Website feature vector extraction, website attribution determination model training method and device

Abstract

The application provides a website feature vector extraction and website attribution judgment model training method and device, which is applied to the field of artificial intelligence technology, the method obtains a first website list of a target enterprise, and then screens the first website list according to a screening condition to determine a second website list; then, according to the second website list, feature extraction is performed on websites identified by IP addresses in the first website list, the extracted features are processed according to a linear function, and the feature vectors of the websites identified by the IP addresses are determined. The websites in the first website list are websites related to the target enterprise, and the websites in the second website list are websites belonging to the target enterprise. The screening condition includes one or more of the following: domain name, network-wide certificate information, ICP filing information, or ASN information. The application can quickly process website asset data of an enterprise, accurately obtain data for website attribution judgment model training, and improve the efficiency and accuracy of model training.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a website feature vector extraction, website attribution judgment model training, website attribution judgment method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the continuous promotion of network security technology, governments and enterprises pay more and more attention to whether their own network assets are safe. In addition to using conventional defense means such as firewalls, anti-viruses, WAFs, etc., the idea of active defense is also gradually popularizing. So-called active defense is to examine whether the network assets are safe from the perspective of the attacker. For attackers, the most important thing to assess the risk of target enterprise network assets is information collection. After finding as many website assets as possible owned by the target enterprise on the Internet, security testing is performed on the discovered website assets. Therefore, how to quickly and accurately determine the attribution of the website becomes a problem that must be considered. SUMMARY

[0003] The present application provides a website feature vector extraction, website attribution judgment model training, website attribution judgment method, device, electronic equipment and storage medium, which can quickly process the website asset data of the enterprise, accurately and truly obtain the data for website attribution judgment model training, and improve the efficiency and accuracy of model training.

[0004] In a first aspect, embodiments of the present application provide a website feature vector extraction method, which comprises:

[0005] obtaining a first website list of a target enterprise;

[0006] Among them, the website in the first website list is a website related to the target enterprise;

[0007] According to the screening condition, the first website list is screened to determine a second website list;

[0008] Among them, the screening condition includes one or more of the following: domain name, global certificate information, ICP filing information or ASN information, and the website in the second website list is a website belonging to the target enterprise;

[0009] According to the second website list, the website identified by the IP address in the first website list is extracted;

[0010] According to the linear function, the extracted features are processed to determine the feature vector of the website identified by the IP address in the first website list.

[0011] Through the technical solution, website asset data of an enterprise can be quickly processed, data used for website attribution judgment model training can be accurately and truly obtained, and the efficiency and accuracy of model training are improved.

[0012] Optionally, the first website list of the target enterprise is obtained, including:

[0013] According to the ICP filing information and the whole network certificate information of the target enterprise, a first-level domain name list of the target enterprise is obtained;

[0014] The subdomain names of the first-level domain names in the first-level domain name list are obtained;

[0015] According to the subdomain names and the ASN information of the target enterprise, IP address segments of the target enterprise are determined;

[0016] The website addresses are expanded according to the IP address segments and the subdomain names;

[0017] Web application discovery is performed according to the expanded website addresses, and the first website list of the target enterprise is determined.

[0018] Optionally, according to the second website list, feature extraction is performed on the website identified by the IP address in the first website list, including:

[0019] The number of keywords in the page of the website identified by the IP address is determined;

[0020] The keywords include the name of the target enterprise;

[0021] The number of websites in the second website list that have the same network segment as the IP address of the website identified by the IP address is determined;

[0022] The number of websites in the second website list that use the same icon as the website identified by the IP address is determined;

[0023] The number of websites in the second website list that have the same service information in the HTTP response header as the website identified by the IP address is determined.

[0024] In a second aspect, embodiments of the present application provide a training method of a website attribution judgment model, the method comprising:

[0025] The website feature vector extraction method is executed multiple times to obtain training samples;

[0026] Labels are set for the training samples;

[0027] The labels are used to identify whether the website belongs to the target enterprise;

[0028] The website attribution judgment model is trained using the training samples with the labels.

[0029] Through the technical solution, the website attribution judgment model can be quickly and accurately trained.

