Abnormal webpage detection method and device, computer device and storage medium

Abstract

The application relates to an abnormal webpage detection method and device, computer equipment, a storage medium and a computer program product. It relates to the field of artificial intelligence and can be applied to a vehicle-mounted scene. The method comprises the following steps: acquiring image low-dimensional features and image high-dimensional features of each labeled webpage image; matching feature clustering results of the image low-dimensional features with feature clustering results of the image high-dimensional features to obtain a feature clustering result matching pair; determining image clustering results of the labeled webpage images based on the feature clustering result matching pair; and constructing a clustering feature vector of each labeled webpage image, performing abnormal detection on an unlabeled webpage image through the clustering feature vector, and obtaining an abnormal webpage detection result. The application uses a clustering method for differentiating content feature extraction, fuses the image low-dimensional features and the image high-dimensional features, and thus more accurate and rich clustering results are obtained, and the accuracy of abnormal webpage detection based on clustering is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an abnormal webpage detection method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] With the development of computer and web technologies, all sorts of web pages have flooded people's lives. However, due to the openness of the internet, in addition to web pages intended for normal work and study, there are also abnormal web pages containing various illegal information. Identifying and blocking the URLs of these abnormal web pages has become a major challenge for network security.

[0003] Currently, because different websites containing illegal information are often clustered and deployed in the same or nearby Internet Data Centers (IDCs), their hosted addresses tend to cluster. Therefore, by calculating the similarity of website hosting addresses or directly classifying sites hosted under the same address as a group, and using labeled data for diffusion, abnormal webpage detection can be achieved by classifying the samples. However, this method only relies on hosting location for identification and lacks direct and effective judgment criteria, resulting in low accuracy. Summary of the Invention

[0004] Therefore, it is necessary to provide an abnormal webpage detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can effectively improve the accuracy of abnormal webpage detection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting abnormal web pages. The method includes:

[0006] Obtain the low-dimensional and high-dimensional features of each labeled webpage image;

[0007] The feature clustering results of the low-dimensional features of each image are matched with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs;

[0008] Based on the feature clustering result matching pairs, determine the image clustering result for each of the labeled web page images;

[0009] Based on the image clustering results, clustering feature vectors are constructed for each of the labeled web page images. Anomaly detection is then performed on the unlabeled web page images using the clustering feature vectors to obtain the abnormal web page detection results.

[0010] Secondly, this application also provides an abnormal webpage detection device. The device includes:

[0011] The feature extraction module is used to obtain the low-dimensional and high-dimensional features of each labeled webpage image;

[0012] The feature clustering module is used to match the feature clustering results of the low-dimensional features of each image with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs;

[0013] The clustering result matching module is used to determine the image clustering result of each labeled web page image based on the feature clustering result matching pairs;

[0014] The abnormal webpage detection module is used to construct clustering feature vectors for each of the labeled webpage images based on the image clustering results, and to perform anomaly detection on the unlabeled webpage images through the clustering feature vectors to obtain abnormal webpage detection results.

[0015] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0016] Obtain the low-dimensional and high-dimensional features of each labeled webpage image;

[0017] The feature clustering results of the low-dimensional features of each image are matched with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs;

[0018] Based on the feature clustering result matching pairs, determine the image clustering result for each of the labeled web page images;

[0019] Based on the image clustering results, clustering feature vectors are constructed for each of the labeled web page images. Anomaly detection is then performed on the unlabeled web page images using the clustering feature vectors to obtain the abnormal web page detection results.

[0020] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0021] Obtain the low-dimensional and high-dimensional features of each labeled webpage image;

[0022] The feature clustering results of the low-dimensional features of each image are matched with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs;

[0023] Based on the feature clustering result matching pairs, determine the image clustering result for each of the labeled web page images;

[0024] Based on the image clustering results, clustering feature vectors are constructed for each of the labeled web page images. Anomaly detection is then performed on the unlabeled web page images using the clustering feature vectors to obtain the abnormal web page detection results.

[0025] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0026] Obtain the low-dimensional and high-dimensional features of each labeled webpage image;

[0027] The feature clustering results of the low-dimensional features of each image are matched with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs;

[0028] Based on the feature clustering result matching pairs, determine the image clustering result for each of the labeled web page images;

[0029] Based on the image clustering results, clustering feature vectors are constructed for each of the labeled web page images. Anomaly detection is then performed on the unlabeled web page images using the clustering feature vectors to obtain the abnormal web page detection results.

[0030] The aforementioned abnormal webpage detection method, apparatus, computer equipment, storage medium, and computer program product first acquire the low-dimensional and high-dimensional features of each labeled webpage image. Specifically, it first obtains the feature vectors of the webpage image in both high and low dimensions. Then, it matches the feature clustering results of the low-dimensional features with the feature clustering results of the high-dimensional features to obtain feature clustering result matching pairs. This involves clustering the two sets of feature vectors separately to obtain content similarity clustering results. Based on the feature clustering result matching pairs, it determines the image clustering result for each labeled webpage image. By using differentially extracted feature vectors for collaborative clustering, it can effectively obtain cluster categories with similarity from different perspectives. Finally, based on the image clustering results, it constructs clustering feature vectors for each labeled webpage image. These clustering feature vectors are then used to perform anomaly detection on unlabeled webpage images to obtain abnormal webpage detection results. In other words, it uses the labeled clustering feature vectors to perform diffusion detection on unlabeled webpage images. This application employs a clustering method based on differentiated content feature extraction, which integrates low-dimensional and high-dimensional image features during webpage image clustering, thereby obtaining more accurate and richer clustering results and improving the accuracy of abnormal webpage detection based on clustering. Attached Figure Description

[0031] Figure 1 This is a diagram illustrating the application environment of an abnormal webpage detection method in one embodiment.

[0032] Figure 2This is a flowchart illustrating an abnormal webpage detection method in one embodiment;

[0033] Figure 3 This is a schematic diagram of the structure of an autoencoder model in one embodiment;

[0034] Figure 4 This is a schematic diagram of the process for obtaining the best matching pair between classes in one embodiment;

[0035] Figure 5 This is a schematic diagram of the current tag diffusion process in one embodiment;

[0036] Figure 6 This is a schematic diagram illustrating the current tag diffusion detection effect in one embodiment;

[0037] Figure 7 This is a flowchart illustrating a diffusion detection method that combines individual and group characteristics of a sample in one embodiment.

