Risk data identification method and device, computer device and storage medium

Abstract

The application provides a risk data identification method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining page object information of at least one page in a to-be-identified document; in the case that the page object information comprises first object information, identifying whether the risk identifier is contained in the corresponding page based on the first object information; wherein the first object information is used to display an image in the to-be-identified document; if the risk identifier is contained in the page, the to-be-identified document to which the page belongs is regarded as risk data, and risk early warning processing is performed on the risk data. By using the application, the identification accuracy of the risk data can be improved, and a more reliable identification result can be obtained.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data processing technology, and in particular to a risk data identification method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the development of digital technology, more and more documents are being converted to PDF format for storage and sharing. To ensure document copyright, many documents add copyright or confidentiality notices, such as watermarks, to indicate the document's source, copyright information, etc., and to prevent the document from being used maliciously.

[0003] As a result, when many enterprises or organizations use shared documents on the Internet to complete project analysis tasks, they will inevitably obtain documents with the above-mentioned tags. However, due to the large amount of data, they cannot efficiently filter them out. Even if image analysis methods or simple document structure analysis methods are used, they cannot detect specific types of tags, or they can only detect documents with fixed formats or tags with fixed positions, which cannot be used for diversified batch detection. Summary of the Invention

[0004] The purpose of this invention is to provide a risk data identification method, apparatus, computer equipment, and storage medium, which combines image processing technology and computer vision technology to analyze the document structure of PDF documents and achieve high-precision detection of risk data in diverse PDF documents.

[0005] In a first aspect, the present invention provides a risk data identification method, comprising:

[0006] Obtain page object information for at least one page in the document to be identified;

[0007] When the page object information includes first object information, the risk label is identified based on the first object information; wherein, the first object information is used to display the image in the document to be identified.

[0008] If the page contains a risk indicator, the document to which the page belongs will be treated as risk data for risk warning processing.

[0009] In some embodiments of the present application, in the case that the page object information includes the first object information, whether the corresponding page contains a risk identifier is identified based on the first object information, including: in the case that the page object information includes the first object information, determining the similarity between the first object information and a preset risk picture to identify whether the page contains a risk identifier; if it is determined based on the similarity that the page does not contain a risk identifier, determining whether the corresponding page object information also includes second object information; in the case that the page object information also includes the second object information, identifying whether the page contains a risk identifier based on the first object information and the second object information; wherein the second object information is used to load a clickable link in the to-be-identified document.

[0010] In some embodiments of the present application, in the case that the page object information includes the first object information, the similarity between the first object information and a preset risk picture is determined to identify whether the page contains a risk identifier, including: in the case that the page object information includes the first object information, obtaining first image features of the first object information; obtaining second image features of the preset risk picture; determining a similarity value between the first image features and the second image features based on a preset algorithm; wherein the preset algorithm includes a KD tree-based approximate nearest neighbor search algorithm; if the similarity value is greater than or equal to a preset similarity threshold, it is determined that the page contains a risk identifier.

[0011] In some embodiments of the present application, in the case that the page object information includes the first object information, the first image features of the first object information are obtained, including: in the case that the page object information includes the first object information, extracting key point information and feature descriptors of the first object information; performing histogram equalization processing on the first object information based on the key point information and the feature descriptors to obtain the first image features.

[0012] In some embodiments of the present application, in the case that the page object information also includes the second object information, whether the page contains a risk identifier is identified based on the first object information and the second object information, including: in the case that the page object information also includes the second object information, obtaining first object position information of the first object information in the page and obtaining second object position information of the second object information in the page; analyzing the first object position information and the second object position information to identify whether the page contains a risk identifier.

[0013] In some embodiments of the present application, the first object position information and the second object position information are analyzed to identify whether the page contains a risk identifier, including: analyzing the first object position information and the second object position information to determine whether the first object information and the second object information are bound to each other; if it is determined that the first object information and the second object information are bound to each other, it is determined that the page contains a risk identifier.