[0030] In a third aspect, embodiments of the present application provide a website attribution judgment method, which comprises:

[0031] Obtaining a website to be judged for attribution and a target enterprise to be judged for website attribution;

[0032] According to the website to be judged for attribution and the target enterprise to be judged for website attribution, a website feature vector extraction method is used to obtain a feature vector of the website to be judged for attribution;

[0033] The feature vector of the website to be judged for attribution is input into the trained website attribution judgment model to determine the attribution result of the website to be judged for attribution.

[0034] Through the technical solution, the attribution of a website can be quickly and accurately judged, and data support is provided for website asset security detection.

[0035] In a fourth aspect, embodiments of the present application provide a website feature vector extraction device, which comprises:

[0036] An acquisition module is configured to acquire a first website list of a target enterprise;

[0037] The websites in the first website list are websites related to the target enterprise;

[0038] A screening module is configured to screen the first website list according to a screening condition to determine a second website list;

[0039] The screening condition comprises one or more of the following: domain name, network-wide certificate information, ICP filing information or ASN information, and the websites in the second website list are websites belonging to the target enterprise;

[0040] A feature extraction module is configured to extract features of websites identified by IP addresses in the first website list according to the second website list;

[0041] A determination module is configured to process the extracted features according to a linear function to determine feature vectors of the websites identified by IP addresses in the first website list.

[0042] In a fifth aspect, embodiments of the present application provide a website attribution judgment model training device, which comprises:

[0043] An acquisition module is configured to execute a website feature vector extraction method multiple times to obtain training samples;

[0044] A labeling module is configured to set labels for the training samples;

[0045] The label is used for identifying whether the website belongs to the target enterprise.

[0046] The training module is configured to train the website attribution judgment model using the training samples provided with the labels.

[0047] In a sixth aspect, an embodiment of the present application provides a website attribution judgment device, which comprises:

[0048] The acquisition module is configured to acquire a website to be judged for attribution and a target enterprise to be judged for website attribution.

[0049] The feature extraction module is configured to use a website feature vector extraction method to obtain a feature vector of the website to be judged for attribution according to the website to be judged for attribution and the target enterprise to be judged for website attribution.

[0050] The determination module is configured to input the feature vector of the website to be judged for attribution into the trained website attribution judgment model and determine an attribution result of the website to be judged for attribution.

[0051] In a seventh aspect, an embodiment of the present application provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method according to any implementation manner of the first aspect, the second aspect or the third aspect when executing the program.

[0052] In an eighth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method according to any implementation manner of the first aspect, the second aspect or the third aspect.

[0053] The present application provides a website feature vector extraction method and a website attribution judgment model training method and device. The method comprises the following steps: acquiring a first website list of a target enterprise, screening the first website list according to a screening condition to determine a second website list; then performing feature extraction on websites identified by IP addresses in the first website list according to the second website list, processing the extracted features according to a linear function, and determining feature vectors of the websites identified by IP addresses in the first website list. The websites in the first website list are websites related to the target enterprise, and the websites in the second website list are websites belonging to the target enterprise. The screening condition comprises one or more of the following: a domain name, global certificate information, ICP filing information, or ASN information. The present application can quickly process website asset data of an enterprise, accurately and truly obtain data for website attribution judgment model training, and improve the efficiency and accuracy of model training.

[0054] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of the present invention, nor is it intended to restrict the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0055] The above and other features, advantages, and aspects of the various embodiments of the present invention will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements.

[0056] Figure 1 This is a flowchart of a website feature vector extraction method according to an embodiment of the present invention;

[0057] Figure 2 This is a flowchart illustrating a training method for a website attribution determination model according to an embodiment of the present invention.

[0058] Figure 3 This is a flowchart of a website ownership determination method according to an embodiment of the present invention;

[0059] Figure 4 This is a schematic diagram of the structure of a website feature vector extraction device according to an embodiment of the present invention;

[0060] Figure 5 This is a schematic diagram of the structure of a training device for a website attribution determination model according to an embodiment of the present invention;

[0061] Figure 6 This is a schematic diagram of the structure of a website ownership determination device according to an embodiment of the present invention;

[0062] Figure 7 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0063] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0064] It should be noted that the embodiments of the present invention are described only to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention.

[0065] Figure 1This is a flowchart illustrating a website feature vector extraction method according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0066] S101. Obtain the target company's primary website list.

[0067] Optionally, the websites in the first website list are those related to the target company.

