target interaction type of the locator to be determined is an aggregated interaction type, and there are locators of sensitive interaction types in the locator sequence obtained based on the locator combination, then it can be determined that the locator to be determined is related to a sensitive industry and a security alert is required. Sensitive interaction types at least include: sensitive interaction information types and sensitive interaction service types. It should be understood that all examples in this embodiment are only for understanding this solution and should not be construed as limitations of this solution.

[0113] In this embodiment, by performing request jump analysis on the request detection data corresponding to each marked locator, a more accurate request jump association can be obtained through the request jump logic inherent in each locator itself, that is, the locator combination determined thereby is more accurate and reliable.

[0114] The following describes in detail how to determine the combination of locators through continuous access behavior within a preset time window: In one embodiment, such as Figure 6 As shown, the method for obtaining the locator combination corresponding to each marked locator includes:

[0115] Step 602: Obtain multiple locators that have access behavior associations with each marked locator, and construct a locator combination. The locator combination includes the marked locator and multiple locators. The access behavior association is used to describe the existence of continuous access behavior within a preset time window.

[0116] The interaction association includes at least the access behavior association. That is, the locator combination includes a marked locator and multiple locators. The access behavior association describes the existence of continuous access behavior within a preset time window. The preset time window is typically a short time interval, such as 30 seconds (s), 1 minute (min), or 5 minutes. For example, taking a preset time window of 5 minutes, if the device is detected to continuously access locator A1, locator A2, locator A3, and locator A4 within the preset time window, it can be determined that there is an access behavior association between locator A1 and locator A4.

[0117] Specifically, the server detects access behavior for each interactive device (i.e., terminal), and detects that there is continuous access behavior to the marked locator and multiple other locators within a preset time window. In this way, it can construct marked locators with access behavior associations and locator combinations of multiple locators.

[0118] For example, taking a practical application as an example, if a user logs into sensitive website 1 via an interactive device, then performs a payment operation on a third-party payment platform through an aggregated payment platform, and then returns to sensitive website 2 to perform an operation, it can be determined that the interactive device has at least: access to the sensitive website, access to the aggregated payment platform, access to the third-party payment platform, and further access to the sensitive website. At this point, a locator combination can be constructed: a locator indicating sensitive website 1, a locator indicating the aggregated payment platform, a locator indicating the third-party payment platform, and a locator indicating sensitive website 2. It should be understood that all examples in this embodiment are only for understanding this solution and should not be construed as limiting this solution.

[0119] This embodiment provides another method for obtaining locator combinations, improving the reliability and flexibility of locator combinations. Specifically, it considers that continuous access behavior within a short time window can form accurate and relevant access behavior associations. These associations can accurately describe the possible accesses to the same business or service by multiple locators, thus obtaining more accurate access behavior associations, and therefore, the locator combinations determined in this way are more accurate and reliable.

[0120] Furthermore, as can be seen from the foregoing embodiments, the interaction association relationship includes at least: request redirection association relationship and access behavior association relationship. Therefore, the locator combination can essentially be obtained by analyzing the request detection data corresponding to each marked locator and determining the presence of continuous access behavior within a preset time window, described in the form of triples, such as... Figure 7 As shown, the server first performs request redirection analysis on the request detection log 702 associated with the marked locator 701, and then performs request redirection analysis on the previous and subsequent redirection access relationships 703 associated with the locators in marked locators 701 that have been determined to be of the aggregation interaction type, obtaining the request redirection association triplet 704. The request redirection association triplet 704 is the... Figure 5 The illustrated embodiment shows the locator combination obtained in step 504, which includes interactive information locators, marked locators, and interactive service locators.

[0121] Furthermore, the server performs access behavior detection 705 on the marked locator 701 and obtains multiple locators that have access behavior associations with each marked locator, thereby constructing an access behavior association triplet 706. The access behavior association triplet 706 is the... Figure 6 The illustrated embodiment shows a locator combination obtained in step 602, which includes a marked locator and multiple locators. Based on this, the server constructs locator combination 707 using request jump association triple 704 and access behavior association triple 706. It should be understood that... Figure 7 The examples provided are for illustrative purposes only and are intended to help you understand this solution. Figure 7 The specific processing steps have been described in detail in the foregoing embodiments, and therefore will not be repeated here.

[0122] In one embodiment, such as Figure 8 As shown, each locator in the locator combination has corresponding initial locator element information.

[0123] The initial locator element information refers to the locator element information without data preprocessing; that is, the raw information of each locator in the locator combination obtained through data collection. Therefore, the initial locator element information of each locator in different locator combinations may be inconsistent.

[0124] Based on this, data preprocessing is performed on each locator combination to obtain multiple locator sequences, including:

[0125] Step 802: Perform data preprocessing on the initial locator element information of each locator in each locator combination to obtain multiple locator sequences. The locator element information corresponding to each locator in the locator sequence is: the initial locator element information of the locator after data preprocessing.

[0126] As described in the foregoing embodiments, data preprocessing includes at least: interactive order arrangement processing, length threshold truncation processing, data anonymization processing, and normalization processing, and specifically, data preprocessing involves processing the locator element information of the locators. Therefore, the locator element information corresponding to each locator in the locator sequence is: the initial locator element information of the locator after data preprocessing; that is, the locator element information of each locator in the locator sequence is basically consistent in form and description.

[0127] The following describes various methods for data preprocessing. The interaction order arrangement process specifically involves arranging the interaction order between each locator in each locator combination. In other words, it ensures the accuracy of the request order or access order between the locator element information of each locator in the obtained locator sequence.

[0128] Secondly, the length threshold truncation process involves setting a corresponding length threshold for each locator sequence. The sequence data included in the locator sequence must be less than or equal to the length threshold; that is, the total length of the content composed of the locator element information of each locator in the locator sequence must be less than or equal to the length threshold. For example, if the length threshold is set to 500, then the resulting locator sequence can only contain 500 pieces of content with a total length. Therefore, any locator element information exceeding this length in the locator combination needs to be truncated and discarded.

[0129] The specific data anonymization process is as follows: In practical applications, the locator element information in the locator may contain parameter information, which may include some plaintext privacy information, such as the user's mobile phone number, user's personal identification document (ID), and other user privacy information. Therefore, it is necessary to process this plaintext privacy information.

[0130] Considering the inconsistency in each locator combination, normalization is necessary to ensure the consistency of each locator in the resulting sequence. Specifically, this means ensuring the consistency of the locator element information for each locator. Therefore, normalization may include at least case conversion, standardization of encoding, and port number handling. Data preprocessing also includes handling missing values ​​and outliers; therefore, no specific limitations are imposed on data preprocessing here.

[0131] Specifically, the server preprocesses the initial locator element information for each locator in each locator combination to obtain multiple locator sequences. For ease of understanding, see Table 1:

[0132] Table 1

[0133]

[0134] Table 1 shows the data format of multiple locator sequences. `Request` describes locator sequences that include request redirection relationships, and `Action` describes locator sequences that include access behavior relationships. `1_Request` indicates the first locator sequence in the sequence, specifically a locator sequence that includes request redirection relationships. Similarly, `2_Action` indicates the second locator sequence in the sequence, specifically a locator sequence that includes access behavior relationships. And `3_Request` indicates the third locator sequence in the sequence, specifically a locator sequence that includes request redirection relationships.

[0135] Secondly, the locator element information includes the locator identifier, locator-related information, and locator time information. The locator identifier is 'id1', 'id2', and 'id24', as shown in Table 1. The locator-related information is 'url_info', as shown in Table 1, and the locator time information is 'time_info', as shown in Table 1. Next, the locator element information of the locator sequence is specifically described. The locator sequence indicated by 1_Request includes: the locator uniquely identified by 'id1' and the locator element information of the locator uniquely identified by 'id2'. The locator element information of the locator uniquely identified by 'id1' specifically includes the locator identifier 'id1', the locator-related information {'url_info':{'text':'xxx','pic':'xxx',...}, and the locator time information 'time_info'. Similarly, the locator element information of the locator uniquely identified by 'id1' is described in a similar way, since the locator element information has already undergone data preprocessing. Therefore, the description method is similar and will not be elaborated here.

[0136] In this embodiment, considering that the original data may contain abnormal values ​​and data inconsistencies due to different data sources, and that these are usually due to data problems with the initial locator element information of each locator in the locator combination, the initial locator element information of each locator in the locator combination is preprocessed to ensure the consistency and reliability of the locator element information in each locator sequence after data preprocessing, and also to ensure the efficiency of subsequent data processing, thereby further improving the accuracy and efficiency of the overall aggregated trading platform's evaluation.