[0014] In some embodiments of the present application, the first object position information and the second object position information are analyzed to determine whether the first object information and the second object information are bound to each other, including: analyzing the first object position information and the second object position information to determine whether the first object information and the second object information have an area overlap in the page; if the first object information and the second object information have an area overlap in the page, obtaining an overlap area proportion value; and if the overlap area proportion value is greater than or equal to a preset proportion threshold, determining that the first object information and the second object information are bound to each other.

[0015] In a second aspect, the present application provides a risk data identification device, including:

[0016] An information acquisition module is configured to acquire page object information of at least one page in a to-be-identified document.

[0017] A risk identification module is configured to, in a case where the page object information includes first object information, identify whether a risk identifier is contained in the corresponding page based on the first object information, wherein the first object information is used to display an image in the to-be-identified document.

[0018] A risk processing module is configured to, in response to the page containing the risk identifier, take the to-be-identified document to which the page belongs as risk data, and perform risk early warning processing on the risk data.

[0019] In a third aspect, the present application further provides a computer device, including:

[0020] One or more processors;

[0021] A memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor to implement the above-mentioned risk data identification method.

[0022] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program. The computer program is loaded by a processor to execute steps in the risk data identification method.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product or a computer program, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to execute the method provided in the first aspect.

[0024] The risk data identification method, device, computer device and storage medium, by obtaining the page object information of at least one page in the to-be-identified document, can identify whether the risk identifier is contained in the corresponding page based on the first object information in the case that the page object information includes the first object information, and finally respond to the case that the risk identifier is contained in the page by taking the to-be-identified document to which the page belongs as the risk data to perform the risk early warning processing on the risk data. Since the method is based on the document structure for analysis and processing, it has wide adaptability, can reduce the false positive rate and the false negative rate of the risk data identification, and greatly improves the identification accuracy of the risk data. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0026] Figure 1 The scene schematic diagram of the risk data identification method in the embodiments of the present application;

[0027] Figure 2 The flowchart of the risk data identification method in the embodiments of the present application;

[0028] Figure 3 The structure schematic diagram of the risk data identification device in the embodiments of the present application;

[0029] Figure 4 The structure schematic diagram of the computer device in the embodiments of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings of the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0031] In the description of the present application, the terms "first", "second" are used only for description purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0032] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0033] This invention provides a risk data identification method, apparatus, computer equipment, and storage medium, which will be described in detail below.

[0034] See Figure 1 , Figure 1 This is a schematic diagram illustrating a scenario for the risk data identification method provided by the present invention, which can be applied to a risk data identification system. The risk data identification system includes a terminal 102 and a server 104. The terminal 102 can be a device that includes both receiving and transmitting hardware, i.e., a device with receiving and transmitting hardware capable of performing bidirectional communication on a bidirectional communication link. Such a device may include: cellular or other communication devices having a single-line display, a multi-line display, or a cellular or other communication device without a multi-line display.

[0035] Specifically, terminal 102 can be a desktop terminal or a mobile terminal, and can also be a mobile phone, tablet computer, or laptop computer. Server 104 can be a standalone server, or a server network or server cluster composed of servers, including but not limited to computers, network hosts, single network servers, edge servers, multiple network server sets, or cloud servers composed of multiple servers. The cloud server consists of a large number of computers or network servers based on cloud computing. Furthermore, terminal 102 and server 104 establish a communication connection through a network, which can be any of a wide area network (WAN), local area network (LAN), or metropolitan area network (MAN).

[0036] Those skilled in the art will understand that Figure 1 The application environment shown is merely one applicable scenario for the solution of this invention and does not constitute a limitation on the application scenarios of this invention. Other application environments may include those that are more specific to this invention. Figure 1 The number of computer devices shown is more or less, for example Figure 1Only one server, 104, is shown in the image. It is understood that this risk data identification system may also include one or more other servers; specific details are not specified here. Additionally, as... Figure 1 As shown, the risk data identification system may also include a memory for storing data, such as storing documents to be identified.