[0068] Optionally, obtain the target company's primary website list, including:

[0069] Based on the target company's Internet Content Provider (ICP) filing information and network certificate information, obtain the target company's list of top-level domain names;

[0070] Retrieve subdomains of the top-level domains in the top-level domain list;

[0071] Based on the subdomain and Autonomous System Number (ASN) information, determine the IP address range of the target enterprise;

[0072] Expand the URL based on IP address ranges and subdomains;

[0073] Web application discovery is performed based on the expanded URLs to determine the primary website list for the target company.

[0074] For example, based on the target company's ICP filing information and network certificate information, a list of the target company's first-level domains is obtained, which includes the first-level domains A12, B12 and C12;

[0075] Then, based on the top-level domain, obtain the subdomains of the top-level domain. The subdomain of A12 is a12, the subdomain of B12 is b12, and the subdomain of C12 is c12.

[0076] Based on the subdomain and the target company's ASN information, it was found that the IP address corresponding to the subdomain a12 is 12.12.12.34. Therefore, the network segment 12.12.0.0 / 16 was selected as the target company's public IP segment.

[0077] Finally, the URL is expanded based on the network segment 12.12.0.0 / 16, and web application discovery is performed based on the expanded URL to determine the target company's primary website list.

[0078] For example, the extended URLs could be: 12.12.14.0, 12.12.14.92, and 12.12.0.34.

[0079] S102. Filter the first website list according to the filtering criteria to determine the second website list.

[0080] Optionally, the filtering criteria may include one or more of the following: domain name, network certificate information, ICP filing information, or ASN information, and the websites in the second website list shall belong to the target company.

[0081] For example, websites that must belong to the target company can be selected from the first website list based on the target company's domain name, network certificate information, ICP filing information, and ASN information, and a second website list can be constructed based on all websites that must belong to the target company.

[0082] It should be noted that the remaining websites in the first website list after filtering are those identified by IP addresses and those not identified by IP addresses and not belonging to the target company. Among them, the websites identified by IP addresses are used for subsequent feature extraction steps.

[0083] S103. Based on the second website list, extract features from the websites identified by IP addresses in the first website list.

[0084] Optionally, based on the second website list, feature extraction is performed on websites identified by IP addresses in the first website list, including:

[0085] Determine the number of keywords in the pages of a website identified by its IP address;

[0086] The keywords include the name of the target company or information related to the target company;

[0087] Determine the number of websites in the second website list that share the same network segment as the websites identified by their IP addresses;

[0088] Determine the number of websites in the second website list that use the same icon as the websites identified by their IP addresses;

[0089] Determine the number of websites in the second website list that have the same service information in the HTTP response header as the websites identified by their IP addresses.

[0090] Optionally, the values ​​obtained in the above steps can be used as feature values, which can be used to calculate the feature vector corresponding to a website that only has an IP address.

[0091] It should be noted that the methods for extracting feature values ​​are not limited to those described in the steps above.

[0092] S104. Process the extracted features according to the linear function to determine the feature vectors of the websites identified by IP addresses in the first website list.

[0093] Optionally, the features extracted in step S103 are normalized by a linear function, and the feature values ​​obtained in step S103 are mapped to the [0,1] interval under the same dimension to obtain the feature vector.

[0094] This invention provides a method for extracting website feature vectors. The method involves obtaining a first list of websites belonging to a target company, filtering the first list based on selection criteria to determine a second list of websites, and then extracting features from the websites identified by IP addresses in the first list based on the second list. The extracted features are then processed using a linear function to determine the feature vectors of the websites identified by IP addresses in the first list. The websites in the first list are those related to the target company, and the websites in the second list belong to the target company. Selection criteria include one or more of the following: domain name, national network certificate information, ICP filing information, or ASN information. This invention can quickly process a company's website asset data, accurately and reliably obtaining data for training a website ownership determination model, thus improving the efficiency and accuracy of model training.

[0095] The above combination Figure 1 This paper details the website feature vector extraction method provided by embodiments of the present invention. The following is a detailed explanation in conjunction with... Figure 2 This invention provides a detailed explanation of the training method for the website attribution determination model provided in the embodiments of the present invention.

[0096] S201. Execute the website feature vector extraction method multiple times to obtain training samples.