[0137] In conjunction with the aforementioned embodiments, and in practical applications, during data preprocessing, data normalization can be performed on each locator combination first. Then, considering the undetermined locators included in the marked locators and the locators with determined interaction types, data analysis and elimination are performed on the normalized locator combinations. Specifically, locator combinations with abnormal data are identified through the locators with determined interaction types, preventing abnormal data from affecting subsequent data processing. Based on this, the specific process for obtaining the locator sequences corresponding to multiple marked locators is as follows: Figure 9 First, the server performs request redirection analysis on the request detection log 902 associated with the marked locator 901, and performs request redirection analysis on the previous and subsequent redirection access relationships 903 associated with the locators in marked locators 901 that have been determined to be of the aggregation interaction type, obtaining request redirection association triples 904. Next, the server performs access behavior detection 905 on the marked locator 901 and obtains multiple locators with access behavior association relationships with each marked locator, thereby constructing access behavior association triples 906. Based on this, the server constructs a locator combination 907 using the request redirection association triples 904 and the access behavior association triples 906, and performs data normalization processing 908 on the locator combination 907. Then, specifically considering the locators in marked locators 901 whose interaction types have been determined, the server performs data analysis and elimination 909 on the locator combination 907 after data normalization 908, and then performs data preprocessing 910 to obtain a locator sequence 911. It should be understood that Figure 9 The examples provided are for illustrative purposes only and are intended to help you understand this solution. Figure 9 The specific processing steps have been described in detail in the foregoing embodiments, and therefore will not be repeated here.

[0138] In one embodiment, such as Figure 10 As shown, the evaluation methods for aggregated trading platforms also include:

[0139] Step 1002: Construct a locator association graph. The nodes of the locator association graph are locators. There are directed edges between two nodes. The directed edges are used to describe the interactive associations between locators. The interactive associations are: request jump associations or access behavior associations.

[0140] In this system, the nodes of the locator association graph are locators, and there are directed edges between two nodes. These directed edges describe the interactive associations between locators, which are either request-to-redirect associations or access behavior associations. The aforementioned request-to-redirect associations or access behavior associations, as well as the request order in the request-to-redirect associations and the access order in the access behavior associations, have been described in the previous embodiments and will not be repeated here.

[0141] Secondly, the locator association graph is constructed based on the locator combinations corresponding to each tagged locator. Since the interaction associations are either request-to-redirect associations or access behavior associations, if a locator combination includes multiple locators with request-to-redirect associations to a tagged locator, the directed edges are specifically used for: the request order of the two locators in the request-to-redirect association relationship. If a locator combination includes multiple locators with access behavior associations to a tagged locator, the directed edges are specifically used for: the access order of the two locators in the access behavior association relationship.

[0142] Specifically, the server constructs a locator association graph, meaning the server builds the locator association graph based on the combinations of locators corresponding to each tagged locator. For ease of understanding, as follows... Figure 11 As shown, for interactive device A, there are consecutive access behaviors to the access addresses indicated by locators 1101, 1102, 1103, and 1104 within a preset time window. For interactive device B, there is a request jump relationship between locators 1103, 1101, and 1105. For interactive device C, there are consecutive access behaviors to the access addresses indicated by locators 1106, 1107, 1101, and 1105 within a preset time window.

[0143] Therefore, we can obtain locator sequences 1109, 1110, and 1111. Locator sequence 1109 specifically includes locators 1101, 1102, 1103, and 1104, and there exists an access order between locators 1101 and 1104. Similarly, locator sequence 1110 specifically includes locators 1103, 1101, and 1105, and there exists a request order between locators 1103 and 1101 and 1105. Similarly, locator sequence 1111 specifically includes locators 1106, 1107, 1101, and 1105, and there exists an access order between locators 1106, 1107, 1101, and 1105.

[0144] Furthermore, based on Figure 11 Examples of methods for constructing locator association graphs include: Figure 12 As shown, through Figure 11 The locator sequences 1109, 1110, and 1111 can be obtained. The order between each locator is recorded in the locator sequences 1109, 1110, and 1111. Therefore, each locator is determined as a node, and the order between each locator is used to construct directed edges between nodes, thus obtaining the locator association graph 1202.

[0145] Based on this, locator features are extracted for each locator sequence to obtain the locator features corresponding to each locator, including:

[0146] Step 1004: Extract locator features based on each locator sequence and locator association graph to obtain the features of each locator. The locator features also include: the inter-sequence association features between the locator and locators with interactive association relationships in the locator association graph.

[0147] Among them, the locator features also include inter-sequence association features, which are used to describe the interaction relationship features between the locator and other locators that have interactive association relationships in the locator association map.

[0148] Specifically, the server extracts locator features based on each locator sequence and the locator association graph, obtaining the features of each locator. That is, the server specifically extracts element features of each locator in the locator sequence using word2vec, and extracts intra-sequence association features between locators in the locator sequence using doc2vec. The embodiments have been described in detail and are not limited here. In this embodiment, the server also considers the graph structure relationships in the locator association graph, specifically extracting interaction relationship features between locators and locators with interactive associations in the locator association graph using the graph embedding method node2vec, to generate graph-level embedding vectors (i.e., inter-sequence association features).

[0149] Furthermore, the server performs embedding vector averaging on the word vectors (i.e., element features) extracted from word2vec and the sentence vectors (i.e., intra-sequence association features) extracted from doc2vec. Then, it concatenates the features obtained from the embedding vector averaging with the inter-sequence association features to obtain the locator features. Specifically, the embedding vector averaging is a weighted averaging process, which involves weighting the element feature weights with the element features themselves, and the intra-sequence association feature weights with the intra-sequence association features themselves. In practice, the element feature weights are set to be greater than the intra-sequence association feature weights.

[0150] For ease of understanding, such as Figure 13 As shown, the server extracts element features 1302 of each locator in the locator sequence 1301 based on word2vec, and extracts intra-sequence association features 1303 between locators in the locator sequence 1301 based on doc2vec. Then, it performs a weighted average processing 1304 on the element features 1302 and the intra-sequence association features 1303. Next, the server constructs a locator association graph 1305 based on the locator sequence 1301, and then extracts inter-sequence association features 1306 from the locator association graph 1305 based on the graph embedding method node2vec. Then, it performs feature concatenation 1307 on the element features 1302, intra-sequence association features 1303, and inter-sequence association features 1306 after weighted average processing 1304, and finally obtains the locator features 1308.

[0151] In this embodiment, based on the element features and intra-sequence association features in the locator sequence, the features of the graph granularity with which each locator in each sequence has an interactive association relationship are also taken into account. That is, the locator can be characterized from multiple feature granularities such as word granularity, sentence granularity and graph granularity, thereby improving the reliability and accuracy of locator features. This allows the subsequent similarity calculation to also consider multiple feature granularities, making the similarity results more accurate and further improving the accuracy of the subsequent evaluation of the aggregated trading platform.

[0152] In one embodiment, such as Figure 14 As shown, the locator element information includes at least: an interactive device identifier, which uniquely identifies an interactive device.

[0153] The locator element information also includes an interaction device identifier that uniquely identifies an interaction device. For example, interaction device identifier 1 uniquely identifies interaction device B1, interaction device identifier 1 uniquely identifies interaction device B2, and interaction device identifier 1 uniquely identifies interaction device B3. Furthermore, locators belonging to the same locator sequence have the same interaction device identifier; that is, one locator sequence can correspond to one interaction device. In practical applications, an interaction device essentially describes the device used by an interactive user.

[0154] Therefore, the evaluation methods for aggregated trading platforms also include:

[0155] Step 1402: Based on the interactive device identifier corresponding to each locator, create a locator co-occurrence graph. The locator co-occurrence graph includes multiple locator co-occurrence pairs, and locators belonging to the same locator co-occurrence pair correspond to the same interactive device identifier.