[0038] Figure 8 This is a schematic diagram of a webpage image in one embodiment;

[0039] Figure 9 This is a schematic diagram of the process for detecting abnormal web pages in one embodiment;

[0040] Figure 10 This is a flowchart illustrating the feature extraction and differential iterative clustering process in one embodiment;

[0041] Figure 11 This is a flowchart illustrating an abnormal webpage detection method in another embodiment;

[0042] Figure 12 This is a structural block diagram of an abnormal webpage detection device in one embodiment;

[0043] Figure 13 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] This application relates to Artificial Intelligence (AI) technology. AI is the theory, methods, techniques, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities. AI technology is a comprehensive discipline involving a wide range of fields, encompassing both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly include computer vision, speech processing, natural language processing, and machine learning / deep learning. This application specifically relates to Computer Vision (CV) and Machine Learning (ML) technologies within AI.

[0046] Computer vision is a science that studies how to enable machines to "see." More specifically, it refers to using cameras and computers to replace human eyes in tasks such as target recognition, tracking, and measurement, and then performing image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and common biometric recognition technologies such as facial recognition and fingerprint recognition. Machine learning, on the other hand, is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence. Its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0047] In this article, it is important to understand that the terminology used includes "abnormal webpages," which specifically refers to webpages containing illegal information such as gambling, pornography, and fraud.

[0048] The abnormal webpage detection method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on the cloud or other servers. When a user on terminal 102 needs to detect abnormal web pages, they can submit images of identified abnormal web pages as labeled web page images to server 104. Server 104 constructs clustering feature vectors for each labeled web page image based on the labeled web page images, and then performs diffusion detection based on the clustering feature vectors to determine the abnormal web page detection results for unlabeled web page images. First, server 104 obtains the low-dimensional and high-dimensional features of each labeled web page image; it matches the feature clustering results of each low-dimensional feature with the feature clustering results of each high-dimensional feature to obtain feature clustering result matching pairs; based on the feature clustering result matching pairs, it determines the image clustering results for each labeled web page image; based on the image clustering results, it constructs clustering feature vectors for each labeled web page image, and performs anomaly detection on unlabeled web page images using the clustering feature vectors to obtain abnormal web page detection results. The terminal 102 can be, but is not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0049] In one embodiment, such as Figure 2 As shown, an abnormal webpage detection method is provided. This method can be applied to a server or a terminal. Figure 1 Taking server 104 as an example, the following steps are included:

[0050] Step 201: Obtain the low-dimensional and high-dimensional features of each labeled webpage image.

[0051] Annotated webpage images refer to webpage images whose image type has been labeled. The labeling specifically indicates whether the webpage corresponding to the image is a normal or abnormal webpage, and may also include information such as image content tags. The difference between low-dimensional and high-dimensional image features lies in the number of image details. Low-dimensional image features refer to features with fewer details in the image, such as features related to layout and color. High-dimensional image features refer to features with more details in the image, such as features related to faces or animals.

[0052] Specifically, the applicant discovered that a webpage is a collection of text and image content. Clustering only the text content features of the webpage, ignoring image and layout information, inevitably leads to biased clustering results. Therefore, the applicant uses image information to detect abnormal webpages. Regarding the process of extracting webpage image features, this application requires obtaining the low-dimensional and high-dimensional features of each labeled webpage image. High-dimensional features, such as faces and animals, can be extracted using specific pre-trained models. However, webpage images contain specific content, such as layout, lines, and animations, which are not considered high-dimensional features. Therefore, extracting only high-dimensional features is not well-suited for webpage images. Therefore, this application introduces low-dimensional image features to combine with high-dimensional features for abnormal webpage detection; for example, the layout and color of a webpage are low-dimensional features. In this application's solution, the low-dimensional and high-dimensional features of each labeled webpage image are obtained and combined to achieve abnormal webpage detection. In one embodiment, the low-dimensional image feature extraction in this application is implemented using an autoencoder model in a convolutional neural network manner, such as... Figure 3 As shown, an encoder and decoder are constructed using convolutional neural networks, and unsupervised training is performed on a webpage image dataset using a mean squared loss function. After training, the encoder is used to extract features from the image, resulting in a 2048-dimensional encoded vector. The high-dimensional image features are achieved using a residual model. Specifically, a ResNet50 convolutional neural network is trained using the ImageNet dataset as the training set. The residual model is then used to perform forward propagation on the labeled webpage image, and the output of the 2048 neurons in the layer preceding the output layer is taken as the residual feature vector.

[0053] Step 203: Match the feature clustering results of the low-dimensional features of each image with the feature clustering results of the high-dimensional features of each image to obtain feature clustering result matching pairs.

[0054] Clustering refers to the process of dividing a collection of physical or abstract objects into multiple classes composed of similar objects. A cluster generated by clustering is a set of data objects that are similar to objects within the same cluster and dissimilar to objects in other clusters. Clustering methods include partitioning methods, hierarchical methods, density-based methods, and model-based methods. In one embodiment, this application uses the K-means clustering algorithm from the partitioning methods to perform vector clustering. In other embodiments, this application may use any currently disclosed clustering method instead of the K-means clustering algorithm, such as DBSCAN, spectral clustering, hierarchical clustering, etc.

[0055] Specifically, this application utilizes low-dimensional and high-dimensional image features extracted from web page images. Combining these two features organically can achieve more accurate clustering results. Therefore, this application proposes a clustering method that integrates both features by comparing the differences in clustering results from the two feature extraction methods. During clustering, the low-dimensional and high-dimensional image features are first processed separately to obtain two distinct feature clustering results. Then, the feature clustering results of each low-dimensional image feature are matched with the feature clustering results of each high-dimensional image feature. The purpose of this matching is to find feature clustering results with higher similarity.

[0056] Step 205: Based on the feature clustering result matching pairs, determine the image clustering result of each labeled web page image.

[0057] The image clustering result of labeled web page images refers to assigning each labeled web page image to various image categories, and each image category contains several labeled web page images.

[0058] Specifically, the feature clustering results are matched one-to-one with the low-dimensional and high-dimensional features of the image to obtain matching pairs. The feature clustering results in each matching pair can be further analyzed to determine the category of the feature vectors, thus obtaining the image clustering results of the labeled web page images. In a specific embodiment, collaborative clustering can be used to determine the image clustering results of each labeled web page image, thereby more effectively obtaining categories with similarity from different perspectives. For example, when the similarity between two feature clustering results in a matching pair is high, it is considered that the labeled web page image samples corresponding to the feature clustering results have high similarity from both high-dimensional and low-dimensional feature perspectives, and the clustering is considered complete. In this case, the intersection of the two categories and the samples individually covered by each category are output as categories, resulting in three categories of labeled web page images. Conversely, if the similarity between the matching pairs is low, these two categories are considered outliers from different perspectives, and they are output as separate categories, resulting in two categories of labeled web page images.