[0097] Optionally, the detailed steps of the feature vector extraction method of this website can be found in steps S101-S104, which will not be repeated here.

[0098] Optionally, steps S101-S104 can be executed multiple times to obtain multiple training samples.

[0099] S202, Set labels for training samples.

[0100] The tags are used to identify whether a website belongs to the target company.

[0101] Optionally, the website can be identified as belonging to the target company based on its IP address. If it belongs to the target company, the feature vector corresponding to the website is labeled as 1; otherwise, the feature vector corresponding to the website is labeled as 0.

[0102] S203. Train the website affiliation judgment model using labeled training samples.

[0103] Alternatively, a Logistic Regression model can be used for training, according to the formula:

[0104] Y = sigmod(w1x1 + w2x2 + ... + w n x n +b), input the feature vectors and labels from the training samples into the Logistic regression model for training, and determine the weight vector W and the bias b.

[0105] In the formula, Y represents the model output, which is either 0 or 1, corresponding to the set labels, and w1, w2…w… n The weight values ​​are x1, x2, ..., x. n Let b be the eigenvector and b be the deviation value.

[0106] It should be noted that training ends when the loss function value reaches a threshold or the number of training iterations reaches a threshold, thus obtaining the website attribution judgment model.

[0107] This invention provides a training method for a website attribution determination model. The method involves repeatedly executing a website feature vector extraction method to obtain training samples; then, labels are assigned to the training samples, whereby the labels identify the website's affiliation; finally, the labeled training samples are used to train the website attribution determination model. This invention can quickly and accurately train a website attribution determination model.

[0108] The above combination Figure 2 The training method of the website attribution determination model provided in the embodiments of the present invention is described in detail below. Figure 3 This invention provides a detailed description of the website ownership determination method provided in the embodiments of the present invention.

[0109] S301. Obtain the website to be determined and the target company to which the website belongs.

[0110] Optionally, the website to be determined and the target company to be determined can be obtained based on the needs of website asset security testing.

[0111] S302. Based on the website to be determined and the target enterprise to which the website belongs, use the website feature vector extraction method to obtain the feature vector of the website to be determined.

[0112] Optionally, the detailed steps of the feature vector extraction method of this website can be found in steps S101-S104, which will not be repeated here.

[0113] For example, if a website 'a' needs to determine whether it belongs to company 'A', then based on company 'A's' ICP filing information and network certificate information, the target company's top-level domain name is obtained; then, its subdomains are obtained based on the top-level domain name; then, based on the subdomains and company 'ASN' information, the target company's IP address range is determined; finally, the URL is expanded based on the IP address range and subdomains, and web application discovery is performed based on the expanded URL to identify websites that may be related to company 'A'.

[0114] Then, based on the domain name, network certificate information, ICP filing information and ASN information, the relevant websites are filtered to identify those that must belong to Company A. Then, based on the websites that must belong to Company A, the features of website a are extracted.

[0115] Feature extraction can be performed in the following steps:

[0116] Determine the number of keywords on the pages of website A; the keywords include the name of company A or information related to company A.

[0117] Determine the number of websites that share the same IP address segment as website A among all websites that must belong to company A.

[0118] Determine the number of websites that use the same icon as website A among all websites that must belong to company A.

[0119] Determine the number of websites that, among those belonging to Company A, have the same service information in their HTTP response headers as website A.

[0120] Furthermore, the extracted features can be processed using a linear function to determine the feature vector of website a.

[0121] S303. Input the feature vector of the website to be determined into the trained website attribution determination model to determine the attribution result of the website to be determined.

[0122] For example, the feature vector obtained in step S301 is input into the website affiliation judgment model for judgment. If the model outputs a result of 1, then website a belongs to company A; if the model outputs a result of 0, then website a does not belong to company A.

[0123] Optionally, the model can be updated based on its usage and changes in the company's website resources, continuously optimizing the training model to make the attribution determination more and more accurate.

[0124] This embodiment provides a method for determining website ownership. The method involves acquiring the website to be identified and the target company to which it belongs; then, using a website feature vector extraction method, obtaining the feature vector of the website to be identified; finally, inputting the feature vector into a trained website ownership determination model to determine the website's ownership. This invention can quickly and accurately determine the ownership of a website, providing data support for website asset security detection.

