Method, device and storage medium for detecting internet harmful event

Abstract

The application discloses an internet harmful event detection method, device and storage medium, constructs or updates a keyword knowledge graph, divides the knowledge graph into a plurality of subgraphs, clusters documents into harmful events by using a clustering algorithm, inserts each harmful event into a harmful story tree by updating each harmful event, or creates a new harmful story tree according to the harmful event, realizes harmful content detection and classification in mobile internet and internet, and the purpose is to find harmful events from massive webpage and document data, organizes harmful events in a reasonable harmful story tree in an online mode, proposes a two-layer webpage document clustering algorithm based on a knowledge graph, extracts harmful events from a large amount of webpage text or webpage related news, and organizes events into a story tree by using an online algorithm after new webpage and document data arrive, and is more effective than a traditional keyword-based harmful algorithm in the aspect of harmful event extraction.

Description

Technical Field

[0001] This application relates to the field of network detection, particularly methods, apparatus, and storage media for detecting harmful internet incidents. Background Technology

[0002] In modern society, harmful content on the internet can impact people's physical and mental health, and even cause huge economic losses to the country and its people. Meanwhile, numerous daily news reports and cases about harmful internet content can cover different types of harmful content and important information, but they also contain a large amount of redundant or overlapping data, making information processing increasingly difficult. Furthermore, faced with massive amounts of internet and mobile internet data, harmful information is often overwhelmed by a large amount of other information, making it difficult to detect.

[0003] First, extracting harmful events from the vast amounts of internet and communication network information remains challenging. Articles and web pages on the mobile internet and the internet can cover vastly different topics and contain redundant information about the same concept published from different sources. Currently, keyword technology is widely used to discover harmful events, but this method, due to its overly simplistic patterns, still requires significant additional effort from users to understand the large number of web pages and articles associated with each keyword set.

[0004] Secondly, many recently proposed infographics attempt to connect events in arbitrary evolutionary graphs into branches within the infographic itself. This overly complex graph structure does not allow users to easily and quickly visualize and understand internet data. Most importantly, most existing harmful event timelines or harmful content graph generation schemes are based on AND / OR operations on the entire corpus, requiring repeated processing of old documents. Users cannot quickly visualize new content within the harmful content events they are trying to focus on.

[0005] Therefore, the aforementioned technical problems in the relevant technologies urgently need to be solved. Summary of the Invention

[0006] This application aims to solve one of the technical problems in related technologies. To this end, embodiments of this application provide a method, apparatus, and storage medium for detecting harmful events on the Internet, capable of detecting harmful events on the Internet.

[0007] According to one aspect of the embodiments of this application, a method for detecting harmful internet events is provided, the method comprising:

[0008] Construct or update a keyword knowledge graph and divide the knowledge graph into several subgraphs;

[0009] Clustering algorithms are used to cluster documents into harmful events;

[0010] By updating each harmful event, each harmful event is inserted into the harmful story tree, or a new harmful story tree is created based on the harmful events;

[0011] The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme.

[0012] In one embodiment, the method further includes, before constructing or updating the keyword knowledge graph:

[0013] Discard documents whose content length is less than the threshold;

[0014] Use Jieba segmentation to split the title and body of each document;

[0015] Keyword extraction was performed using a collaborative filtering algorithm.

[0016] In one embodiment, clustering documents into harmful events using a clustering algorithm includes:

[0017] Community detection is performed on the keyword knowledge graph, dividing the keyword knowledge graph into several communities, where each community contains keywords for a specific topic;

[0018] The strength of each edge in the keyword knowledge graph is measured using the intermediateness score of the edges, where the intermediateness score is the number of shortest paths between all node pairs through the edge.

[0019] Iteratively remove edges with intermediate scores higher than a preset value to extract communities.

[0020] In one embodiment, the method further includes:

[0021] Perform a second-level document clustering within each topic to obtain harmful events and their classifications;

[0022] An SVM classifier is used to determine whether a pair of documents are discussing the same harmful event or whether document features are used as input.