[0059] Step 207: Based on the image clustering results, construct clustering feature vectors for each labeled webpage image, and use the clustering feature vectors to perform anomaly detection on the unlabeled webpage images to obtain the anomaly webpage detection results.

[0060] The clustering feature vector of the labeled webpage image refers to the feature vector constructed based on the labeled webpage image for abnormal webpage detection. The clustering feature vector contains the statistical features of the categories included in the image clustering results, as well as the individual information corresponding to each labeled webpage image. It is constructed by fusing the group clustering features and individual features of the webpage images. The unlabeled webpage image refers to the detection target of this application's abnormal webpage detection. This application uses labeled webpage images to predict the type of unlabeled webpage images, determines the labeling type of the unlabeled webpage images, and thus identifies abnormal webpage images among the unlabeled webpage images, obtaining the abnormal webpage detection result.

[0061] Specifically, after obtaining the image clustering results, the type information corresponding to each labeled webpage image can be obtained. Then, based on the annotation content of the labeled webpage images, the correspondence between the image clustering results and the labels in the annotation content is determined, thereby constructing a clustering feature vector for each labeled webpage image. Unlabeled webpage images are then classified using these clustering feature vectors, and the corresponding abnormal webpage detection results are obtained based on the classification results of the unlabeled webpage images. In a specific embodiment, the individual features of the labeled webpage images themselves can also be combined to construct clustering feature vectors for each labeled webpage image. This allows for anomaly detection on unlabeled webpage images based on the clustering feature vectors, yielding abnormal webpage detection results. In a specific embodiment, the process of anomaly detection on unlabeled webpage images using clustering feature vectors can also be implemented using machine learning methods, such as decision tree models. The decision tree model is trained and tested using the clustering feature vectors and the labels of the labeled webpage images as training data. The tested decision tree model is then used as the anomaly detection model; only an unlabeled webpage image needs to be input to obtain the corresponding abnormal webpage detection results.

[0062] The aforementioned abnormal webpage detection method first acquires the low-dimensional and high-dimensional features of each labeled webpage image. Specifically, it first obtains the feature vectors of the webpage image in both high and low dimensions. Then, it matches the feature clustering results of the low-dimensional features with the feature clustering results of the high-dimensional features to obtain feature clustering result matching pairs. This involves clustering the two sets of feature vectors separately to obtain content similarity clustering results. Based on the feature clustering result matching pairs, the image clustering result for each labeled webpage image is determined. By using differentially extracted feature vectors for co-clustering, cluster categories with similarity from different perspectives can be effectively obtained. Finally, based on the image clustering results, clustering feature vectors for each labeled webpage image are constructed. These clustering feature vectors are then used to perform anomaly detection on unlabeled webpage images to obtain the abnormal webpage detection result. In other words, the labeled clustering feature vectors are used to perform diffusion detection on unlabeled webpage images. This application employs a clustering method based on differential content feature extraction, which integrates low-dimensional and high-dimensional image features during webpage image clustering, thereby obtaining more accurate and richer clustering results and improving the accuracy of abnormal webpage detection based on clustering.

[0063] In one embodiment, step 201 includes: extracting low-dimensional image features for each labeled webpage image based on an autoencoder model, and extracting high-dimensional image features for each labeled webpage image based on a residual network model. The autoencoder model is trained using a webpage image dataset, where the webpage images contain low-dimensional image information. The residual network model is trained using a natural image dataset, where the natural images contain high-dimensional image information.

[0064] Among them, an autoencoder (AE) is a type of artificial neural network (ANN) used in semi-supervised and unsupervised learning. Its function is to learn representations of the input information by using the input information as the learning target. In the scheme of this application, an autoencoder can be used to extract low-dimensional features of web page images. The residual model refers to a residual neural network model obtained through pre-training. The pre-training process uses as much training data as possible to extract as many common features as possible, thereby reducing the learning burden of the model on a specific task. In the scheme of this application, a pre-trained model is used to extract high-dimensional features of web page images. The residual neural network is a type of convolutional neural network. It is a very effective network for mitigating the gradient vanishing and gradient exploding problems, greatly increasing the depth of networks that can be effectively trained. The characteristics of the residual neural network are that it is easy to optimize and can improve accuracy by increasing the depth considerably. Its internal residual blocks use skip connections to alleviate the gradient vanishing problem caused by increasing the depth in deep neural networks. Webpage image datasets refer to datasets composed of real webpage images from historical data, which contain low-dimensional image information such as layout and color. Natural image datasets, on the other hand, are datasets composed of natural images that are not webpages, which contain high-dimensional image information such as animals and human faces.

[0065] Specifically, the applicant discovered that a webpage is a collection of text and images. Clustering only the text content features of the webpage, ignoring image and layout information, inevitably leads to biased clustering results. Therefore, the applicant uses image information to detect abnormal webpages. Regarding the process of extracting webpage image features, since the residual model is fully trained on a large-scale natural image dataset, it can fit high-dimensional image features, such as faces and animals. However, webpage images and natural images have inherent differences; many layouts, lines, and animations appearing on webpages are completely absent in natural images. Therefore, the feature extraction of the pre-trained model naturally does not adapt well to webpage images. Therefore, this application introduces an unsupervised learning method using an autoencoder. By training the autoencoder on a webpage image dataset, the encoder can better adapt to webpage image features. Due to the limited size of the image dataset and the limited training time, the encoder fits low-dimensional image features, such as layout and color. Therefore, in the solution of this application, while extracting features from the labeled webpage image based on the autoencoder model to obtain the autoencoder feature vector of the labeled webpage image, a pre-trained residual model is also used to extract features from the labeled webpage image to obtain the residual feature vector of the labeled webpage image. That is, feature extraction processing of webpage images can be achieved by combining the autoencoder model and the pre-trained residual model. In one embodiment, the autoencoder model in the solution of this application is implemented through a convolutional neural network, such as... Figure 3 As shown, an encoder and decoder are constructed using convolutional neural networks, respectively. Unsupervised training is performed on a webpage image dataset using a mean squared loss function. After training, the encoder is used to extract features from the image, obtaining a 2048-dimensional encoded vector. Specifically, a ResNet50 convolutional neural network trained on the ImageNet dataset can be used as the pre-trained residual model to perform forward propagation on the labeled webpage image, taking the output of the 2048 neurons in the layer preceding the output layer as the residual feature vector. In this embodiment, extracting image features using both the autoencoder model and the residual network model effectively ensures the accuracy of low-dimensional and high-dimensional feature extraction, thereby guaranteeing the accuracy of the abnormal webpage detection process.