[0037] It should be noted that, Figure 1 The schematic diagram of the risk data identification system shown is merely an example. The risk data identification system and scenario described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As those skilled in the art will know, with the evolution of risk data identification systems and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0038] See Figure 2 This invention provides a risk data identification method, and this embodiment mainly applies this method to the above-mentioned... Figure 1 Taking server 104 as an example, the method includes steps S201 to S203, as follows:

[0039] S201, Obtain page object information of at least one page in the document to be identified.

[0040] The document to be identified can be a PDF (Portable Document Format) document, a universal file format used to present and exchange electronic documents in a reliable and consistent manner. Furthermore, PDF documents can contain text, graphics, links, and other media elements, all of which can serve as page object information as mentioned in the embodiments of this invention, and can maintain a consistent appearance and layout across different operating systems, software, and devices.

[0041] In specific implementation, server 104 can call document parsing tools (such as PDF parser tools), Python libraries, or other software to traverse all pages of the document to be identified, and then automatically extract the media elements in each page as page object information. The page object information involved in this embodiment includes, but is not limited to, xobjects objects, links objects, and image objects. xobjects objects exist in the form of key-value pairs in the PDF file and are external resources in the PDF document, typically used to store and manage graphics, form elements, fonts, and other embedded objects on the page. Links objects typically contain attributes such as the target location, style, and interactive behavior of the links; they are hyperlink objects in the PDF document, and links can jump to another page, open a URL link, or perform specific operations. Image objects can have different attributes and parameters, such as size, resolution, and color space, and include, but are not limited to, image formats such as JPEG, PNG, and TIFF.

[0042] Furthermore, before obtaining the page object information of each page in the document to be identified, the server 104 can obtain the document to be identified in the following ways: 1. In a normal network structure, the server 104 can obtain the document to be identified from the terminal 102 or other cloud devices with network connections; 2. In a pre-built blockchain network, the server 104 can synchronously obtain the document to be identified from other terminal nodes or server nodes. The blockchain network can be a public chain, a private chain, etc.

[0043] Furthermore, to meet the needs of certain application scenarios, the documents to be identified can be those filtered based on preset rules. For example, if the document to be identified is a PDF document in the medical field, then before obtaining the document, it can be filtered and collected based on preset keywords in the medical field. However, it should be noted that if one or more PDF documents to be filtered contain only unreadable parts, such as only image objects, then OCR (Optical Character Recognition) technology can be used to extract the text from the page, and then it can be determined whether this text information contains keywords in the medical field to determine whether it can be used as a document to be identified for subsequent processing.

[0044] S202, if the page object information includes first object information, identify whether the corresponding page contains a risk label based on the first object information; wherein, the first object information is used to display an image in the document to be identified.

[0045] Among them, the risk identifier can be text, image, or link identifier used to indicate the document source and copyright information; the first object information is used to display images in the document to be identified, hereinafter referred to as image objects.

[0046] In the specific implementation, server 104 traverses all pages of the document to be identified and determines the page object information of each page. Since this page object information may include text objects, image objects, and / or link objects, the existing page object information can be parsed separately to identify whether the current page contains risk tags. For example, a certain amount of risk reference information, such as risk words, risk images, and / or risk domain names, can be pre-stored and then matched with different types of page object information. If text objects exist, they can be analyzed based on risk words; if image objects exist, they can be analyzed based on risk images; if link objects exist, they can be analyzed based on risk domain names. Page objects matching the risk reference information are then considered risk identifiers, and the page corresponding to the page object information is determined to contain a risk identifier. The scheme of analyzing image objects based on risk images involved in this embodiment will be described in detail below.

[0047] It should be noted that, since the risk identification results are inevitably limited by the amount of risk reference information obtained from parsing existing page object information separately, especially when initially identifying risk data, all risk reference information, including risk images, risk words, and risk domains, is generally not comprehensive enough. Individually matching and identifying whether each page object information is a risk identifier results in low reliability. Therefore, this embodiment of the invention proposes combining different types of page object information for risk data identification, such as combining first object information (image objects) and second object information (link objects) for analysis, to improve the accuracy of risk data identification. Specific analysis steps will be described in detail below.