[0023] In one embodiment, document characteristics include the similarity between cosine-valued content and TF vectors, the similarity between cosine-valued headings and TF vectors, and the similarity between the first sentence in two documents.

[0024] In one embodiment, each harmful event is either inserted into the harmful story tree by updating each harmful event, or a new harmful story tree is created based on the harmful events, including:

[0025] Given a set of harmful events extracted for a specific harmful topic;

[0026] Multiple stories under the theme of organizing harmful incidents online;

[0027] Each harmful story is described by a harmful story tree, which represents the evolutionary structure of the harmful story.

[0028] In one embodiment, the method further includes the recommendation and warning of harmful story trees, including:

[0029] Once a harmful event is detected, recommendations and warnings will be issued.

[0030] According to one aspect of an embodiment of this application, a device for detecting harmful internet events is provided, the device comprising:

[0031] The first module is used to construct or update the keyword knowledge graph and divide the knowledge graph into several subgraphs.

[0032] The second module is used to cluster documents into harmful events using clustering algorithms;

[0033] The third module is used to insert each harmful event into the harmful story tree by updating each harmful event, or to create a new harmful story tree based on the harmful events;

[0034] The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme.

[0035] According to one aspect of an embodiment of this application, a device for detecting harmful internet events is provided, the device comprising:

[0036] At least one processor;

[0037] At least one memory for storing at least one program;

[0038] When at least one of the programs is executed by at least one of the processors, the method for detecting harmful Internet events as described in the preceding embodiments is implemented.

[0039] According to one aspect of the embodiments of this application, a storage medium is provided, the storage medium storing a processor-executable program, which, when executed by a processor, implements the method for detecting harmful Internet events as described in the preceding embodiments.

[0040] The beneficial effects of the method, apparatus, and storage medium for detecting harmful internet events provided in this application are as follows: This application constructs or updates a keyword knowledge graph and divides the knowledge graph into several subgraphs; it uses a clustering algorithm to cluster documents into harmful events; by updating each harmful event, each harmful event is inserted into a harmful story tree, or a new harmful story tree is created based on the harmful event, thus realizing the detection and classification of harmful content in the mobile internet and the internet. The purpose is to discover harmful events from massive amounts of web page and document data, and to organize harmful events in a reasonable harmful story tree online; a two-layer web page and document clustering algorithm based on a knowledge graph is proposed, which extracts harmful events from a large amount of web page text or web page-related news. After new web page and document data arrive, an online algorithm is used to organize the events into a story tree, which is more effective than traditional keyword-based malicious algorithms in extracting harmful events.

[0041] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart illustrating the method for detecting harmful internet events provided in this application embodiment;

[0044] Figure 2 A schematic diagram of an internet harmful event detection device provided in an embodiment of this application;

[0045] Figure 3 A schematic diagram of another Internet harmful event detection device provided in an embodiment of this application. Detailed Implementation

[0046] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0047] The terms "first," "second," "third," and "fourth," etc., used in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0048] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0049] In modern society, harmful content on the internet can impact people's physical and mental health, and even cause huge economic losses to the country and its people. Meanwhile, numerous daily news reports and cases about harmful internet content can cover different types of harmful content and important information, but they also contain a large amount of redundant or overlapping data, making information processing increasingly difficult. Furthermore, faced with massive amounts of internet and mobile internet data, harmful information is often overwhelmed by a large amount of other information, making it difficult to detect.

[0050] First, extracting harmful events from the vast amounts of internet and communication network information remains challenging. Articles and web pages on the mobile internet and the internet can cover vastly different topics and contain redundant information about the same concept published from different sources. Currently, keyword technology is widely used to discover harmful events, but this method, due to its overly simplistic patterns, still requires significant additional effort from users to understand the large number of web pages and articles associated with each keyword set.

[0051] Secondly, many recently proposed infographics attempt to connect events in arbitrary evolutionary graphs into branches within the infographic itself. This overly complex graph structure does not allow users to easily and quickly visualize and understand internet data. Most importantly, most existing harmful event timelines or harmful content graph generation schemes are based on AND / OR operations on the entire corpus, requiring repeated processing of old documents. Users cannot quickly visualize new content within the harmful content events they are trying to focus on.