[0156] The locator co-occurrence map includes multiple locator co-occurrence pairs. Locators belonging to the same locator co-occurrence pair correspond to the same interactive device identifier. Therefore, it can be determined that there is an interactive device co-occurrence relationship between locators belonging to the same locator co-occurrence pair. Thus, a locator co-occurrence pair can correspond to multiple interactive device identifiers, meaning the access address indicated by one locator can be accessed by multiple interactive devices. For example, locator A1 corresponds to interactive device identifier 1 and interactive device identifier 2, locator A2 corresponds to interactive device identifier 2 and interactive device identifier 3, locator A3 corresponds to interactive device identifier 1 and interactive device identifier 2, and locator A4 corresponds to interactive device identifier 2 and interactive device identifier 3.

[0157] Based on this, the server can determine that locator A1 and locator A3 belong to the same locator co-occurrence pair C1, and that locator co-occurrence pair C1 corresponds to interactive device identifier 1 and interactive device identifier 2. In other words, the access address indicated by the locator belonging to locator co-occurrence pair C1 can be accessed by interactive devices B1 and B2. Similarly, the server can determine that locator A2 and locator A4 belong to the same locator co-occurrence pair C2, and that locator co-occurrence pair C2 corresponds to interactive device identifier 2 and interactive device identifier 3. In other words, the access address indicated by the locator belonging to locator co-occurrence pair C2 can be accessed by interactive devices B2 and B3.

[0158] Specifically, the server creates a locator co-occurrence graph based on the interaction device identifier corresponding to each locator. To facilitate understanding of the locator co-occurrence graph, the details are as follows: Figure 15 As shown, this includes the locators associated with interactive devices from interactive user A to interactive user G, that is, the access addresses indicated by the locators accessed by the interactive devices. Specifically, interactive user A is associated with locator 1501, interactive user B is associated with locator 1506, interactive user C is associated with locators 1501, 1502, and 1506, interactive user D is associated with locators 1502 and 1504, interactive user E is associated with locators 1502 and 1504, interactive user F is associated with locators 1503, 1504, and 1505, and interactive user G is associated with locator 1503.

[0159] Based on this, a locator co-occurrence map 1507 can be obtained. The locator co-occurrence map 1507 includes multiple locator co-occurrence pairs. Through the multiple locator co-occurrence pairs, it can be seen that the access addresses indicated by locator 1501, locator 1502, and locator 1506 have been accessed by the same interactive device, the access addresses indicated by locator 1502 and locator 1504 have been accessed by the same interactive device, and the access addresses indicated by locator 1503, locator 1504, and locator 1505 have been accessed by the same interactive device.

[0160] Based on this, locator features are extracted for each locator sequence to obtain the locator features corresponding to each locator, including:

[0161] Step 1404: Extract locator features based on each locator sequence and the locator co-occurrence map to obtain the features of each locator. The locator features also include the co-occurrence features between the locator and locators belonging to the same locator co-occurrence pair in the locator co-occurrence map.

[0162] The locator features also include: the co-occurrence features between a locator and locators belonging to the same locator co-occurrence pair in the locator co-occurrence map. In other words, the co-occurrence features are used to describe the characteristics of access addresses indicated by multiple locators being accessed by the same interactive device. Specifically, the co-occurrence features are used to describe the interactive device co-occurrence relationship of interactive devices.

[0163] Specifically, the server extracts locator features based on each locator sequence and the locator co-occurrence map, obtaining the features of each locator. That is, the server can determine the co-occurrence pair of each locator in each locator sequence within the locator co-occurrence map, and determine the co-occurrence features through the co-occurrence relationships between the locators included in the co-occurrence pair. It is understood that the server can also consider the locator association map; that is, the server can also extract locator features based on each locator sequence, the locator association map, and the locator co-occurrence map. In this case, the locator features can collectively include co-occurrence features and inter-sequence association features. The specific processing steps are similar to those in the aforementioned embodiments and are not limited here.

[0164] In this embodiment, based on the element features and intra-sequence association features in the locator sequence, the co-occurrence features of the interaction devices corresponding to each locator are also taken into account. That is, the locators can be characterized from multiple feature granularities such as word granularity, sentence granularity and device granularity, thereby improving the reliability and accuracy of locator features. This allows the subsequent similarity calculation to also consider multiple feature granularities, making the similarity results more accurate and further improving the accuracy of the subsequent evaluation of the aggregated trading platform.

[0165] In one embodiment, such as Figure 16 As shown, similarity processing is performed on each locator feature, including:

[0166] Step 1602: Using the nearest neighbor search algorithm, candidate locator features that match each locator feature are selected.

[0167] Considering the massive amount of locator data in practical applications, calculating the similarity of each locator's features would be computationally complex and inefficient. Therefore, the server uses a nearest neighbor search algorithm to filter candidate locator features that match each locator's features. In other words, the server uses the locator features for which similarity association calculations are performed as target features, and then calculates the nearest neighbor locator features for each target feature, thus obtaining candidate locator features that are approximately associated with the target (i.e., the locator feature).

[0168] The aforementioned nearest neighbor search algorithm can be understood as follows: for a given locator feature, the server identifies that locator feature as the target feature, then iterates through the locator features and calculates the distance between the locator feature and the target feature, while simultaneously recording the locator feature that is closest to the target feature. The nearest neighbor search algorithm will not be elaborated upon here.

[0169] Step 1604: Perform similarity processing on each locator feature and the candidate locator features that match the locator features.

[0170] Specifically, the server further performs similarity processing on each locator feature and the candidate locator features that match the locator feature. That is, the server specifically calculates the similarity between each locator feature and the candidate locator features that match the locator feature.

[0171] In this embodiment, the nearest neighbor search algorithm is used to select the candidate locator features that are closest to each locator feature. This avoids the problem of large computational load that may occur when the amount of data is large, thereby reducing the computational load of subsequent similarity calculations and improving the computational efficiency of similarity calculations, which in turn improves the evaluation efficiency of the aggregated trading platform.

[0172] The following section details how to calculate similarity after filtering candidate locator features that match each locator feature using the nearest neighbor search algorithm. It is understood that in practical applications, similarity can be calculated using a similar method without performing the nearest neighbor search algorithm, and will not be elaborated upon here.

[0173] In one embodiment, such as Figure 17 As shown, similarity processing is performed on each locator feature and the candidate locator features that match the locator features, including:

[0174] Step 1702: Perform feature similarity processing on each locator feature and the candidate locator features that match the locator features.

[0175] Feature similarity is used to describe the similarity between locator features and candidate locator features. Since locator features include at least element features, intra-sequence association features, and inter-sequence association features, feature similarity is used to describe at least: the element feature similarity between the element features of a locator feature and the element features of a candidate locator feature; the intra-sequence association feature similarity between the intra-sequence association features of a locator feature and the intra-sequence association features of a candidate locator feature; and the inter-sequence association feature similarity between the inter-sequence association features of a locator feature and the inter-sequence association features of a candidate locator feature.

[0176] Specifically, the server calculates the similarity of each locator feature and the candidate locator features that match the locator features to obtain the feature similarity in the similarity results.

[0177] Step 1704: Perform element information similarity analysis on the locator element information corresponding to each locator feature and the locator element information corresponding to the candidate locator features that match the locator features.

[0178] The similarity results include at least two categories: feature similarity and element information similarity. The element information similarity describes the similarity between the locator element information matched by the locator feature. Therefore, since locator element information includes at least the URL's text information, image information, structural information, and other relevant information embedded in the URL, element information similarity includes at least the similarity between the text information of the locator matched by the locator feature and the text information of the locator matched by the candidate locator feature; the similarity between the image information of the locator matched by the locator feature and the image information of the locator matched by the candidate locator feature; and the similarity between the structural information of the locator matched by the locator feature and the structural information of the locator matched by the candidate locator feature.

[0179] Specifically, the server calculates the similarity between the locator element information corresponding to each locator feature and the locator element information corresponding to candidate locator features that match the locator feature, to obtain the element information similarity in the similarity result. Therefore, the similarity result in this embodiment includes at least: feature similarity and element information similarity, specifically as follows: Figure 18 As shown, firstly, using the method described in the aforementioned embodiment, the nearest neighbor search algorithm is used to filter out candidate locator features 1804 that match locator feature 1802. Then, the feature similarity 1806 between locator feature 1802 and candidate locator feature 1804, and the element information similarity 1808 between the locator element information of the locator matched by locator feature 1802 and the locator element information of the locator matched by candidate locator feature 1804 are calculated. Thus, a similarity result 1810 including feature similarity 1806 and element information similarity 1808 is constructed. And the similarity set 1812 of the locator matched by locator feature 1802 is determined by the similarity result 1810.