[0048] In one embodiment, step S202 includes: if the page object information includes first object information, determining the similarity between the first object information and a preset risk image to identify whether the page contains a risk marker; if the similarity determines that the page does not contain a risk marker, then determining whether the corresponding page object information also includes second object information; if the page object information also includes second object information, identifying whether the page contains a risk marker based on the first object information and the second object information; wherein the second object information is used to load clickable links in the document to be identified.

[0049] The preset risk images can be trademark images (including but not limited to text, graphics, letters, numbers, etc.) collected for specific fields, or images containing prohibited words (such as "confidential," "for internal use only," "strictly prohibited from distribution," etc.). The second object information is used to load clickable links in the document to be identified, hereinafter referred to as link objects.

[0050] In the specific implementation, after server 104 extracts the image object of the current page, it can first analyze whether the image object is a risk marker. This can be done by performing a similarity analysis between the image object and a preset risk image. Then, based on the similarity information obtained from the analysis, it can be determined whether the image object is a risk marker. If it is determined to be a risk marker, it can be determined that the current page contains a risk marker. The image similarity analysis scheme involved in this embodiment will be described in detail below.

[0051] Furthermore, if server 104 determines, using the above-described method, that the current page does not contain a risk identifier, but link objects can still be extracted from the current page, then a deeper analysis can be performed combining image objects and link objects to determine whether the current page contains a risk identifier. This ensures the reliability of the risk data identification results and reduces the probability of the risk identifier being missed. The deep analysis scheme for multiple types of page object information involved in this embodiment will be described in detail below.

[0052] In one embodiment, when the page object information includes first object information, determining the similarity between the first object information and a preset risk image to identify whether the page contains a risk marker includes: obtaining a first image feature of the first object information; obtaining a second image feature of the preset risk image; determining a similarity value between the first image feature and the second image feature based on a preset algorithm; wherein the preset algorithm includes an approximate nearest neighbor search algorithm based on a KD tree; if the similarity value is greater than or equal to a preset similarity threshold, it is determined that the page contains a risk marker.

[0053] Among them, the KD-tree-based approximate nearest neighbor search algorithm (KNN) is an algorithm for efficiently searching for approximate nearest neighbors. It organizes data points by constructing a KD-tree and then uses the properties of the KD-tree to perform the search.

[0054] In specific implementation, this invention proposes using the KNN algorithm to perform similarity analysis between an image object and a preset risk image. Upon initiation of the analysis, the feature vector of the image object is obtained as the first image feature, and then the feature vector of the preset risk image is obtained synchronously or asynchronously as the second image feature. Then, after obtaining the image features of the two images, the image similarity is calculated. For example, the FLANN (Fast Library for Approximate Nearest Neighbors) algorithm can be used to match the first and second image features. Finally, the similarity value is calculated based on the number of matching points. It is understood that the similarity value here can be a percentage value, such as 90% or 100%, or an integer or non-integer value, such as a similarity value of 9 for a maximum score of 10, or 0.8 for a maximum score of 1.

[0055] Furthermore, after server 104 analyzes and determines the similarity value of each image object on the current page compared with the preset risk image, it can compare each similarity value with the preset similarity threshold one by one. If a certain similarity value is greater than or equal to the similarity threshold, the corresponding image object can be determined to be a risk marker, and the page where the image object is located is considered to contain the risk marker.

[0056] For example, if image object "A" has a similarity score of "98%" with a preset risk image, and the similarity threshold is "95%", then image object "A" can be determined to be a risk marker, and the page containing it contains a risk marker. As another example, if image object "B" has a similarity score of "0.5" with a preset risk image, and the similarity threshold is "0.9", then image object "B" can be determined not to be a risk marker.