[0066] In one embodiment, extracting the low-dimensional features of each labeled webpage image based on the autoencoder model includes: performing convolution processing on each labeled webpage image based on the autoencoder model to obtain the autoencoder model feature map of each labeled webpage image; and performing linear rectification and pooling processing on the autoencoder feature map to obtain the low-dimensional features of each labeled webpage image.

[0067] In image processing, convolution refers to performing a series of operations on each pixel of an image using a convolution kernel. The convolution kernel (operator) is a matrix used in image processing, also called a mask, and is a parameter used in operations with the original image. A convolution kernel is typically a square grid structure (e.g., a 3x3 matrix or pixel region), where each square has a weight value. When performing convolution calculations, the center of the kernel is placed on the pixel to be calculated. The kernel's product of each element and the image pixel value it covers is calculated and summed; the resulting structure is the new pixel value at that location. Linear rectification processing refers to processing the autoencoder feature map using a rectified linear unit (ReLU). The rectified linear unit, also known as a modified linear unit, is a commonly used activation function in artificial neural networks, typically referring to nonlinear functions such as the ramp function and its variants. Pooling, on the other hand, mimics the human visual system's ability to reduce the dimensionality of data. Pooling operations are also commonly referred to as subsampling or downsampling. Specifically, the scheme in this application uses max pooling to process the linearly rectified autoencoder feature map, obtaining low-dimensional image features.

[0068] Specifically, the autoencoder model in this application can be implemented using an autoencoder convolutional neural network model. For the process of extracting low-dimensional features from images using the autoencoder model, it is necessary to first perform convolution processing on each labeled webpage image based on the convolution kernels trained in the autoencoder model to obtain the autoencoder model feature map for each labeled webpage image. Then, the autoencoder feature map is linearly rectified and pooled using the linear rectified layer and pooling layer in the autoencoder model, respectively, to obtain the low-dimensional features of each labeled webpage image. In a specific embodiment, the solution of this application also includes a training process for the autoencoder model, which is implemented through unsupervised learning. The server can acquire webpage images from historical data and construct a webpage image dataset. Based on the webpage image dataset, model training data and model testing data are constructed to complete the training of the autoencoder model. In this embodiment, using an autoencoder model to perform convolution processing on labeled webpage images can effectively complete the extraction of low-dimensional image features, ensuring the effectiveness of the low-dimensional image features.

[0069] In one embodiment, extracting the high-dimensional features of each labeled webpage image based on the residual network model includes: performing convolution processing on each labeled webpage image based on the residual network model to obtain the residual model feature map of each labeled webpage image; and performing pooling and fully connected processing on the residual feature map to obtain the high-dimensional features of each labeled webpage image.

[0070] Among them, fully connected processing refers to weighting the feature maps obtained after convolution and pooling to obtain the final high-dimensional features.

[0071] Specifically, the process of extracting high-dimensional features from images using a residual network model involves first performing convolutional processing on each labeled webpage image based on the convolutional kernels trained in the residual network model to obtain the autoresidual model feature map for each labeled webpage image. Then, pooling and fully connected layers in the autoencoder model are used to perform pooling and fully connected processing on the autoencoder feature map, respectively, to obtain the high-dimensional features of each labeled webpage image. In a specific embodiment, the residual network model in this application is specifically ResNet50, and the scheme also includes a training process for the residual network model, which is implemented through supervised pre-training. The server can acquire natural images from historical data and construct a labeled natural image dataset. Based on the natural image dataset, model training data and model testing data are constructed to complete the training of the autoencoder model. In this embodiment, using a residual network model to perform convolutional processing on labeled webpage images can effectively extract high-dimensional features from the images, ensuring the effectiveness of the high-dimensional features.

[0072] In one embodiment, step 203 includes: calculating the similarity between each cluster category in the feature clustering results of each low-dimensional feature of the image and each cluster category in the feature clustering results of the high-dimensional feature of the image, to obtain a similarity matrix between the feature clustering results; extracting the best matching pair between the feature clustering results of the low-dimensional feature of the image and the feature clustering results of the high-dimensional feature of the image from the similarity matrix, to obtain each clustering result matching pair, wherein the best matching pair is the matching pair with the highest similarity.

[0073] The similarity calculation of cluster categories can be achieved through the interaction ratio. For a feature clustering result A of low-dimensional image features and a feature clustering result B of high-dimensional image features, for any category in A, the similarity between it and every category in B can be calculated using the interaction ratio. The similarity matrix is ​​a matrix constructed from the similarities between A and B. The rows and columns of the matrix represent A and B, respectively, and the elements of the matrix are the similarities between the two.

[0074] Specifically, the matching pair identification process in this application can be achieved by combining matching degree with a similarity matrix. First, the similarity is calculated between each cluster category in the feature clustering results of each image's low-dimensional features and each cluster category in the feature clustering results of the image's high-dimensional features, resulting in a similarity matrix between the feature clustering results. In a specific embodiment, the intersection sample size and union sample size between each cluster category in the feature clustering results of each image's low-dimensional features and each cluster category in the feature clustering results of the image's high-dimensional features are determined. Based on the ratio of the intersection sample size to the union sample size, the similarity value between each cluster category in the feature clustering results of each image's low-dimensional features and each cluster category in the feature clustering results of the image's high-dimensional features is determined. Each cluster category in the feature clustering results of each image's low-dimensional features and each cluster category in the feature clustering results of the image's high-dimensional features are used as the rows and columns of the similarity matrix, respectively. The similarity values ​​are used as elements of the similarity matrix to obtain the similarity matrix. The corresponding calculation method can be implemented using the following formula:

[0075]

[0076] Where I represents the sample size of the intersection of two feature clustering results, and U represents the sample size of the union of two feature clustering results. After calculating the similarity, a corresponding similarity matrix can be established. For example, for feature clustering result A of low-dimensional image features with 5 cluster categories and feature clustering result B of high-dimensional image features, a 5x5 matrix can be constructed as the similarity matrix. Then, in the obtained similarity matrix, the best matching pairs of feature clustering results of low-dimensional image features and feature clustering results of high-dimensional image features are extracted sequentially to obtain each clustering result matching pair. In this embodiment, by determining the similarity and constructing the similarity matrix, the matching pairs of each clustering result corresponding to the feature clustering results can be effectively identified, ensuring the accuracy of clustering matching.