[0052] To address the aforementioned problems, this application proposes a method, apparatus, and storage medium for detecting harmful events on the Internet. In this technology, firstly, a novel two-layer document clustering procedure accurately groups a large amount of web page content and articles into conceptually single harmful events. Feature engineering and machine learning techniques are utilized, primarily including keyword extraction, keyword community detection, and a classifier to detect whether two documents discuss the same harmful event, as well as a knowledge graph-based document clustering process. Secondly, the system further groups harmful stories, with each story represented by a harmful event tree. The connection between two harmful events indicates the temporal transition or causal relationship between them. Through an online algorithm, the harmful story tree is progressively updated based on newly collected web pages and articles without needing to be regenerated when new data arrives.

[0053] The terms used in this application include:

[0054] Deep learning: Deep learning is a type of machine learning, and machine learning is an essential path to achieving artificial intelligence. The concept of deep learning originated from research on artificial neural networks; a multilayer perceptron with multiple hidden layers is a type of deep learning structure. Deep learning discovers distributed feature representations of data by combining low-level features to form more abstract high-level representations of attribute categories or features. The motivation for researching deep learning is to build neural networks that simulate the human brain's analytical learning process. It mimics the mechanisms of the human brain to interpret data, such as images, sounds, and text.

[0055] Harmful incidents: Web pages or articles containing harmful content that suddenly appear on the mobile internet or the internet are called fraudulent incidents.

[0056] Harmful Stories: Composed of multiple related harmful events, organized together by a series of evolving real-world incidents of harmful content.

[0057] Knowledge graphs are structured semantic knowledge bases used to describe concepts and their relationships in the physical world in symbolic form. Their basic building blocks are "entity-relationship-entity" triples, as well as entities and their associated attribute-value pairs. Entities are interconnected through relations, forming a network-like knowledge structure.

[0058] Clustering refers to the process of dividing a given set of objects into different subsets, with the goal of making the elements within each subset as similar as possible, and the elements between different subsets as dissimilar as possible. These subsets are also called clusters, and generally have no overlap.

[0059] Text clustering: Text clustering refers to the clustering analysis of documents and is widely used in text mining and information retrieval. The basic process of text clustering consists of two steps: feature extraction and vector clustering. If a document can be represented as a vector, clustering algorithms can be applied to it.

[0060] TF-IDF: TF-IDF is a commonly used weighting technique for information retrieval and text mining. It is a statistical method used to evaluate the importance of a word to a document within a document set or corpus. The importance of a word increases proportionally to its frequency of occurrence in the document, but decreases inversely proportionally to its frequency of occurrence in the corpus.

[0061] Jieba Segmentation: An open-source Chinese word segmentation toolkit.

[0062] Figure 1 A flowchart of the method for detecting harmful internet events provided in the embodiments of this application is shown below. Figure 1 As shown, the method for detecting harmful internet incidents proposed in this application includes:

[0063] S101. Construct or update the keyword knowledge graph and divide the knowledge graph into several subgraphs;

[0064] S102. Use clustering algorithms to cluster documents into harmful events;

[0065] S103. By updating each harmful event, insert each harmful event into the harmful story tree, or create a new harmful story tree based on the harmful events;

[0066] The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme.

[0067] This embodiment introduces the concepts of "harmful events" and "harmful stories," and proposes organizing and tracking harmful web pages or articles into a harmful story tree to reveal the relationships between them and reduce redundancy. A harmful event refers to a group of web pages or articles belonging to a certain harmful type, such as a gambling website. A harmful story is a collection of related harmful events, consisting of a series of harmful stories of the same type.

[0068] Harmful Story Trees are constructed from a certain number of web pages or articles within a harmful story forest system. They primarily consist of three components: data preprocessing, keyword knowledge graph construction, and document clustering into harmful events, generating harmful event story trees, and providing early warning recommendations. The entire process is divided into the following stages: First, a series of NLP and machine learning tools are used to process the input web page document stream, including document recording and word segmentation. Then, the system extracts keywords, constructs / updates a keyword knowledge graph, and divides the knowledge graph into several subgraphs. Next, harmful event clustering is used to cluster documents into harmful events. Finally, a new story tree is updated by either inserting each discovered harmful event into an existing harmful story tree or creating a new story tree.