[0180] In this embodiment, feature similarity is calculated between locator features, that is, the similarity between two locators is calculated from the feature vector dimension. Furthermore, the similarity between locator element information of each locator is taken into account, that is, the similarity between two locators is further considered from the locator element information similarity. Therefore, the obtained similarity result includes at least feature similarity and locator element information similarity. Performing similarity calculation and result description from multiple similarity calculation granularities can make the similarity result more reliable and accurate, and the similar locator set determined thereby can better reflect the real situation.

[0181] In one embodiment, such as Figure 19 As shown, the locator element information includes at least: an interactive device identifier, which uniquely identifies an interactive device. The specific details are similar to the aforementioned embodiments and will not be repeated here.

[0182] Based on this, similarity processing is performed on each locator feature and the candidate locator features that match the locator features, including:

[0183] Step 1902: Perform feature similarity processing on each locator feature and the candidate locator features that match the locator features.

[0184] Feature similarity is used to describe the similarity between locator features and candidate locator features. Specifically, the server calculates the similarity for each locator feature and the candidate locator features that match it, to obtain the feature similarity in the similarity result. The feature similarity and calculation method are similar to those in the previous embodiments, and will not be repeated here.

[0185] Step 1904: Determine the set of interactive devices corresponding to each locator feature by using the interactive device identifier corresponding to each locator feature, and calculate the difference and intersection of interactive devices among the sets of interactive devices corresponding to each locator feature.

[0186] The interaction device identifier is used to uniquely identify the interaction device. The specific implementation is similar to the previous embodiments and will not be repeated here. The interaction device difference set describes the distinct interaction devices in the sets of interaction devices corresponding to the two locator features, while the interaction device intersection set describes the common interaction devices in the sets of interaction devices corresponding to the two locator features. It is understood that the interaction device difference set and the interaction device intersection set can constitute the sum of the sets of interaction devices corresponding to the two locator features, and both the interaction device difference set and the interaction device intersection set can be empty sets.

[0187] Specifically, the server determines the set of interactive devices corresponding to each locator feature by using the interactive device identifier corresponding to each locator feature. That is, it determines the specific interactive device identifier within the locator element information of the locator matched by the locator feature, and thus determines the set of interactive devices corresponding to the locator feature. See further details. Figure 15 The set of interactive devices corresponding to locator 1501 includes at least: interactive user A and interactive user C; the set of interactive devices corresponding to locator 1502 includes at least: interactive user C, interactive user D, and interactive user E; the set of interactive devices corresponding to locator 1503 includes at least: interactive user F and interactive user G; the set of interactive devices corresponding to locator 1504 includes at least: interactive user D, interactive user E, and interactive user F; the set of interactive devices corresponding to locator 1505 includes at least: interactive user F; and the set of interactive devices corresponding to locator 1506 includes at least: interactive user B and interactive user C. Since locators 1501 to 1506 have corresponding locator features, the set of interactive devices corresponding to the locator feature of locator 1501 includes at least: interactive user A and interactive user C. Similarly, the set of interactive devices corresponding to the locator features of other locators can be determined, which will not be elaborated here.

[0188] Furthermore, the server calculates the difference and intersection of interactive devices between two sets of interactive devices corresponding to two locator features, based on the set of interactive devices corresponding to each locator feature. Again, based on... Figure 15 As seen in the examples above, the difference set of interactive devices between locator 1501 and locator 1502 is interactive user A, interactive user D, and interactive user E, and the intersection set of interactive devices between locator 1501 and locator 1502 is interactive user C. Similarly, the difference set of interactive devices between locator 1501 and locator 1503 is interactive user A, interactive user C, interactive user F, and interactive user G, while the intersection set of interactive devices between locator 1501 and locator 1503 is empty, meaning there are no identical interactive devices.

[0189] Step 1906: The interaction device correlation between each locator feature is obtained by processing the difference and intersection of the interaction devices between each locator feature. The interaction device correlation can be either positive or negative.

[0190] The similarity results include at least: feature similarity and interaction device relevance. The interaction device relevance can be either positive or negative, and it describes the degree of correlation between the sets of interaction devices corresponding to the locator features.

[0191] Specifically, the server processes the difference and intersection of the interaction devices between each locator feature to obtain the correlation between the interaction devices of each locator feature, i.e., it calculates the correlation between the interaction devices of each locator feature. Therefore, when the intersection of the interaction devices between locator features is empty, the correlation between the interaction devices of the two locator features can be determined to be negative. Conversely, when the number of interaction devices in the intersection of the interaction devices exceeds a certain threshold, or when the ratio of the number of interaction devices in the intersection to the number of interaction devices in the difference set of the interaction devices reaches a certain threshold, the correlation between the interaction devices of the two locator features can be determined to be positive.

[0192] Therefore, the similarity results in this embodiment include at least: feature similarity and interaction device relevance, specifically as follows: Figure 20 As shown, firstly, using the method described in the aforementioned embodiment, the nearest neighbor search algorithm is used to filter out candidate locator features 2004 that match locator feature 2002. Then, the feature similarity 2006 between locator feature 2002 and candidate locator feature 2004 is calculated. And the interaction device relevance 2008 between locator feature 2002 and candidate locator feature 2004 is calculated by using the interaction device difference and interaction device intersection between locator feature 2002 and candidate locator feature 2004. Thus, a similarity result 2010 including feature similarity 2006 and interaction device relevance 2008 is constructed. And the similarity set 2012 of the locator matched by locator feature 2002 is determined by the similarity result 2010.

[0193] Understandably, in practical applications, similarity results should include at least: feature similarity, element information similarity, and relevance of interactive devices. Specifically, for example... Figure 21 As shown, firstly, using the method described in the aforementioned embodiment, the nearest neighbor search algorithm is used to filter out candidate locator features 2104 that match locator feature 2102. Then, the feature similarity 2106 between locator feature 2102 and candidate locator feature 2104, and the element information similarity 2108 between the locator element information of the locator matched by locator feature 2102 and the locator element information of the locator matched by candidate locator feature 2104 are calculated. Then, the interaction device relevance 2110 between locator feature 2102 and candidate locator feature 2104 is calculated by using the interaction device difference and interaction device intersection between locator feature 2102 and candidate locator feature 2104. Thus, a similarity result 2112 is constructed, including feature similarity 2106, element information similarity 2108, and interaction device relevance 2110. Finally, the similarity set 2114 of the locator matched by locator feature 2102 is determined by the similarity result 2112.

[0194] In this embodiment, feature similarity is calculated between the features of the locators, that is, the similarity between two locators is calculated from the feature vector dimension. Furthermore, the device relevance between the interaction devices of each locator is taken into account, that is, the similarity of user interaction in actual application is considered from the perspective of the interacting user. Therefore, the obtained similarity result includes at least feature similarity and device relevance. Performing similarity calculation and result description at multiple similarity calculation granularities can make the similarity result more reliable and accurate, and the set of similar locators determined in this way can better reflect the real situation.

[0195] In one embodiment, such as Figure 22 As shown, the method for determining marked locators includes:

[0196] Step 2202: Determine the aggregation interaction judgment conditions through the aggregation interaction data included in the aggregation interaction database, and perform aggregation interaction judgment on multiple locators based on the aggregation interaction judgment conditions to determine the locator of the aggregation interaction type.

[0197] Among them, the aggregation interaction judgment condition is used to determine whether the locator's interaction type is an aggregation interaction type. Based on the aggregation interaction judgment condition, a locator content recognition model can be constructed to judge the locator element information of the locator. Secondly, the aggregation interaction database is an existing aggregation interaction seed library, which is composed of locators with already determined aggregation interaction types.

[0198] Specifically, the server determines the aggregation interaction judgment conditions by using the aggregation interaction data included in the aggregation interaction database. That is, the server specifically determines the locator element information of the locators belonging to the aggregation interaction type from the existing aggregation interaction seed library (i.e., the aggregation interaction database). This allows it to determine the text information, image information, and structural information of the locators belonging to the aggregation interaction type. Then, using the known text information, image information, and structural information of the locators of the known aggregation interaction type, the server determines the aggregation interaction judgment conditions and constructs a locator content recognition model based on these conditions. Based on this, the server performs aggregation interaction judgment on multiple locators according to the aggregation interaction judgment conditions to determine the locators of the aggregation interaction type. In other words, the server uses the locator content recognition model to identify and judge the locator element information of each locator whose type has not yet been determined, thereby identifying it as a locator of the aggregation interaction type.