[0057] Of course, besides the KNN algorithm mentioned above, deep neural network models can also be used to calculate image features, including but not limited to Residual Neural Networks (ResNet) and Neural Networks Connecting Text and Images (CLIP). Specifically, deep neural networks can convert images into fixed-dimensional vectors, and these vectors can be compared using the cosine similarity algorithm.

[0058] In one embodiment, when the page object information includes first object information, obtaining the first image feature of the first object information includes: extracting key point information and feature descriptors of the first object information; and performing histogram equalization processing on the first object information based on the key point information and feature descriptors to obtain the first image feature.

[0059] In specific implementation, this embodiment of the invention proposes that to obtain the feature vectors of each image, the SIFT (Scale-invariant feature transform) algorithm can be used to extract key point information and feature descriptors, and then histogram equalization processing can be performed on the image to enhance the robustness and reliability of the features. Specifically, the SIFT algorithm finds extreme points in different scale spaces and directions to obtain information such as the position, scale, and orientation of key points, and calculates descriptors to describe the image features around the key points. Meanwhile, since histogram equalization is a method to enhance image contrast and can even out the distribution of pixel gray values ​​in an image, this embodiment of the invention proposes that histogram equalization can be used to match and enhance the detail information of the image to improve the final accuracy of risk data identification.

[0060] In one embodiment, if the page object information further includes second object information, identifying whether the page contains a risk identifier based on the first object information and the second object information includes: if the page object information further includes second object information, obtaining the first object location information of the first object information on the page, and obtaining the second object location information of the second object information on the page; analyzing the first object location information and the second object location information to identify whether the page contains a risk identifier.

[0061] The location information of both the first and second objects can be represented by a quadruple of {top, left, width, height} to accommodate high-precision detection of risk markers that exist in documents with varying page sizes and diverse positions and sizes. Here, "top" represents the distance of the rectangle containing the object from the top edge of the PDF document page, "left" represents the distance of the rectangle containing the object from the left edge of the PDF document page, "width" represents the width of the rectangle containing the object, and "height" represents the height of the rectangle containing the object. It should be noted that these distance values ​​depend on the current page size. For example, since a PDF document has four endpoints, a coordinate system can be established with one endpoint (such as the top left corner) as the origin, normalizing the height and width of a single page of PDF document to a preset range (such as [0, 100]). Based on these quadruple values, the vertex coordinates of each page object information within the current page can be calculated, thus obtaining the location information of the first and second objects.

[0062] In practice, server 104 analyzes the page object information of each page in the document to be identified one by one. When it is initially determined that none of the pages contain risk markers, pages with image objects but whose similarity analysis does not meet the risk judgment criteria can be used as target pages. Further determination is made as to whether the page also contains link objects. If both link objects and image objects exist, and the link objects match the preset risk domain name but still do not meet the risk judgment criteria, then in-depth analysis can be performed by combining link objects and image objects to avoid missing images / links that should be identified as risk markers due to insufficient preset risk images / risk domain names.

[0063] Specifically, a deep analysis combining link objects and image objects is needed to determine whether the link objects and image objects on the target page are mutually bound. If so, the current page can be determined to contain a risk indicator. This is because, through massive analysis, although links exist in PDF documents, not all links are risk indicators; some links may only be for information traceability. However, if a link is mutually bound to an image, it is highly likely to be a risk indicator, such as a "hyperlink watermark." To address this, this embodiment of the invention proposes that the first object location information of the first object information and the second object location information of the second object information can be obtained and analyzed to determine whether the image objects and link objects on the target page are mutually bound.

[0064] In one embodiment, analyzing the location information of the first object and the location information of the second object to identify whether the page contains a risk identifier includes: analyzing the location information of the first object and the location information of the second object to determine whether the first object information and the second object information are bound together; if it is determined that the first object information and the second object information are bound together, then it is determined that the page contains a risk identifier.

[0065] In the specific implementation, after the server 104 obtains the position information of the first object and the position information of the second object, since both are represented by the quadruple {top, left, width, height}, it can further determine the coordinates of the four vertices of the image object and the link object on the target page: the top-left vertex (left, top), the top-right vertex (right, top), the bottom-left vertex (left, bottom), and the bottom-right vertex (right, bottom). Where right = left + width, and bottom = top + height.