[0125] The following combination Figure 4 This application provides a detailed description of the apparatus provided in its embodiments that can perform the above-described website feature vector extraction method.

[0126] For example, Figure 4 This is a schematic diagram of the structure of a website feature vector extraction device according to an embodiment of the present invention; as shown below. Figure 4 As shown, the website feature vector extraction device 40 includes:

[0127] Module 401 is used to retrieve the target company's primary website list;

[0128] The websites in the first website list are those related to the target company;

[0129] The filtering module 402 is used to filter the first website list according to the filtering criteria to determine the second website list;

[0130] The filtering criteria include one or more of the following: domain name, network certificate information, ICP filing information or ASN information, and the websites in the second website list belong to the target company.

[0131] The feature extraction module 403 is used to extract features from websites identified by IP addresses in the first website list based on the second website list;

[0132] The determination module 404 is used to process the extracted features according to a linear function to determine the feature vectors of the websites identified by IP addresses in the first website list.

[0133] Optionally, module 401 is also used to obtain a list of primary domains of the target enterprise based on the target enterprise's ICP filing information and network certificate information; then obtain the subdomains of the primary domains in the list of primary domains, determine the IP address range of the target enterprise based on the subdomains and the target enterprise's ASN information; then expand the URL based on the IP address range and the subdomains, perform web application discovery based on the expanded URL, and determine the primary website list of the target enterprise.

[0134] Optionally, the feature extraction module 403 is further configured to determine the number of keywords in the pages of the website identified by the IP address; wherein the keywords include the name of the target enterprise; determine the number of websites in the second website list whose IP addresses are in the same network segment as the website identified by the IP address; determine the number of websites in the second website list whose icons are the same as those used by the website identified by the IP address; and determine the number of websites in the second website list whose service information in the HTTP response headers is the same as that of the website identified by the IP address.

[0135] The following combination Figure 5 This application provides a detailed description of the apparatus provided in its embodiments, which can execute the training method of the website attribution determination model described above.

[0136] For example, Figure 5 This is a schematic diagram of the structure of a training device for a website attribution determination model according to an embodiment of the present invention; as shown below. Figure 5 As shown, the device 50 includes:

[0137] The acquisition module 501 is used to execute the website feature vector extraction method multiple times to obtain training samples;

[0138] The annotation module 502 is used to set labels for the training samples;

[0139] The tag is used to identify whether the website belongs to the target company;

[0140] Training module 503 is used to train the website attribution judgment model using labeled training samples.

[0141] The following combination Figure 6 This application provides a detailed description of the apparatus provided in its embodiments that can execute the aforementioned website attribution determination method.

[0142] For example, Figure 6 This is a schematic diagram of a website attribution determination device according to an embodiment of the present invention; as shown below. Figure 6 As shown, the device 60 includes:

[0143] The acquisition module 601 is used to acquire the website to be determined and the target company to which the website to be determined belongs;

[0144] The feature extraction module 602 is used to obtain the feature vector of the website to be determined based on the website to be determined and the target enterprise to which the website to be determined belongs, using the website feature vector extraction method.

[0145] The determination module 603 is used to input the feature vector of the website to be determined into the trained website attribution determination model to determine the attribution result of the website to be determined.

[0146] This invention also provides a computer electronic device. Figure 7 A schematic diagram of the structure of an electronic device to which embodiments of the present invention can be applied is shown, such as... Figure 7 As shown, the computer electronic device includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for system operation. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0147] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0149] The modules or modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules or modules can also be housed in a processor. For example, a processor can be described as including an acquisition module 401, a filtering module 402, a feature extraction module 403, and a determination module 404. The names of these modules do not necessarily limit the module itself. For example, the feature extraction module 403 can also be described as "a feature extraction module 403 for extracting features from websites identified by IP addresses in a first website list based on a second website list."

[0150] In another aspect, the present invention also provides a computer-readable storage medium, which may be the computer-readable storage medium included in the website feature vector extraction device, the website attribution judgment model training device, or the website attribution judgment device described in the above embodiments; or it may be a standalone computer-readable storage medium not assembled into an electronic device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the website feature vector extraction method, the website attribution judgment model training method, or the website attribution judgment method described in the present invention.