[0199] Secondly, in practical applications, accounts belonging to sensitive industries or development accounts providing interactive services to sensitive industries typically propagate aggregated payment type locators, or access addresses indicated by these locators. In this case, the server can determine the aggregated interaction judgment conditions and construct a locator content recognition model based on this, thereby capturing and identifying aggregated payment type locators. Alternatively, web pages and applications involving sensitive industries, such as sensitive web pages and applications, may embed aggregated interaction functions. Therefore, the server can also capture and identify aggregated payment type locators by monitoring the Application Programming Interface (API) of sensitive web pages and applications. Based on this, the specific method for identifying aggregated payment type locators in practical applications is not limited here.

[0200] Furthermore, the server identifies locators using a locator content recognition model and authenticates locators in each interaction request. It then obtains locator element information for the detected aggregated payment type locators. At this point, the locator element information can include at least: site domain name, filing information, and Internet Protocol (IP) mounting. The server also normalizes the locator element information of each locator to ensure data consistency in subsequent processing steps.

[0201] Step 2204: Identify the locator associated with the sensitive information as a locator of the sensitive information type. The sensitive information includes at least: sensitive accounts, sensitive web pages, and sensitive applications.

[0202] Sensitive information includes at least: sensitive accounts, sensitive web pages, and sensitive applications. Specifically, sensitive information is information related to sensitive industries, such as accounts related to sensitive industries, interactive accounts related to sensitive industries, web pages displaying sensitive industries, applications displaying sensitive industries, or interactive web pages related to sensitive web pages and applications.

[0203] Specifically, as illustrated by the foregoing embodiments, in practical applications, accounts belonging to sensitive industries or development accounts providing interactive services to sensitive industries typically propagate aggregated payment type locators, or access addresses indicated by these locators. In this case, the server can also capture the aggregated payment type locator. When determining the aggregated payment type locator, the server can further determine the locator associated with the sensitive account, i.e., determine the locator for the sensitive information type. Similarly, when the server monitors the APIs of sensitive web pages and sensitive applications and captures aggregated payment type locators, it can also further determine the locators associated with the sensitive web pages and sensitive applications, i.e., determine the locator for the sensitive information type.

[0204] For ease of understanding, such as Figure 23 As shown, the server specifically determines the locator element information of the locator of the aggregation interaction type from the aggregation interaction database 2301. Then, it determines the aggregation interaction judgment condition 2302 through the known text information, image information, and structural information of the locator of the aggregation interaction type, and constructs the locator content recognition model 2303 based on the aggregation interaction judgment condition 2302. Secondly, since accounts of sensitive industries or development accounts that provide interaction services to sensitive industries usually spread aggregation payment type locators, the server can also determine the aggregation interaction judgment condition 2302 through the locator 2304 associated with sensitive accounts, and construct the locator content recognition model 2303 based on the aggregation interaction judgment condition 2302.

[0205] Furthermore, since web pages and applications involving sensitive industries may embed aggregated interaction functions, the server performs application interface monitoring (API) 2306 on sensitive web pages and applications 2305, thereby recording locators 2307 related to the sensitive web pages and applications. Thus, the server can determine the type of multiple undetermined locators 2308, and normalize the locator element information of locators with determined interaction types 2309, thereby completing the determination and processing of locators with determined interaction types.

[0206] Step 2206: Locators that are not determined to be of the aggregation interaction type among multiple locators are identified as locators to be determined.

[0207] The locators whose interaction types have been determined include locators for aggregated interaction types and locators for sensitive interaction types. Specifically, through the aforementioned steps, the server can determine the locators whose interaction types have been determined. At this point, locators that belong to the interaction service type but have not been determined to be aggregated interaction types will be identified as locators to be determined.

[0208] Understandably, in practical applications, when it's necessary to determine whether a locator of an aggregated interaction type is associated with sensitive information, the server can further perform whitelist filtering on the locators of the aggregated interaction type among the locators already identified as having an interaction type. This prevents misjudgment of locators of the legitimate aggregated interaction types specified by the business logic. Then, locators that do not belong to the legitimate aggregated interaction types specified by the business logic are identified as locators to be determined regarding their association with sensitive information; that is, they can also be identified as locators to be determined. Alternatively, the server can further mark the locators of the aggregated interaction type identified by locators associated with sensitive information so that subsequent determinations can confirm whether the locator of that aggregated interaction type is indeed associated with sensitive information; that is, they can also be identified as locators to be determined.

[0209] In this embodiment, by using multiple locator acquisition and determination methods, it is possible to ensure a more comprehensive and accurate collection of locators for aggregated interaction types, and to provide a reliable data foundation for subsequent locator determination, thereby further improving the reliability and accuracy of the evaluation of the aggregated trading platform.

[0210] In one embodiment, such as Figure 24 As shown, by using the locators whose interaction types have been determined in each set of similar locators, the target interaction type of each locator to be determined is determined, including:

[0211] Step 2402: If the set of similar locators with determined interaction types only includes locators with aggregate interaction types, then the locator to be determined is determined to be of aggregate interaction type.

[0212] Specifically, when the set of similar locators in the locator to be determined includes only locators with aggregated interaction types, it means that all locators similar to the locator to be determined are of aggregated interaction type. In this case, the locator to be determined can be directly determined to be of aggregated interaction type. For example, if the set of similar locators in the locator to be determined D1 includes locators A1, A2, and A3, all of which are of aggregated interaction type, the server can determine that the locator to be determined D1 is of aggregated interaction type.

[0213] Optionally, in step 2404, if the set of similar locators with determined interaction types includes more than a preset ratio threshold or a preset number of locators with aggregated interaction types, the locator to be determined is identified as an aggregated interaction type.

[0214] The preset percentage threshold can be 60%, 70%, or 80%, and the preset quantity can be 3, 4, or 5. The preset quantity is usually determined based on the total number of locators in the similar locator set, and is not limited here.

[0215] Specifically, when the set of similar locators in the locator to be determined includes more than a preset proportion threshold or a preset number of locators of aggregated interaction type, the locator to be determined is identified as an aggregated interaction type. For example, taking a preset proportion threshold of 70% as an example, the set of similar locators in the locator to be determined D1 includes locators A1 to A5, and locators A1 to A4 are all aggregated interaction types, while locator A5 is an interaction service type. In this case, the locator to be determined D1 can also be identified as an aggregated interaction type. It is understood that the examples in the foregoing embodiments are for understanding this solution and do not constitute a limitation on this solution.

[0216] In this embodiment, since the interaction types of the locators in the similar locator set that have been determined to have a high degree of similarity with the interaction types of the locator to be determined, when the proportion of locators with aggregated interaction types included in the similar locator set is high or the number is large, it can be determined that the target interaction type of the locator to be determined is the aggregated interaction type. At this time, the discovery and determination of the locators with aggregated interaction types can be more in line with the actual situation, that is, further improve the accuracy of the evaluation of the aggregated trading platform.

[0217] In one embodiment, such as Figure 25 As shown, the target interaction type of the locator to be determined is the aggregate interaction type.

[0218] Based on this, after determining the target interaction type for each locator to be determined, the method further includes:

[0219] Step 2502: If the locator sequence corresponding to the locator to be determined includes a locator of a sensitive interaction type, determine that the locator to be determined is associated with sensitive information so as to issue an interaction security notification.

[0220] Specifically, the server determines, through the aforementioned embodiments, that the target interaction type of the locator to be determined is an aggregated interaction type. It can further determine whether the locator sequence corresponding to the locator to be determined includes locators of sensitive interaction types. If so, it can determine that the locator to be determined is associated with sensitive information and issue an interaction security notification. The interaction security notification can be issued when the interactive device accesses the access address indicated by the locator to be determined, or before redirection to the access address indicated by the locator to be determined. The interaction security notification can be displayed on the interactive device's interface or via voice notification; no limitation is made here.

[0221] Taking the scenario of security identification of aggregated payment as an example, the evaluation method of the aggregated transaction platform provided in this application embodiment determines that the interaction type of the locator to be judged is aggregated payment type, and the locator sequence corresponding to the locator to be judged includes locators of sensitive interaction types. At this time, the server determines that the locator to be judged is associated with sensitive information, that is, it determines that the locator to be judged may be used by sensitive industries, or that the third-party payment platform associated with the locator to be judged is not a legitimate payment platform. Therefore, it is determined that the locator to be judged has payment security risks, and thus it is necessary to issue interaction security notifications and other reminders for aggregated payment security.