[0077] In one embodiment, the best matching pairs of feature clustering results of low-dimensional features of the image and feature clustering results of high-dimensional features of the image are sequentially extracted from the similarity matrix to obtain each clustering result matching pair. This includes: extracting the best matching pairs of feature clustering results of low-dimensional features of the image and feature clustering results of high-dimensional features of the image from the similarity matrix; setting the similarity of the feature clustering results containing the best matching pairs in the similarity matrix to zero, and then extracting the best matching pairs of feature clustering results of low-dimensional features of the image and feature clustering results of high-dimensional features of the image from the similarity matrix again, until all parameters of the similarity matrix are set to zero.

[0078] Specifically, the process of extracting matching pairs from the similarity matrix involves sequentially extracting the pair of categories with the highest similarity from the similarity matrices of the two calculated clustering results. These two categories are then considered the best inter-class match, forming a matching pair. These two categories are then removed from the global matching process and no longer participate in matching; that is, their similarity to other categories in the similarity matrix is ​​set to 0. In one embodiment, the process of constructing matching pairs based on the similarity matrix can be described as follows: Figure 4 As shown, step three is repeated until all elements in the similarity matrix are set to zero, meaning all categories have been matched. At this point, the clustering result matching pairs corresponding to the number of feature clustering results are obtained. In this embodiment, by sequentially extracting the best matching pairs and setting the similarity to zero, the accuracy of clustering matching can be guaranteed.

[0079] In one embodiment, step 205 includes: when the similarity of the clustering result matching pairs is higher than or equal to the similarity threshold, taking the intersection between the feature clustering results and the part of the feature clustering results excluding the intersection as the clustering result of the labeled web page image; when the similarity of the clustering result matching pairs is lower than the similarity threshold, taking the feature clustering result of the low-dimensional features of the image and the feature clustering result of the high-dimensional features of the image as the clustering result of the labeled web page image.

[0080] Specifically, after obtaining feature matching pairs, it is necessary to classify the labeled web page images based on the feature matching pairs to obtain the cluster categories corresponding to the labeled web page images. If the similarity of the clustering result matching pairs is higher than or equal to the similarity threshold, it indicates that these samples have high similarity from the perspectives of high-dimensional, natural features, and low-dimensional, web page features, and the clustering is considered complete. Therefore, the intersection of the feature clustering results and the portion of the feature clustering results excluding the intersection are taken as the clustering results of the labeled web page images. The intersection of the feature clustering results and the samples individually covered by each are output as categories. If the similarity of the clustering result matching pairs is lower than the similarity threshold, these two categories are considered outliers from different perspectives, and these two categories are output as separate categories. The feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image are taken as the clustering results of the labeled web page images. It is worth noting that the similarity threshold in this embodiment can be determined experimentally using historical data based on the required recognition accuracy. In one embodiment, cases with low similarity between matching pairs can be categorized and discussed. Only when the similarity between matching pairs is low and the sample size of each category is very small are the two categories considered outliers from different perspectives, and these two categories are output as separate categories. For matching pairs with low similarity and a large sample size, they are considered not yet fully clustered, and these samples are returned to the iteration for re-clustering until all matching pairs have completed the judgment process, resulting in the image clustering results for all labeled web page images. In this embodiment, a similarity threshold is used to identify matching pairs of different types of clustering results, thereby accurately completing the category analysis processing of labeled web page images and ensuring the accuracy of abnormal web page detection.

[0081] In one embodiment, step 207 includes: constructing a group feature vector based on the category information of each webpage image category in the image clustering results; constructing a sample individual feature vector based on the individual information of each webpage image in each webpage image category; constructing a webpage feature vector for each webpage image based on the group feature vector and the sample individual feature vector; performing anomaly detection on unlabeled webpage images based on the webpage feature vectors to identify abnormal webpage images in the unlabeled webpage images; and obtaining anomaly webpage detection results based on the abnormal webpage images.

[0082] The category information for webpage images includes statistics such as class size, average intra-class distance, and the dominant tag type and its quantity. The feature vector constructed based on this information is the group feature vector. The individual information for each webpage image includes features extracted from information such as the IP address of the corresponding URL and its registration details. The webpage feature vector for each image is a single feature vector constructed by concatenating the group feature vector and the individual feature vectors.

[0083] Specifically, the applicant found that current methods generally involve diffusion through already labeled samples on the clustering results. For example... Figure 5 As shown, this method specifically calculates the number and proportion of each label in each cluster. When a certain label has the most occurrences and its statistical information reaches a certain threshold, the entire cluster is assigned to that label. However, this method only uses the group information of the clusters and does not consider the individual information of each sample point. Furthermore, this method has relatively strict diffusion conditions, requiring the presence of an audit label in the cluster category and reaching a certain threshold. In scenarios with a large total sample size and a small audit sample size, traditional methods suffer from poor accuracy and low coverage. In a specific embodiment, such as... Figure 6 As shown, in actual business testing, clustering results of 300,000 webpage image samples were used to spread the data using 8,000 review tags. Only 17% of all clusters contained review tags, and of these, only 28% reached the spread threshold. Overall, only 40,000 samples were spread, with an accuracy of only 75%. This application proposes a spread detection method that combines individual and group characteristics of samples. It integrates group and individual information from sample clustering, and is not limited by spread conditions, thus achieving better accuracy and coverage. First, a group feature vector is constructed based on the category information of each webpage image category in the clustering results. Then, a sample individual feature vector is constructed based on the individual information of each webpage image within each category. Next, a webpage feature vector is constructed for each webpage image based on the group feature vector and the sample individual feature vector. Finally, anomaly detection can be performed on unlabeled webpage images based on the webpage feature vectors to identify abnormal webpage images among the unlabeled images. In one embodiment, as shown in the table below, when performing diffusion on the same cluster of 300,000 webpage image data, the existing scheme can diffuse the sample size from 40,000 hints to the full 300,000, while the accuracy of the diffusion results increases from 75.6% to 89.9%, an improvement of 14 percentage points, indicating that the existing scheme has better diffusion detection performance.

[0084] Table 1: Accuracy Comparison of the Applicable Solution and Existing Technical Solutions

[0085] The technical solution of this application 30w 89.9％ Existing technical solutions 4w 75.6％

[0086] In one embodiment, anomaly detection of unlabeled webpage images based on webpage feature vectors, identifying anomalous webpage images among unlabeled webpage images, includes: constructing model training data based on the label information and webpage feature vectors corresponding to each webpage image, where the label information indicates the webpage type of the labeled webpage image, and the webpage type includes normal webpages and anomalous webpages; training an initial decision tree using the model training data to obtain an anomaly detection model; and identifying anomalous webpage images among unlabeled webpage images based on the anomaly detection model.