[0066] Furthermore, based on the aforementioned coordinates, it can be analyzed whether image objects and link objects on the same target page overlap, thereby determining whether the first object information and the second object information are mutually bound. If they are determined to be mutually bound, it can be determined that the target page contains a risk indicator.

[0067] In one embodiment, analyzing the location information of the first object and the location information of the second object to determine whether the first object information and the second object information are bound together includes: analyzing the location information of the first object and the location information of the second object to determine whether the first object information and the second object information have overlapping areas on the page; if the first object information and the second object information have overlapping areas on the page, then obtaining the overlapping area percentage value; if the overlapping area percentage value is greater than or equal to a preset percentage threshold, then determining that the first object information and the second object information are bound together.

[0068] In practice, to analyze whether image objects and link objects existing simultaneously on the target page are mutually bound, it is necessary to first determine the coordinates of the four vertices of the image object and link object on the target page using the position information of the first and second objects. Then, based on the vertex coordinates, it is analyzed whether the information of the first and second objects overlaps, that is, whether the areas covered by the four vertices of the two objects intersect. If there is an intersection, it means that the two objects overlap. At this point, the area ratio of the overlapping area to the total area of ​​the image area can be obtained as the overlapping area ratio value. Then, it is analyzed whether the overlapping area ratio value is greater than or equal to a preset ratio threshold. If so, it can be determined that the first and second object information are mutually bound.

[0069] For example, if the overlap ratio is "60%", meaning the overlap area accounts for "60%" of the total area of ​​the image, and the preset ratio threshold is "50%", then it can be determined that the corresponding image object and the link object are bound to each other.

[0070] S203 If the page contains a risk indicator, the document to be identified to which the page belongs will be treated as risk data for risk warning processing.

[0071] In the specific implementation, after the server 104 traverses all pages of the document to be identified, if it detects that at least one page contains a risk identifier, the document to be identified to which that page belongs can be regarded as risk data, and so on to identify all documents to be identified, thereby realizing the batch identification of risk data of the documents to be identified.

[0072] Of course, after the server 104 identifies and filters out the risky data in the document to be identified, it can summarize the risky data and then directly filter it out or send it back to the terminal 102 to obtain manual review instructions before deleting it. This has important application value in the fields of copyright protection and security review.

[0073] The risk data identification method in the above embodiments involves the server acquiring page object information of at least one page in the document to be identified. If the page object information includes first object information, the server identifies whether the corresponding page contains a risk identifier based on the first object information. Finally, in response to the presence of a risk identifier on the page, the server treats the document to which the page belongs as risk data for risk warning processing. Because this method analyzes and processes data based on document structure, it has broad applicability and can reduce the false positive and false negative rates of risk data identification, significantly improving the accuracy of risk data identification.

[0074] It should be understood that, although Figure 2The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0075] To better implement the risk data identification method provided in the embodiments of the present invention, based on the risk data identification method proposed in the embodiments of the present invention, the present invention also provides a risk data identification device, which can be deployed in, for example, Figure 1 In server 104 shown, as Figure 3 As shown, the risk data identification device 300 includes:

[0076] The information acquisition module 310 is used to acquire page object information of at least one page in the document to be identified;

[0077] The risk identification module 320 is used to identify whether a risk label is contained in the corresponding page based on the first object information when the page object information includes the first object information; wherein the first object information is used to display an image in the document to be identified;

[0078] The risk processing module 330 is used to treat the document to be identified as risk data in response to the presence of a risk label on the page, so as to perform risk warning processing on the risk data.

[0079] In one embodiment, the risk identification module 320 is further configured to determine the similarity between the first object information and a preset risk image when the page object information includes the first object information, so as to identify whether the page contains a risk icon; if it is determined based on the similarity that the page does not contain a risk icon, then it is determined whether the corresponding page object information also includes the second object information; if the page object information also includes the second object information, it is used to identify whether the page contains a risk icon based on the first object information and the second object information; wherein the second object information is used to load a clickable link in the document to be identified.