[0222] In this embodiment, interactive security notifications can prevent locators of aggregated interactive types from being exploited by sensitive industries, thereby improving the security of aggregated interactive services in practical applications.

[0223] Based on the foregoing embodiments, the complete implementation process of evaluating the aggregated trading platform will be detailed below, as follows: Figure 26 As shown, an evaluation method for aggregated trading platforms is provided, which can be applied to... Figure 1 Using a server as an example, it can be understood that this method can also be applied to systems including terminals and servers, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0224] Step 2601: Obtain the request detection data corresponding to each marked locator.

[0225] The request detection data includes at least: request detection logs and request redirection access data. Specifically, the server obtains the request detection logs associated with the marked locators, as well as the previous and subsequent redirection access relationships associated with locators determined to be of the aggregation interaction type, to constitute the request detection data.

[0226] Step 2602: Perform request redirection analysis on each request detection data, determine the interactive information locators and interactive service locators that have request redirection association with the marked locators, and construct locator combinations.

[0227] The interaction relationships include at least request redirection relationships. Specifically, the server performs request redirection analysis on each request detection data to determine the interaction information locators and interaction service locators that have request redirection relationships with the marked locators. That is, the server specifically performs request redirection analysis on the request detection logs associated with the marked locators, identifying the interaction information locators and interaction service locators with request redirection relationships in the request detection logs. Furthermore, the server also needs to perform request redirection analysis on the preceding and following redirection access relationships associated with locators determined to be of the aggregated interaction type, identifying the interaction information locators and interaction service locators with request redirection relationships with the marked locators within the preceding and following redirection access relationships.

[0228] Step 2603: Obtain multiple locators that have access behavior associations with each marked locator, and construct a locator combination.

[0229] The interaction association includes at least the access behavior association. Specifically, the server detects access behavior for each interactive device (i.e., terminal), and detects that there is continuous access behavior to the marked locator and multiple other locators within a preset time window. This allows the server to construct marked locators with access behavior associations and combinations of multiple locators.

[0230] Step 2604: Perform data preprocessing on each locator combination to obtain multiple locator sequences.

[0231] It is understandable that each locator in a locator combination has corresponding initial locator element information. This initial locator element information is the locator element information before data preprocessing; that is, it is the raw information of each locator in the locator combination obtained through data collection. Therefore, the initial locator element information of each locator in different locator combinations may be inconsistent.

[0232] The data preprocessing includes at least the following: interaction order arrangement processing, length threshold truncation processing, data anonymization processing, and normalization processing. Specifically, data preprocessing involves processing the locator element information of each locator in each locator combination. Specifically, the server performs data preprocessing on the initial locator element information of each locator in each locator combination to obtain multiple locator sequences.

[0233] Step 2605: Construct a locator association graph.

[0234] In this system, the nodes of the locator association graph are locators, and there are directed edges between two nodes. These directed edges describe the interactive associations between locators, which are either request-to-redirect associations or access behavior associations. The aforementioned request-to-redirect associations or access behavior associations, as well as the request order in the request-to-redirect associations and the access order in the access behavior associations, have been described in the previous embodiments and will not be repeated here.

[0235] Secondly, the locator association graph is constructed based on the locator combinations corresponding to each marked locator. Since the interaction associations are either request-to-redirect associations or access-behavior associations, if a locator combination includes multiple locators with request-to-redirect associations to a marked locator, the directed edges are specifically used to determine the request order of the two locators in the request-to-redirect association. If a locator combination includes multiple locators with access-behavior associations to a marked locator, the directed edges are specifically used to determine the access order of the two locators in the access-behavior association. Specifically, the server constructs the locator association graph by constructing it based on the locator combinations corresponding to each marked locator.

[0236] Step 2606: Create a locator co-occurrence map based on the interactive device identifier corresponding to each locator.

[0237] The aforementioned locator element information includes at least one interactive device identifier, which uniquely identifies an interactive device. The locator co-occurrence graph comprises multiple locator co-occurrence pairs, and locators belonging to the same co-occurrence pair correspond to the same interactive device identifier. Therefore, it can be determined that there is an interactive device co-occurrence relationship between locators belonging to the same co-occurrence pair. Thus, a locator co-occurrence pair can have multiple interactive device identifiers corresponding to one locator, meaning the access address indicated by one locator can be accessed by multiple interactive devices. Specifically, the server creates a locator co-occurrence graph based on the interactive device identifier corresponding to each locator.

[0238] Step 2607: Extract locator features based on each locator sequence, locator association graph, and locator co-occurrence graph to obtain the locator features corresponding to each locator.

[0239] The locator features include at least: element features corresponding to the locator element information, intra-sequence association features between the locator and locators belonging to the same locator sequence, inter-sequence association features between the locator and locators with interactive association relationships in the locator association graph, and co-occurrence features between the locator and locators belonging to the same locator co-occurrence pair in the locator co-occurrence graph.

[0240] Specifically, locator features are extracted based on each locator sequence, locator association graph, and locator co-occurrence graph to obtain the locator features corresponding to each locator. Specifically, the server extracts element features of each locator in the locator sequence using word2vec, extracts intra-sequence association features between locators in the locator sequence using doc2vec, and extracts interaction relationship features between locators and locators with interactive associations in the locator association graph using the graph embedding method node2vec. This generates graph-level embedding vectors (i.e., inter-sequence association features). Furthermore, the co-occurrence pairs of each locator in each locator sequence in the locator co-occurrence graph are determined, and co-occurrence features are determined through the co-occurrence relationships between the locators included in the co-occurrence pairs.

[0241] Step 2608: Using the nearest neighbor search algorithm, candidate locator features that match each locator feature are selected.

[0242] Considering the massive amount of locator data in practical applications, calculating the similarity of each locator's features would be computationally complex and inefficient. Therefore, the server uses a nearest neighbor search algorithm to filter candidate locator features that match each locator's features. In other words, the server uses the locator features for which similarity association calculations are performed as target features, and then calculates the nearest neighbor locator features for each target feature, thus obtaining candidate locator features that are approximately associated with the target (i.e., the locator feature).

[0243] Step 2609: Perform feature similarity processing on each locator feature and the candidate locator features that match the locator features.

[0244] Feature similarity is used to describe the similarity between locator features and candidate locator features. Specifically, the server calculates the similarity for each locator feature and the candidate locator features that match the locator features to obtain the feature similarity in the similarity results.

[0245] Step 2610: Perform element information similarity analysis on the locator element information corresponding to each locator feature and the locator element information corresponding to the candidate locator features that match the locator features.

[0246] Element information similarity describes the similarity between the locator element information of the locators matched by the locator feature. Specifically, the server calculates the similarity between the locator element information corresponding to each locator feature and the locator element information corresponding to the candidate locator features that match the locator feature, to obtain the element information similarity in the similarity result.

[0247] Step 2611: Determine the set of interactive devices corresponding to each locator feature by using the interactive device identifier corresponding to each locator feature, and calculate the difference and intersection of interactive devices among the sets of interactive devices corresponding to each locator feature.

[0248] The interaction device identifier is used to uniquely identify the interaction device. The specific details are similar to the previous embodiments and will not be repeated here. The interaction device difference set describes the different interaction devices in the sets of interaction devices corresponding to two locator features, while the interaction device intersection set describes the same interaction devices in the sets of interaction devices corresponding to two locator features.

[0249] Specifically, the server determines the set of interactive devices corresponding to each locator feature by using the interactive device identifier corresponding to each locator feature. That is, it determines the specific interactive device identifier in the locator element information of the locator matched by the locator feature, and thus determines the set of interactive devices corresponding to the locator feature. Further, based on the set of interactive devices corresponding to each locator feature, the server calculates the difference between the interactive devices of two sets of interactive devices corresponding to two locator features, and the intersection between the interactive devices of two sets of interactive devices corresponding to two locator features.

[0250] Step 2612: The interaction device correlation between each locator feature is obtained by processing the difference and intersection of the interaction devices between each locator feature.

[0251] In this embodiment, the interaction device relevance can be either positive or negative, and it describes the degree of correlation between sets of interaction devices corresponding to locator features. Therefore, in this embodiment, the similarity results include at least: feature similarity, element information similarity, and interaction device relevance.