[0087] Decision trees, based on the known probabilities of various scenarios, are used to calculate the probability that the expected net present value is greater than or equal to zero. This method assesses project risk and determines its feasibility, and is a graphical approach that intuitively applies probability analysis. Because the decision branches resemble the branches of a tree, it is called a decision tree. In machine learning, a decision tree is a predictive model that represents a mapping between object attributes and object values.

[0088] Specifically, such as Figure 7 As shown, based on the fused webpage feature vector, to more accurately detect abnormal webpage images from unlabeled webpage images, a decision tree model can be constructed and trained. This model is used to identify abnormal webpage images. First, model training data is constructed based on the label information and webpage feature vector corresponding to each webpage image. The label information in the model training data consists of manually reviewed labels, which include the webpage type of the labeled webpage image, indicating whether the current labeled webpage image is normal or abnormal. Then, the initial decision tree is trained using the model training data to obtain an anomaly detection model. The trained decision tree model is then used to predict on unlabeled webpage images. The resulting decision tree prediction is the label of the unlabeled webpage image, thus identifying abnormal webpage images among numerous unlabeled webpage images. In this embodiment, using a decision tree model to achieve anomaly detection of unlabeled webpage images effectively ensures the accuracy of identifying abnormal webpage images, thereby guaranteeing the accuracy of abnormal webpage detection.

[0089] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0090] This application also provides an application scenario in which the above-described abnormal webpage detection method is applied.

[0091] Specifically, the application of this abnormal webpage detection method in this application scenario is as follows:

[0092] When developing a browser application, users sometimes need to detect and block abnormal web pages to ensure user information security. In this case, users can use the abnormal web page detection method described in this application to detect abnormal web pages. This process requires users to first obtain web page images and natural images, constructing separate datasets for web page images and natural images. For details on web page images, please refer to [reference needed]. Figure 8 As shown. After constructing the webpage image dataset and the natural image dataset, the autoencoder model can be trained using the webpage image dataset, and the residual network model can be trained using the natural image dataset. Then, another batch of webpage images undergoes manual annotation. The process for anomaly webpage detection can be referenced... Figure 9 As shown, the process specifically includes three steps: feature extraction, differential iterative clustering, and a diffusion detection method that combines individual and group features of the samples. For the feature extraction and differential iterative clustering steps, refer to... Figure 10As shown, firstly, low-dimensional features of each labeled webpage image are extracted based on an autoencoder model, and high-dimensional features of each labeled webpage image are extracted based on a residual network model. The extracted features are then clustered to obtain cluster A and cluster B. Next, the similarity between each cluster category in the low-dimensional feature clustering results and each cluster category in the high-dimensional feature clustering results is calculated to obtain a similarity matrix between the feature clustering results. From the similarity matrix, the best matching pairs between the low-dimensional and high-dimensional feature clustering results are extracted. Finally, the similarity of the feature clustering results containing the best matching pairs in the similarity matrix is ​​set to zero, and the similarity is calculated again from the similarity matrix. In the similarity matrix, the best matching pairs of the feature clustering results of low-dimensional features of the image and the feature clustering results of high-dimensional features of the image are extracted until all parameters of the similarity matrix are set to zero. When the similarity of the matching pairs of clustering results is higher than or equal to the similarity threshold, the intersection between the feature clustering results and the part of the feature clustering results excluding the intersection are taken as the clustering results of the labeled web page images. When the similarity of the matching pairs of clustering results is lower than the similarity threshold and the sample size is small, the feature clustering results of low-dimensional features of the image and the feature clustering results of high-dimensional features of the image are taken as the clustering results of the labeled web page images. When the similarity of the matching pairs of clustering results is lower than the similarity threshold and the sample size is large, these samples are returned, and the clustering is re-aggregated after iteration until all matching pairs of clustering results are obtained. For diffusion detection methods that combine individual and group features, it is necessary to first construct a group feature vector based on the category information of each webpage image category in the image clustering results, and then construct a sample individual feature vector based on the individual information of each webpage image in each webpage image category. Based on the group feature vector and the sample individual feature vector, a webpage feature vector for each webpage image is constructed. This allows for the construction of model training data based on the label information and webpage feature vector corresponding to each webpage image. The label information indicates the webpage type of the labeled webpage image, including normal webpages and abnormal webpages. The initial decision tree is then trained using the model training data to obtain an anomaly detection model. The anomaly detection model is used to identify abnormal webpage images among the unlabeled webpage images, and finally, the anomaly webpage detection result is obtained based on the abnormal webpage images.

[0093] In one specific embodiment, this application also provides an abnormal webpage detection method, the flowchart of which can be referred to. Figure 11As shown, the process includes the following steps: Step 1102: Extract low-dimensional features of each labeled webpage image based on an autoencoder model, and extract high-dimensional features of each labeled webpage image based on a residual network model. Step 1104: Calculate the similarity between each cluster category in the feature clustering results of the low-dimensional features of each image and each cluster category in the feature clustering results of the high-dimensional features of the image, obtaining a similarity matrix between the feature clustering results. Step 1106: Extract the best matching pair between the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image from the similarity matrix. Step 1108: After setting the similarity of the feature clustering results containing the best matching pair in the similarity matrix to zero, extract the best matching pair between the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image again from the similarity matrix, until all parameters of the similarity matrix are set to zero. Step 1110: Construct a group feature vector based on the category information of each webpage image category in the image clustering results, and construct a sample individual feature vector based on the individual information of each webpage image in each webpage image category. Step 1112: Construct a webpage feature vector for each webpage image based on the group feature vector and the individual sample feature vectors. Step 1114: Construct model training data based on the label information and webpage feature vector corresponding to each webpage image. The label information indicates the webpage type of the labeled webpage image, including normal webpages and abnormal webpages. Step 1116: Train the initial decision tree using the model training data to obtain the anomaly detection model. Step 1118: Identify abnormal webpage images among the unlabeled webpage images based on the anomaly detection model. Step 1120: Obtain the abnormal webpage detection result based on the abnormal webpage images.

[0094] Based on the same inventive concept, this application also provides an abnormal webpage detection device for implementing the abnormal webpage detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the abnormal webpage detection device provided below can be found in the limitations of the abnormal webpage detection method described above, and will not be repeated here.

[0095] In one embodiment, such as Figure 12 As shown, an abnormal webpage detection device is provided, comprising:

[0096] The feature extraction module 1201 is used to obtain the low-dimensional and high-dimensional features of each labeled web page image.

[0097] The feature clustering module 1203 is used to match the feature clustering results of low-dimensional features of each image with the feature clustering results of high-dimensional features of each image to obtain feature clustering result matching pairs.