[0080] In one embodiment, the risk identification module 320 is further configured to: acquire a first image feature of the first object information when the page object information includes first object information; acquire a second image feature of a preset risk image; determine a similarity value between the first image feature and the second image feature based on a preset algorithm; wherein the preset algorithm includes an approximate nearest neighbor search algorithm based on a KD tree; if the similarity value is greater than or equal to a preset similarity threshold, it is determined that the page contains a risk identifier.

[0081] In one embodiment, the risk identification module 320 is further configured to extract key point information and feature descriptors of the first object information when the page object information includes first object information; and perform histogram equalization processing on the first object information based on the key point information and feature descriptors to obtain first image features.

[0082] In one embodiment, the risk identification module 320 is further configured to, when the page object information also includes second object information, obtain the first object location information of the first object information on the page and obtain the second object location information of the second object information on the page; analyze the first object location information and the second object location information to identify whether the page contains a risk identifier.

[0083] In one embodiment, the risk identification module 320 is further configured to analyze the location information of the first object and the location information of the second object to determine whether the first object information and the second object information are bound together; if it is determined that the first object information and the second object information are bound together, then it is determined that the page contains a risk identifier.

[0084] In one embodiment, the risk identification module 320 is further used to analyze the location information of the first object and the location information of the second object to determine whether the first object information and the second object information overlap in the page; if the first object information and the second object information overlap in the page, the overlapping area percentage value is obtained; if the overlapping area percentage value is greater than or equal to a preset percentage threshold, the first object information and the second object information are determined to be mutually bound.

[0085] In the above embodiments, the server obtains page object information of at least one page in the document to be identified. If the page object information includes first object information, the server identifies whether the corresponding page contains a risk identifier based on the first object information. Finally, in response to the presence of a risk identifier on the page, the server treats the document to which the page belongs as risk data for risk warning processing. Because this method analyzes and processes data based on document structure, it has broad applicability and can reduce the false positive and false negative rates of risk data identification, significantly improving the accuracy of risk data identification.

[0086] It should be noted that the specific limitations regarding the risk data identification device can be found in the limitations of the risk data identification method described above, and will not be repeated here. Each module in the aforementioned risk data identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the electronic device in hardware form, or stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of each module.

[0087] In some embodiments of the present invention, the risk data identification device 300 can be implemented as a computer program, which can be implemented in, for example... Figure 4 The device operates on the computer shown. The computer's memory can store the various program modules that make up the risk data identification device 300, for example, Figure 3 The information acquisition module 310, risk identification module 320, and risk processing module 330 shown; the computer program composed of each program module causes the processor to execute the steps in the risk data identification method of the various embodiments of the present invention described in this specification. For example, Figure 4 The computer equipment shown can be used as follows Figure 3 The information acquisition module 310 in the risk data identification device 300 shown executes step S201. The computer device can execute step S202 via the risk identification module 320. The computer device can execute step S203 via the risk processing module 330. The computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communication with external computer devices via a network connection. When the computer program is executed by the processor, it implements a risk data identification method.

[0088] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0089] In some embodiments of the present invention, a computer device is provided, including one or more processors; a memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processors as described in the risk data identification method. The steps of the risk data identification method here may be steps from the risk data identification methods of the various embodiments described above.

[0090] In some embodiments of the present invention, a computer-readable storage medium is provided, storing a computer program that is loaded by a processor, causing the processor to execute the steps of the risk data identification method described above. The steps of the risk data identification method here may be the steps in the risk data identification methods of the various embodiments described above.