[0252] Specifically, the server processes the difference and intersection of the interaction devices between each locator feature to obtain the correlation between the interaction devices of each locator feature, i.e., it calculates the correlation between the interaction devices of each locator feature. Therefore, when the intersection of the interaction devices between locator features is empty, the correlation between the interaction devices of the two locator features can be determined to be negative. Conversely, when the number of interaction devices in the intersection of the interaction devices exceeds a certain threshold, or when the ratio of the number of interaction devices in the intersection to the number of interaction devices in the difference set of the interaction devices reaches a certain threshold, the correlation between the interaction devices of the two locator features can be determined to be positive.

[0253] Step 2613: Determine the set of similar locators that are similar to each locator to be determined based on the obtained similarity results.

[0254] Specifically, the server calculates the similarity of each locator feature to obtain a similarity result, which includes the feature similarity between each locator feature. Since the server can obtain the feature similarity between the locator features of each labeled locator, and since multiple labeled locators also include multiple locators to be determined, the server can also obtain the feature similarity between the locator features of each locator to be determined and other locator features. Based on this, the server determines the locator features with high feature similarity to the locator features of each locator to be determined by using the feature similarity between the locator features of each locator to be determined and other locator features. Then, using the locators corresponding to the locator features with high feature similarity, a set of similar locators similar to the locator to be determined is constructed.

[0255] Step 2614: Determine the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators.

[0256] Specifically, the server determines the target interaction type for each locator to be determined by using the locators whose interaction types have already been determined in each set of similar locators. That is, the server can determine the interaction type of the locator to be determined as the target interaction type of the locator that pre-determines the majority of locators in the set of similar locators. Alternatively, it can determine the target interaction type of the locator to be determined as the only interaction type included in the set of similar locators.

[0257] It should be understood that the specific implementation methods of steps 2601 to 2614 are similar to those of the aforementioned embodiments, and will not be repeated here.

[0258] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0259] Based on the same inventive concept, this application also provides an evaluation apparatus for an aggregated trading platform to implement the evaluation method for the aggregated trading platform described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations of one or more embodiments of the evaluation apparatus for aggregated trading platforms provided below can be found in the limitations of the evaluation method for aggregated trading platforms described above, and will not be repeated here.

[0260] In one embodiment, such as Figure 27 As shown, an evaluation device for an aggregated trading platform is provided, comprising: a sequence acquisition module 2702, a feature extraction module 2704, a similarity calculation module 2706, and an interaction type determination module 2708, wherein:

[0261] The sequence acquisition module 2702 is used to acquire the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information.

[0262] The feature extraction module 2704 is used to extract locator features based on each locator sequence, and obtain the locator features corresponding to each locator. The locator features include at least: the element features corresponding to the locator element information of the locator, and the intra-sequence association features between the locator and the locators belonging to the same locator sequence.

[0263] The similarity calculation module 2706 is used to perform similarity processing on each locator feature and determine the set of similar locators similar to each locator to be judged based on the obtained similarity results.

[0264] The interaction type determination module 2708 is used to determine the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators.

[0265] In one embodiment, the sequence acquisition module 2702 is further configured to acquire a locator combination corresponding to each marked locator, the locator combination including multiple locators with interactive association with the marked locators; and to perform data preprocessing on each locator combination to obtain multiple locator sequences.

[0266] In one embodiment, the sequence acquisition module 2702 is further configured to acquire request detection data corresponding to each marked locator, the request detection data including at least: request detection logs and request jump access data; and perform request jump analysis on each request detection data to determine the interaction information locator and interaction service locator that have a request jump association relationship with the marked locator, and construct a locator combination, the locator combination including interaction information locator, marked locator, and interaction service locator; wherein, the interaction association relationship includes at least the request jump association relationship.

[0267] In one embodiment, the sequence acquisition module 2702 is further configured to acquire multiple locators that have access behavior associations with each marked locator, and construct a locator combination. The locator combination includes the marked locator and multiple locators. The access behavior association is used to describe the existence of continuous access behavior within a preset time window. The interaction association includes at least the access behavior association.

[0268] In one embodiment, each locator in the locator combination has corresponding initial locator element information;

[0269] The sequence acquisition module 2702 is also used to perform data preprocessing on the initial locator element information of each locator in each locator combination to obtain multiple locator sequences. The locator element information corresponding to each locator in the locator sequence is: the initial locator element information of the locator after data preprocessing.

[0270] In one embodiment, such as Figure 28 As shown, the evaluation device for the aggregated trading platform also includes a correlation graph construction module 2802;

[0271] The association graph construction module 2802 is used to construct the locator association graph. The nodes of the locator association graph are locators, and there are directed edges between two nodes. The directed edges are used to describe the interactive association relationships between locators. The interactive association relationships are: request jump association relationships or access behavior association relationships.

[0272] The feature extraction module 2704 is also used to extract locator features based on each locator sequence and the locator association graph, and to obtain the features of each locator. The locator features also include: the inter-sequence association features between the locator and locators with interactive association relationships in the locator association graph.

[0273] In one embodiment, the locator association graph is constructed based on the locator combination corresponding to each tagged locator; if the locator combination includes multiple locators that have a request jump association with the tagged locator, the directed edges are specifically used for: the request order of the two locators in the request jump association.

[0274] In one embodiment, the locator association graph is constructed based on the locator combination corresponding to each tagged locator; if the locator combination includes multiple locators that have access behavior associations with the tagged locators, the directed edges are specifically used for: the access order of the two locators in the access behavior association relationship.

[0275] In one embodiment, the evaluation apparatus of the aggregated trading platform further includes a co-occurrence matrix creation module 2804;

[0276] The locator element information includes at least: the interactive device identifier, which uniquely identifies an interactive device;

[0277] The co-occurrence matrix creation module 2804 is used to create a locator co-occurrence map based on the interactive device identifier corresponding to each locator. The locator co-occurrence map includes multiple locator co-occurrence pairs, and locators belonging to the same locator co-occurrence pair correspond to the same interactive device identifier.

[0278] The feature extraction module 2704 is also used to extract locator features based on each locator sequence and the locator co-occurrence map, and to obtain the features of each locator. The locator features also include: the co-occurrence features between the locator and the locators belonging to the same locator co-occurrence pair in the locator co-occurrence map.

[0279] In one embodiment, the similarity calculation module 2706 is further configured to filter out candidate locator features that match each locator feature using a nearest neighbor search algorithm; and to perform similarity processing on each locator feature and the candidate locator features that match the locator feature.

[0280] In one embodiment, the similarity calculation module 2706 is further configured to perform feature similarity processing on each locator feature and the candidate locator features that match the locator features; and to perform element information similarity on the locator element information corresponding to each locator feature and the locator element information corresponding to the candidate locator features that match the locator features; wherein the similarity result includes at least: feature similarity and element information similarity.

[0281] In one embodiment, the locator element information includes at least: an interactive device identifier, which uniquely identifies an interactive device;

[0282] The similarity calculation module 2706 is also used to perform feature similarity processing on each locator feature and the candidate locator features that match the locator features; and to determine the set of interactive devices corresponding to each locator feature through the interactive device identifier corresponding to each locator feature, and to calculate the difference and intersection of interactive devices among the sets of interactive devices corresponding to each locator feature; and to obtain the correlation between interactive devices among each locator feature by processing the difference and intersection of interactive devices among each locator feature, wherein the correlation between interactive devices is either positive or negative; wherein the similarity result includes at least: feature similarity and interactive device correlation.

[0283] In one embodiment, the evaluation device of the aggregated trading platform further includes a locator determination module 2806;

[0284] The locator determination module 2806 is further configured to determine aggregate interaction judgment conditions through aggregate interaction data included in the aggregate interaction database, and to perform aggregate interaction judgment on multiple locators based on the aggregate interaction judgment conditions to determine the locators of the aggregate interaction type; and to determine the locators associated with sensitive information as locators of the sensitive information type, wherein the sensitive information includes at least: sensitive accounts, sensitive web pages and sensitive applications; and to determine the locators among the multiple locators that are not determined to be of the aggregate interaction type as locators to be determined; wherein the locators whose interaction type has been determined include locators of the aggregate interaction type and locators of the sensitive interaction type.

[0285] In one embodiment, the interaction type determination module 2708 is further configured to determine the target locator as an aggregated interaction type if the locators whose interaction types have been determined in the similar locator set only include locators of aggregated interaction types.