[0069] Furthermore, before constructing or updating the keyword knowledge graph, this embodiment also includes text and document preprocessing: discarding documents with content length less than a threshold; segmenting the title and body of each document using Jieba segmentation; and extracting keywords using a collaborative filtering algorithm. Document filtering includes discarding unimportant documents with content length less than a threshold (20 characters); segmentation includes segmenting the title and body of each document using Jieba segmentation, primarily processing Chinese web pages and articles, achieving good performance on Chinese segmentation tasks. For data in different languages, corresponding segmentation tools for that language can be used; keyword extraction includes addressing the issue that traditional keyword extraction methods, such as TF-IDF-based methods that measure the importance of each word through frequency information, cannot detect keywords with relatively low frequencies. The text ranking algorithm used in this technology employs a collaborative filtering algorithm, which can handle such cases.

[0070] During document preprocessing, harmful event extraction is performed to group conceptually similar documents into events. Based on the large amount of accumulated keyword information, the accuracy of event clustering can be significantly improved. To meet the high-precision requirements of long document text clustering, this technique uses a two-layer clustering method based on keyword knowledge graph and document knowledge graph, including: performing community detection in the keyword knowledge graph, dividing the keyword knowledge graph into several communities, where each community contains keywords of a topic; using the intermediateness score of edges to measure the strength of each edge in the keyword knowledge graph, where the intermediateness score is the number of shortest paths between all node pairs through the edge; iteratively deleting edges with intermediateness scores higher than a preset value to extract communities. Further, a second-layer document clustering is performed in each topic to obtain harmful events and their classifications; an SVM classifier is used to determine whether a pair of documents is discussing the same harmful event or whether document features are used as input. Document features include the similarity between cosine similarity content and TF vector, the similarity between cosine similarity titles and TF vectors, and the similarity of the first sentence in the two documents.

[0071] Specifically, the two-layer clustering method based on keyword knowledge graphs and document knowledge graphs includes:

[0072] (1) Construct a keyword knowledge graph.

[0073] (2) Community detection is performed in the constructed keyword graph. The entire keyword graph G is divided into communities C = {C1, C2, ..., C1|C1|}, where each community contains keywords for a certain topic (possibly associated with multiple stories). Each keyword can appear in multiple communities. To detect keyword communities, the centrality score of edges is used to measure the strength of each edge in the keyword graph. The centrality score of an edge is defined as the number of shortest paths between all pairs of nodes passing through it. The advantage between two communities is expected to reach a higher centrality score. Edges with higher centrality scores are iteratively removed to extract communities. Since a keyword community is a set of words, it can also be regarded as a document. Each document is assigned to a keyword community by thresholding.

[0074] (3) Further, a second-layer document clustering is performed in each topic to obtain harmful events and their classifications. This process is also called harmful event clustering. Harmful events only include documents that discuss the same semantically harmful events. To generate harmful event clusters, a supervised learning-guided clustering procedure is used in the second layer, i.e., an SVM classifier is trained to determine whether a pair of documents is discussing the same harmful event, or whether a set of document pair features are used as input, including the similarity of cosine similarity content TF-idf and TF vector, cosine similarity title TF-idf and TF vector, the similarity of the first sentence in the two documents, etc. For each pair of documents in the same topic, it is decided whether to connect them based on the prediction of the above document pair relation classifier. Therefore, the documents in each topic will form a document knowledge graph. Then, the same community detection algorithm mentioned above is applied to such a document knowledge graph. The second-layer scheme groups documents into topics based on keyword community detection, and further groups documents in each topic into harmful events. For each event E, a set of keywords belonging to the topic (keyword community) is recorded to facilitate the generation of harmful story trees.