[0091] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0092] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] The above provides a detailed description of a risk data identification method, apparatus, computer device, and storage medium provided by embodiments of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A risk data identification method, characterized in that, include: Obtain page object information for at least one page in the document to be identified; When the page object information includes first object information, based on the first object information, identifying whether the corresponding page contains a risk identifier includes: If the page object information includes first object information, determine the similarity between the first object information and a preset risk image to identify whether the page contains a risk icon; If the similarity determines that the page does not contain a risk identifier, then it is determined whether the corresponding page object information also includes second object information; If the page object information further includes second object information, based on the first object information and the second object information, identifying whether the page contains a risk identifier includes: If the page object information further includes second object information, the first object position information of the first object information in the page is obtained, and the second object position information of the second object information in the page is obtained. Analyzing the location information of the first object and the location information of the second object to identify whether the page contains a risk indicator includes: Analyzing the location information of the first object and the location information of the second object to determine whether the first object information and the second object information are mutually bound includes: Analyze the location information of the first object and the location information of the second object to determine whether the first object information and the second object information have overlapping areas on the page; If the first object information and the second object information overlap in area on the page, then obtain the percentage value of the overlapping area; If the percentage of the overlapping area is greater than or equal to a preset percentage threshold, then the first object information and the second object information are determined to be mutually bound. If it is determined that the first object information and the second object information are mutually bound, then it is determined that the page contains a risk identifier; Wherein, the first object information is used to display an image in the document to be identified, and the second object information is used to load a clickable link in the document to be identified; If the page contains a risk identifier, the document to which the page belongs will be treated as risk data for risk warning processing.

2. The method as described in claim 1, characterized in that, When the page object information includes first object information, determining the similarity between the first object information and a preset risk image to identify whether the page contains a risk marker includes: When the page object information includes first object information, the first image feature of the first object information is obtained; Obtain the second image features of the preset risk image; Based on a preset algorithm, the similarity value between the first image feature and the second image feature is determined; wherein, the preset algorithm includes an approximate nearest neighbor search algorithm based on a KD tree; If the similarity value is greater than or equal to a preset similarity threshold, then the page is determined to contain a risk marker.

3. The method as described in claim 2, characterized in that, When the page object information includes first object information, obtaining the first image feature of the first object information includes: When the page object information includes first object information, extract the key point information and feature descriptor of the first object information; Based on the key point information and the feature descriptor, histogram equalization is performed on the first object information to obtain the first image features.

4. A risk data identification device, characterized in that, include: The information acquisition module is used to acquire page object information of at least one page in the document to be identified; The risk identification module is used to identify, based on the first object information, whether a risk identifier is contained in the corresponding page when the page object information includes first object information, including: If the page object information includes first object information, determine the similarity between the first object information and a preset risk image to identify whether the page contains a risk icon; If the similarity determines that the page does not contain a risk identifier, then it is determined whether the corresponding page object information also includes second object information; If the page object information further includes second object information, based on the first object information and the second object information, identifying whether the page contains a risk identifier includes: If the page object information further includes second object information, the first object position information of the first object information in the page is obtained, and the second object position information of the second object information in the page is obtained. Analyzing the location information of the first object and the location information of the second object to identify whether the page contains a risk indicator includes: Analyzing the location information of the first object and the location information of the second object to determine whether the first object information and the second object information are mutually bound includes: Analyze the location information of the first object and the location information of the second object to determine whether the first object information and the second object information have overlapping areas on the page; If the first object information and the second object information overlap in area on the page, then obtain the percentage value of the overlapping area; If the percentage of the overlapping area is greater than or equal to a preset percentage threshold, then the first object information and the second object information are determined to be mutually bound. If it is determined that the first object information and the second object information are mutually bound, then it is determined that the page contains a risk identifier; Wherein, the first object information is used to display an image in the document to be identified, and the second object information is used to load a clickable link in the document to be identified; The risk processing module is used to respond to the presence of a risk identifier on the page by treating the document to be identified to which the page belongs as risk data and performing risk warning processing on the risk data.

5. A computer device, characterized in that, The computer device includes: One or more processors; The memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the risk data identification method of any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, It stores a computer program, which is loaded by a processor to execute the steps of the risk data identification method according to any one of claims 1 to 3.

Images