[0286] In one embodiment, the interaction type determination module 2708 is further configured to determine the locator to be determined as an aggregated interaction type if the locators in the similar locator set whose interaction types have been determined include locators of an aggregated interaction type that are greater than a preset ratio threshold or a preset number.

[0287] In one embodiment, the evaluation device of the aggregated trading platform further includes an interactive association module 2808;

[0288] The target interaction type of the locator to be determined is an aggregated interaction type;

[0289] The interaction association module 2808 is used to determine that the locator to be determined is associated with sensitive information if the locator sequence corresponding to the locator to be determined includes a locator of a sensitive interaction type, so as to issue an interaction security notification.

[0290] The modules in the evaluation device of the aforementioned aggregated trading platform can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0291] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 29 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as locator sequences and locator interaction types. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements an evaluation method for an aggregated trading platform.

[0292] Those skilled in the art will understand that Figure 29 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0293] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0294] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0295] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0296] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0297] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0298] The technical features in the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0299] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for evaluating an aggregated trading platform, characterized in that, The method includes: Obtain the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information. Based on each of the locator sequences, locator features are extracted to obtain the locator features corresponding to each locator. The locator features include at least: element features corresponding to the locator element information of the locator, and intra-sequence association features between the locator and locators belonging to the same locator sequence. For each of the aforementioned locator features, a similarity processing is performed, and the set of similar locators that are similar to each of the aforementioned locators to be determined is determined based on the obtained similarity results; The target interaction type of each locator to be determined is determined by using the locators whose interaction types have been determined in each set of similar locators.

2. The method according to claim 1, characterized in that, The step of obtaining the locator sequence corresponding to each of the multiple marked locators includes: Obtain the locator combination corresponding to each of the marked locators, wherein the locator combination includes multiple locators that have interactive association relationships with the marked locators; Each of the aforementioned locator combinations is preprocessed to obtain the plurality of locator sequences.

3. The method according to claim 2, characterized in that, The step of obtaining the locator combination corresponding to each of the marked locators includes: Obtain the request detection data corresponding to each of the marked locators, wherein the request detection data includes at least: request detection logs and request redirection access data; For each of the requested detection data, a request jump analysis is performed to determine the interactive information locator and interactive service locator that have a request jump association with the marked locator, and the locator combination is constructed, the locator combination including the interactive information locator, the marked locator, and the interactive service locator; The interaction association includes at least the request redirection association.

4. The method according to claim 2, characterized in that, The step of obtaining the locator combination corresponding to each of the marked locators includes: Obtain multiple locators that have access behavior associations with each of the marked locators, and construct the locator combination, the locator combination including the marked locator and the multiple locators, the access behavior association being used to describe the existence of continuous access behavior within a preset time window; The interaction association includes at least the access behavior association.

5. The method according to claim 2, characterized in that, Each locator in the locator combination has corresponding initial locator element information; The step of preprocessing each of the locator combinations to obtain the plurality of locator sequences includes: Data preprocessing is performed on the initial locator element information of each locator in each locator combination to obtain the plurality of locator sequences. The locator element information corresponding to each locator in the locator sequence is: the initial locator element information of the locator after data preprocessing.

6. The method according to claim 1, characterized in that, The method further includes: Construct a locator association graph, where nodes are locators and directed edges exist between nodes. These directed edges describe the interactive associations between locators, which are either request redirection associations or access behavior associations. The step of extracting locator features based on each of the locator sequences to obtain the locator features corresponding to each locator includes: Based on each locator sequence and the locator association graph, locator features are extracted to obtain each locator feature. The locator feature further includes: inter-sequence association features between the locator and locators with the interaction relationship in the locator association graph.

7. The method according to claim 6, characterized in that, The locator association graph is constructed based on the combination of locators corresponding to each of the marked locators; If the locator combination includes multiple locators that have the request jump association with the marked locator, the directed edge is specifically used for: the request order of the two locators in the request jump association; If the locator combination includes multiple locators that have the access behavior association with the marked locator, the directed edge is specifically used for: the access order of the two locators in the access behavior association.

8. The method according to claim 1, characterized in that, The locator element information includes at least: an interactive device identifier, wherein the interactive device identifier uniquely identifies an interactive device; The method also includes: Based on the interactive device identifier corresponding to each locator, a locator co-occurrence map is created. The locator co-occurrence map includes multiple locator co-occurrence pairs, and locators belonging to the same locator co-occurrence pair correspond to the same interactive device identifier. The step of extracting locator features based on each of the locator sequences to obtain the locator features corresponding to each locator includes: Based on each of the locator sequences and the locator co-occurrence map, locator features are extracted to obtain each of the locator features. The locator features further include: co-occurrence features between the locator and locators belonging to the same locator co-occurrence pair in the locator co-occurrence map.

9. The method according to claim 1, characterized in that, The similarity processing for each of the locator features includes: The nearest neighbor search algorithm is used to filter out candidate locator features that match each of the locator features. A similarity processing is performed on each of the locator features and the candidate locator features that match the locator features.

10. The method according to claim 9, characterized in that, The similarity processing of each of the locator features and the candidate locator features that match the locator features includes: For each of the aforementioned locator features and the candidate locator features that match the aforementioned locator features, feature similarity processing is performed; Element information similarity processing is performed on the locator element information corresponding to each of the locator features and the locator element information corresponding to the candidate locator features that match the locator features; The similarity results include at least the feature similarity and the element information similarity.

11. The method according to claim 9, characterized in that, The locator element information includes at least: an interactive device identifier, wherein the interactive device identifier uniquely identifies an interactive device; The similarity processing of each of the locator features and the candidate locator features that match the locator features includes: For each of the aforementioned locator features and the candidate locator features that match the aforementioned locator features, feature similarity processing is performed; By using the interactive device identifier corresponding to each of the locator features, determine the set of interactive devices corresponding to each of the locator features, and calculate the difference and intersection of interactive devices among the sets of interactive devices corresponding to each of the locator features. The interaction device correlation between each locator feature is obtained by processing the difference set of the interaction devices between each locator feature and the intersection set of the interaction devices. The interaction device correlation is either positive or negative. The similarity results include at least the feature similarity and the relevance of the interactive devices.

12. The method according to claim 1, characterized in that, Methods for identifying marked locators include: The aggregation interaction judgment conditions are determined by the aggregation interaction data included in the aggregation interaction database, and the aggregation interaction judgment is performed on multiple locators based on the aggregation interaction judgment conditions to determine the locator of the aggregation interaction type. Locators associated with sensitive information are identified as locators of sensitive interaction types, wherein the sensitive information includes at least: sensitive accounts, sensitive web pages, and sensitive applications; The locator that is not determined to be the aggregation interaction type among the plurality of locators is determined as the locator to be determined. The locator for the determined interaction type includes the locator for the aggregated interaction type and the locator for the sensitive interaction type.

13. The method according to claim 1, characterized in that, The step of determining the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators includes: If the set of similar locators has only included locators of aggregated interaction type in the set of locators with determined interaction type, then the marked locator is determined to be the aggregated interaction type. If the set of similar locators contains locators of an aggregated interaction type whose interaction type has been determined, and this aggregated interaction type is greater than a preset ratio threshold or a preset number, then the marked locator is determined as the aggregated interaction type.

14. The method according to claim 1, characterized in that, The target interaction type of the locator to be determined is the aggregated interaction type; After determining the target interaction type for each of the locators to be determined, the method further includes: If the locator sequence corresponding to the locator to be determined includes a locator of a sensitive interaction type, the locator to be determined is associated with sensitive information for use in issuing an interaction security notification.

15. An evaluation device for an aggregated trading platform, characterized in that, The device includes: The sequence acquisition module is used to acquire the locator sequence corresponding to each of the multiple marked locators. The marked locators include locators to be determined and locators with determined interaction types. The locator sequence includes multiple locators with interaction relationships, and each locator has corresponding locator element information. The feature extraction module is used to extract locator features based on each locator sequence, and obtain the locator features corresponding to each locator. The locator features include at least: element features corresponding to the locator element information of the locator, and intra-sequence association features between the locator and locators belonging to the same locator sequence. The similarity calculation module is used to perform similarity processing on each of the locator features and determine the set of similar locators similar to each of the locators to be determined based on the obtained similarity results. The interaction type determination module is used to determine the target interaction type of each locator to be determined by using the locators whose interaction types have been determined in each set of similar locators.

Images