[0098] The clustering result matching module 1205 is used to determine the image clustering results of each labeled web page image based on the feature clustering result matching pairs.

[0099] The abnormal webpage detection module 1207 is used to construct clustering feature vectors for each labeled webpage image based on the image clustering results, and to perform anomaly detection on unlabeled webpage images through the clustering feature vectors to obtain abnormal webpage detection results.

[0100] In one embodiment, the feature extraction module 1201 is specifically used to: extract low-dimensional image features of each labeled web page image based on an autoencoder model, and extract high-dimensional image features of each labeled web page image based on a residual network model. The autoencoder model is trained on a web page image dataset, in which the web page images contain low-dimensional image information. The residual network model is trained on a natural image dataset, in which the natural images contain high-dimensional image information.

[0101] In one embodiment, the feature extraction module 1201 is further configured to: perform convolution processing on each labeled webpage image based on the autoencoder model to obtain an autoencoder model feature map of each labeled webpage image; and perform linear rectification and pooling processing on the autoencoder feature map to obtain low-dimensional image features of each labeled webpage image.

[0102] In one embodiment, the feature extraction module 1201 is further configured to: perform convolution processing on each labeled webpage image based on the residual network model to obtain the residual model feature map of each labeled webpage image; and perform pooling and fully connected processing on the residual feature map to obtain the high-dimensional image features of each labeled webpage image.

[0103] In one embodiment, the feature clustering module 1203 is specifically used to: calculate the similarity between each cluster category in the feature clustering results of each low-dimensional feature of the image and each cluster category in the feature clustering results of the high-dimensional feature of the image, to obtain a similarity matrix between the feature clustering results; and extract the best matching pair between the feature clustering results of the low-dimensional feature of the image and the feature clustering results of the high-dimensional feature of the image from the similarity matrix to obtain each clustering result matching pair.

[0104] In one embodiment, the feature clustering module 1203 is specifically used to: determine each cluster category in the feature clustering results of each low-dimensional image feature, the number of intersection samples and the number of union samples between each cluster category and each cluster category in the feature clustering results of the high-dimensional image feature; based on the ratio of the number of intersection samples to the number of union samples, determine the similarity value between each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of the high-dimensional image feature; each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of the high-dimensional image feature are respectively used as rows and columns of the similarity matrix, and the similarity values ​​are used as elements of the similarity matrix to obtain the similarity matrix.

[0105] In one embodiment, the feature clustering module 1203 is further configured to: extract the best matching pair between the feature clustering results of low-dimensional features of the image and the feature clustering results of high-dimensional features of the image from the similarity matrix; after setting the similarity of the feature clustering results containing the best matching pair in the similarity matrix to zero, extract the best matching pair between the feature clustering results of low-dimensional features of the image and the feature clustering results of high-dimensional features of the image from the similarity matrix again, until all parameters of the similarity matrix are set to zero.

[0106] In one embodiment, the clustering result matching module 1205 is used to: when the similarity of the clustering result matching pairs is higher than or equal to the similarity threshold, take the intersection between the feature clustering results and the part of the feature clustering results excluding the intersection as the clustering result of the labeled web page image; when the similarity of the clustering result matching pairs is lower than the similarity threshold, take the feature clustering result of the low-dimensional features of the image and the feature clustering result of the high-dimensional features of the image as the clustering result of the labeled web page image.

[0107] In one embodiment, the abnormal webpage detection module 1207 is specifically used to: construct a group feature vector based on the category information of each webpage image category in the image clustering results; construct a sample individual feature vector based on the individual information of each webpage image in each webpage image category; construct a webpage feature vector for each webpage image based on the group feature vector and the sample individual feature vector; perform anomaly detection on unlabeled webpage images based on the webpage feature vector, and identify abnormal webpage images in the unlabeled webpage images; and obtain abnormal webpage detection results based on the abnormal webpage images.

[0108] In one embodiment, the abnormal webpage detection module 1207 is further configured to: construct model training data based on the label information and webpage feature vector corresponding to each webpage image, wherein the label information is used to indicate the webpage type of the labeled webpage image, and the webpage type includes normal webpages and abnormal webpages; train the initial decision tree through the model training data to obtain an anomaly detection model; and identify abnormal webpage images in unlabeled webpage images based on the anomaly detection model.

[0109] Each module in the aforementioned abnormal webpage detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0110] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 13 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to abnormal webpage detection. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an abnormal webpage detection method.

[0111] Those skilled in the art will understand that Figure 13 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0112] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0113] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0114] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0115] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0116] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0117] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting abnormal web pages, characterized in that, The method includes: Obtain the low-dimensional and high-dimensional features of each labeled webpage image; The process involves determining each cluster category in the feature clustering results of each low-dimensional image feature, the intersection sample size with each cluster category in the feature clustering results of each high-dimensional image feature, and the union sample size. Based on the ratio of the intersection sample size to the union sample size, the similarity value between each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of each high-dimensional image feature is determined. Each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of each high-dimensional image feature are used as rows and columns of a similarity matrix. The similarity values ​​are used as elements of the similarity matrix to obtain a similarity matrix. From the similarity matrix, the best matching pairs between the feature clustering results of the low-dimensional image feature and the feature clustering results of the high-dimensional image feature are extracted sequentially to obtain each clustering result matching pair. The best matching pair is the matching pair with the highest similarity. Based on the feature clustering result matching pairs, determine the image clustering result for each of the labeled web page images; Based on the image clustering results, clustering feature vectors are constructed for each of the labeled web page images. Anomaly detection is then performed on the unlabeled web page images using the clustering feature vectors to obtain the abnormal web page detection results.

2. The method according to claim 1, characterized in that, The process of obtaining the high-dimensional and low-dimensional features of each labeled webpage image includes: The autoencoder model extracts low-dimensional image features for each labeled webpage image, and the residual network model extracts high-dimensional image features for each labeled webpage image. The autoencoder model is trained on a webpage image dataset containing low-dimensional image information, and the residual network model is trained on a natural image dataset containing high-dimensional image information.

3. The method according to claim 2, characterized in that, The extraction of low-dimensional image features for each labeled webpage image based on the autoencoder model includes: Each labeled webpage image is convolved based on an autoencoder model to obtain an autoencoder model feature map for each labeled webpage image. The feature map of the autoencoder model is subjected to linear rectification and pooling to obtain the low-dimensional image features of each labeled web page image.

4. The method according to claim 2, characterized in that, The extraction of high-dimensional image features for each labeled webpage image based on the residual network model includes: Each labeled webpage image is convolved based on a residual network model to obtain a residual model feature map for each labeled webpage image. The residual model feature map is subjected to pooling and fully connected processing to obtain the high-dimensional image features of each labeled web page image.