[0075] The above step S103 involves updating each harmful event, inserting each harmful event into the harmful story tree, or creating a new harmful story tree based on the harmful events, including: given a set of harmful events extracted for a specific harmful topic; organizing the harmful events into multiple stories under the topic in an online manner; wherein each harmful story is described by a harmful story tree to describe the evolutionary structure of the harmful story.

[0076] Specifically, each harmful story is described by a harmful story tree, which represents the evolutionary structure of that harmful story. When a new harmful event arrives and an existing story forest is provided, the online algorithm for developing the story forest mainly includes two steps: a) identifying the harmful story tree to which the event belongs; b) updating the found harmful story tree by inserting the new event in the correct place, or creating a new harmful story tree if the event does not belong to any existing harmful story; c) harmful story recommendation and early warning: based on the set warning categories and thresholds, detected harmful events are recommended and warned to help with timely subsequent handling.

[0077] In this embodiment, the identification of relevant harmful story trees is as follows: Given a new set of harmful events Et = fE1, E2, ..., EjEtjg over a time period t and an existing harmful story forest Ft1 = fS1, S2, ..., SjFt1jg, which has formed the current harmful story forest, a new harmful story tree will be created and added to the harmful story forest. A two-step strategy is used to determine whether a new harmful event E belongs to an existing story tree S. Event E has its own keyword set. Similarly, for an existing story tree S, there is also an associated keyword set CS, which is the union of all keyword sets of events in the tree. The compatibility between event E and story tree S can be calculated by similarity. If the compatibility is greater than a threshold, it is further checked whether at least one document in event E and at least one document in story tree S share n or more common words in their titles (stop words are removed). If so, event E is assigned to story tree S. Otherwise, they are not related; if event E is not related to any existing story tree, a new story tree is created.

[0078] The update-related story tree in this embodiment includes: a story tree A related to the incoming event E, and one of three types of operations to place event E in the tree: merge, expand, or insert. The merge operation merges the new event E into an existing event node in the tree; the expand operation appends event E as a child node to an existing event node in the tree; the insert operation directly appends event E to the root node of story tree S. The system selects the most appropriate operation to handle the incoming event based on the following process: Merge: Merge E with existing events in the tree if they essentially talk about the same event. The relevance of these two events can be checked using a relation classifier; Expand and Insert: If event E does not overlap with any existing events, it will be bound to the parent event node in S to which it should be appended.

[0079] In addition, this application can also recommend and warn about harmful stories: the system sets warning categories and thresholds, and when harmful events are detected, recommendations and warnings can be made to help with timely subsequent handling and improve the purification of the Internet cyberspace.

[0080] The beneficial effects of the method, apparatus, and storage medium for detecting harmful internet events provided in this application are as follows: This application constructs or updates a keyword knowledge graph and divides the knowledge graph into several subgraphs; it uses a clustering algorithm to cluster documents into harmful events; by updating each harmful event, each harmful event is inserted into a harmful story tree, or a new harmful story tree is created based on the harmful event, thus realizing the detection and classification of harmful content in the mobile internet and the internet. The purpose is to discover harmful events from massive amounts of web page and document data, and to organize harmful events in a reasonable harmful story tree online; a two-layer web page and document clustering algorithm based on a knowledge graph is proposed, which extracts harmful events from a large amount of web page text or web page-related news. After new web page and document data arrive, an online algorithm is used to organize the events into a story tree, which is more effective than traditional keyword-based malicious algorithms in extracting harmful events.

[0081] In addition, such as Figure 2 As shown, this application also proposes a device for detecting harmful internet incidents, the device comprising:

[0082] The first module 201 is used to construct or update the keyword knowledge graph and divide the knowledge graph into several subgraphs.

[0083] The second module 202 is used to cluster documents into harmful events using a clustering algorithm;

[0084] The third module 203 is used to insert each harmful event into the harmful story tree by updating each harmful event, or to create a new harmful story tree based on the harmful events;

[0085] The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme.