[0151] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the specific combination of the above-described technical features, but also includes other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for extracting website feature vectors, characterized in that, include: Obtain a first website list of the target company; the websites in the first website list are websites related to the target company; filter the first website list according to filtering conditions to determine a second website list; the filtering conditions include one or more of the following: domain name, full network certificate information, ICP filing information or ASN information, and the websites in the second website list belong to the target company; extract features from the websites identified by IP addresses in the first website list according to the second website list; process the extracted features according to a linear function to determine the feature vectors of the websites identified by IP addresses in the first website list, the step of obtaining the first website list of the target company includes: obtaining a list of first-level domain names of the target company according to the ICP filing information and full network certificate information of the target company; obtaining the subdomains of the first-level domain names in the list of first-level domain names; according to the... The system uses the subdomain and the target company's ASN information to determine the target company's IP address range; it expands the URL based on the IP address range and the subdomain; it performs web application discovery based on the expanded URL to determine the target company's first website list; and it extracts features from the websites identified by IP addresses in the first website list based on the second website list, including: determining the number of keywords in the pages of the websites identified by IP addresses; the keywords include the name of the target company; determining the number of websites in the second website list whose IP addresses are in the same network segment as the websites identified by IP addresses; determining the number of websites in the second website list whose icons are the same as the websites identified by IP addresses; and determining the number of websites in the second website list whose HTTP response headers contain the same service information as the websites identified by IP addresses.

2. A training method for a website affiliation determination model based on the website feature vector extraction method of claim 1, characterized in that, include: The website feature vector extraction method is executed multiple times to obtain training samples; labels are set for the training samples; the labels are used to identify whether a website belongs to the target enterprise; the website affiliation judgment model is trained using the labeled training samples.

3. A website attribution determination method based on the website feature vector extraction method of claim 1, characterized in that, include: Obtain the website to be determined and the target company to which the website belongs; based on the website to be determined and the target company to which the website belongs, use the website feature vector extraction method to obtain the feature vector of the website to be determined; input the feature vector of the website to be determined into the trained website belonging determination model to determine the belonging result of the website to be determined.

4. A website feature vector extraction device, characterized in that, include: The acquisition module is used to acquire a first list of websites of the target company; the websites in the first list are websites related to the target company. The acquisition module is also used to obtain a list of primary domains of the target enterprise based on the target enterprise's ICP filing information and network certificate information; then, it obtains the subdomains of the primary domains in the list of primary domains, and determines the IP address range of the target enterprise based on the subdomains and the target enterprise's ASN information; Then, the URLs are expanded based on IP address ranges and subdomains. Web application discovery is performed based on the expanded URLs to determine a first website list for the target company. A filtering module is used to filter the first website list according to filtering conditions to determine a second website list. The filtering conditions include one or more of the following: domain name, network certificate information, ICP filing information, or ASN information. The websites in the second website list belong to the target company. A feature extraction module is used to extract features from the websites identified by IP addresses in the first website list based on the second website list. A determination module is used to process the extracted features according to a linear function to determine the feature vectors of the websites identified by IP addresses in the first website list. The feature extraction module is also used to determine the number of keywords in the pages of the websites identified by IP addresses. The keywords include the name of the target company. The module also determines the number of websites in the second website list whose IP addresses are in the same network segment as the websites identified by IP addresses. The module further determines the number of websites in the second website list whose icons are the same as the websites identified by IP addresses. Finally, the module determines the number of websites in the second website list whose HTTP response headers contain the same service information as the websites identified by IP addresses.

5. A training device for a website attribution determination model based on the website feature vector extraction device of claim 4, characterized in that, include: The acquisition module is used to execute the website feature vector extraction method multiple times to obtain training samples; The labeling module is used to set labels for the training samples; the labels are used to identify whether a website belongs to the target enterprise; the training module is used to train the website affiliation judgment model using the labeled training samples.

6. A website attribution determination device based on the website feature vector extraction device of claim 4, characterized in that, include: The acquisition module is used to acquire the website to be determined and the target enterprise to which the website belongs; the feature extraction module is used to obtain the feature vector of the website to be determined using the website feature vector extraction method based on the website to be determined and the target enterprise to which the website belongs; the determination module is used to input the feature vector of the website to be determined into the trained website belonging determination model to determine the belonging result of the website to be determined.

7. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 3.

Images