5. The method according to claim 1, characterized in that, The step of sequentially extracting the best matching pairs of the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image from the similarity matrix, and obtaining each clustering result matching pair includes: From the similarity matrix, extract the best matching pair between the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image; After setting the similarity of the feature clustering results containing the best matching pair in the similarity matrix to zero, the best matching pair of the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image is extracted from the similarity matrix again, until all parameters of the similarity matrix are set to zero.

6. The method according to claim 5, characterized in that, The process of determining the image clustering results for each labeled webpage image based on the feature clustering result matching pairs includes: When the similarity of the clustering result matching pairs is higher than or equal to the similarity threshold, the intersection between the feature clustering results and the part of the feature clustering results excluding the intersection are taken as the clustering result of the labeled web page image; When the similarity of the clustering result matching pair is lower than the similarity threshold, the feature clustering result of the low-dimensional features of the image and the feature clustering result of the high-dimensional features of the image are used as the clustering result of the labeled web page image.

7. The method according to any one of claims 1 to 6, characterized in that, Based on the image clustering results, clustering feature vectors are constructed for each of the labeled webpage images. Anomaly detection is then performed on unlabeled webpage images using these clustering feature vectors to obtain anomaly detection results, including: A group feature vector is constructed based on the category information of each webpage image category in the image clustering results, and a sample individual feature vector is constructed based on the individual information of each webpage image in each webpage image category. The webpage feature vector for each webpage image is constructed based on the group feature vector and the sample individual feature vector; Anomaly detection is performed on unlabeled webpage images based on the webpage feature vectors to identify abnormal webpage images in the unlabeled webpage images; The abnormal webpage detection result is obtained based on the abnormal webpage image.

8. The method according to claim 7, characterized in that, The step of performing anomaly detection on unlabeled webpage images based on the webpage feature vector, and identifying abnormal webpage images in unlabeled webpage images, includes: Based on the tag information corresponding to each webpage image and the webpage feature vector, model training data is constructed. The tag information is used to indicate the webpage type of the labeled webpage image. The webpage type includes normal webpages and abnormal webpages. The initial decision tree is trained using the model training data to obtain the anomaly detection model; The anomaly detection model is used to identify abnormal web page images in unlabeled web page images.

9. An abnormal webpage detection device, characterized in that, The device includes: The feature extraction module is used to obtain the low-dimensional and high-dimensional features of each labeled webpage image; A feature clustering module is used to determine each cluster category in the feature clustering results of each low-dimensional image feature, the intersection sample size and the union sample size between each cluster category and each cluster category in the feature clustering results of the high-dimensional image feature; based on the ratio of the intersection sample size to the union sample size, determine the similarity value between each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of the high-dimensional image feature; each cluster category in the feature clustering results of each low-dimensional image feature and each cluster category in the feature clustering results of the high-dimensional image feature are respectively used as rows and columns of a similarity matrix, and the similarity values ​​are used as elements of the similarity matrix to obtain a similarity matrix; from the similarity matrix, the best matching pairs between the feature clustering results of the low-dimensional image feature and the feature clustering results of the high-dimensional image feature are extracted sequentially to obtain each clustering result matching pair, and the best matching pair is the matching pair with the highest similarity; The clustering result matching module is used to determine the image clustering result of each labeled web page image based on the feature clustering result matching pairs; The abnormal webpage detection module is used to construct clustering feature vectors for each of the labeled webpage images based on the image clustering results, and to perform anomaly detection on the unlabeled webpage images through the clustering feature vectors to obtain abnormal webpage detection results.

10. The apparatus according to claim 9, characterized in that, The feature extraction module is specifically used to: extract low-dimensional image features for each labeled webpage image based on an autoencoder model, and extract high-dimensional image features for each labeled webpage image based on a residual network model. The autoencoder model is trained using a webpage image dataset, in which the webpage images contain low-dimensional image information. The residual network model is trained using a natural image dataset, in which the natural images contain high-dimensional image information.

11. The apparatus according to claim 10, characterized in that, The feature extraction module is further configured to: perform convolution processing on each of the labeled web page images based on the autoencoder model to obtain an autoencoder model feature map of each of the labeled web page images; and perform linear rectification and pooling processing on the autoencoder model feature map to obtain low-dimensional image features of each of the labeled web page images.

12. The apparatus according to claim 10, characterized in that, The feature extraction module is further configured to: perform convolution processing on each labeled webpage image based on the residual network model to obtain the residual model feature map of each labeled webpage image; and perform pooling and fully connected processing on the residual model feature map to obtain the high-dimensional image features of each labeled webpage image.

13. The apparatus according to claim 9, characterized in that, The feature clustering module is further configured to: extract the best matching pair between the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image from the similarity matrix; after setting the similarity of the feature clustering results containing the best matching pair in the similarity matrix to zero, extract the best matching pair between the feature clustering results of the low-dimensional features of the image and the feature clustering results of the high-dimensional features of the image from the similarity matrix again, until all parameters of the similarity matrix are set to zero.

14. The apparatus according to claim 13, characterized in that, The clustering result matching module is used to: when the similarity of the clustering result matching pairs is higher than or equal to the similarity threshold, take the intersection between the feature clustering results and the part of the feature clustering results excluding the intersection as the clustering result of the labeled web page image; when the similarity of the clustering result matching pairs is lower than the similarity threshold, take the feature clustering result of the low-dimensional features of the image and the feature clustering result of the high-dimensional features of the image as the clustering result of the labeled web page image.

15. The apparatus according to any one of claims 9 to 14, characterized in that, The abnormal webpage detection module is specifically used for: constructing a group feature vector based on the category information of each webpage image category in the image clustering results; constructing a sample individual feature vector based on the individual information of each webpage image in each webpage image category; constructing a webpage feature vector for each webpage image based on the group feature vector and the sample individual feature vector; and performing anomaly detection on unlabeled webpage images based on the webpage feature vector to identify abnormal webpage images in the unlabeled webpage images. The abnormal webpage detection result is obtained based on the abnormal webpage image.

16. The apparatus according to claim 15, characterized in that, The abnormal webpage detection module is further configured to: construct model training data based on the label information corresponding to each webpage image and the webpage feature vector, wherein the label information is used to indicate the webpage type of the labeled webpage image, and the webpage type includes normal webpages and abnormal webpages; train an initial decision tree using the model training data to obtain an anomaly detection model; and identify abnormal webpage images in unlabeled webpage images based on the anomaly detection model.

17. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

19. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images