[0086] In addition, such as Figure 3 As shown, this application also proposes a device for detecting harmful internet incidents, the device comprising:

[0087] At least one processor 301;

[0088] At least one memory 302, the memory 302 being used to store at least one program;

[0089] When at least one of the programs is executed by at least one of the processors 301, the method for detecting harmful Internet events as described in the preceding embodiments is implemented.

[0090] This application also proposes a storage medium storing a processor-executable program that, when executed by a processor, implements the method for detecting harmful Internet events as described in the preceding embodiments.

[0091] The content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0092] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0093] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional technology for an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0094] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0095] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0096] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0097] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0098] In the foregoing description of this specification, the references to terms such as "one embodiment," "another embodiment," or "some embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0099] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

[0100] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting harmful internet incidents, characterized in that, The method includes: Construct or update a keyword knowledge graph and divide the knowledge graph into several subgraphs; Clustering algorithms are used to cluster documents into harmful events; By updating each harmful event, each harmful event is inserted into the harmful story tree, or a new harmful story tree is created based on the harmful events; The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme. The method further includes the following steps before constructing or updating the keyword knowledge graph: Discard documents whose content length is less than the threshold; Use Jieba segmentation to split the title and body of each document; Keyword extraction is performed using a collaborative filtering algorithm; The process of updating each harmful event, inserting each harmful event into the harmful story tree, or creating a new harmful story tree based on harmful events includes: Given a set of harmful events extracted for a specific harmful topic; Multiple stories under the theme of organizing harmful incidents online; Each harmful story is described by a harmful story tree, which represents the evolutionary structure of the harmful story. The method further includes: When updating a harmful event to a harmful story tree, the compatibility between the keyword set of the harmful event and the keyword set of the existing harmful story tree is calculated. When the compatibility is greater than a preset threshold, a further determination is made based on the words in the title of at least one document in the harmful event and at least one document in the harmful story tree. If there are no less than a preset number of shared words, the harmful event is updated into the corresponding harmful story tree; otherwise, it is determined to be irrelevant to the harmful story tree. The harmful story tree is updated by performing one of the following methods: merging, expanding, or inserting. The method of clustering documents into harmful events using clustering algorithms includes: Community detection is performed on the keyword knowledge graph, dividing the keyword knowledge graph into several communities, where each community contains keywords for a specific topic; The strength of each edge in the keyword knowledge graph is measured using the intermediateness score of the edges, where the intermediateness score is the number of shortest paths between all node pairs through the edge. Iteratively remove edges with intermediate scores higher than a preset value to extract communities; Perform a second-level document clustering within each topic to obtain harmful events and their classifications; An SVM classifier is used to determine whether a pair of documents are discussing the same harmful event or whether document features are used as input. The documents in each topic will form a document knowledge graph, which will then be processed using a community detection algorithm.

2. The method for detecting harmful internet events according to claim 1, characterized in that, Document characteristics include the similarity between cosine similarity content and TF vector, the similarity between cosine similarity headings and TF vectors, and the similarity between the first sentence in two documents.

3. The method for detecting harmful internet events according to claim 1, characterized in that, The method also includes recommendations and warnings for harmful story trees, including: Once a harmful event is detected, recommendations and warnings will be issued.

4. A device for detecting harmful internet incidents, characterized in that, The apparatus is used in the method as described in any one of claims 1-3, the apparatus comprising: The first module is used to construct or update the keyword knowledge graph and divide the knowledge graph into several subgraphs. The second module is used to cluster documents into harmful events using clustering algorithms; The third module is used to insert each harmful event into the harmful story tree by updating each harmful event, or to create a new harmful story tree based on the harmful events; The harmful events are harmful web pages or articles, the harmful stories are a collection of several related harmful events, and the harmful story tree is a collection of several harmful stories with the same theme.

5. A device for detecting harmful internet incidents, characterized in that, The device includes: At least one processor; At least one memory for storing at least one program; The method for detecting harmful Internet events as described in any one of claims 1-3 is implemented when at least one of the programs is executed by at least one of the processors.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a processor-executable program that, when executed by the processor, implements the method for detecting harmful Internet events as described in any one of claims 1-3.

Images