Content recognition method, network device, and computer-readable storage medium

Abstract

The application provides a content identification method, network equipment and a computer readable storage medium. The method comprises: identifying user access records corresponding to suggestive content according to collected domain name system (DNS) logs; the suggestive content is suspected flow diversion content; determining whether external addresses in the user access records have flow diversion behavior according to the user access records; if it is determined that the external addresses have flow diversion behavior, sending target external addresses having flow diversion behavior to a second device for content review; the second device is a device having a subscription relationship with a first device; and receiving review results sent by the second device. The first device of the application provides flow diversion behavior discovery capability, the second device reviews target external addresses having flow diversion behavior, and through interaction between the first device and the second device, multi-party collaborative governance of bad flow diversion behavior is realized, and the efficiency and accuracy of identifying bad content can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a content identification method, a network device and a computer readable storage medium. BACKGROUND

[0002] Currently, the discovery of flow content is similar to the discovery of traditional bad information. The flow content is mainly analyzed by analyzing the title, introduction, comments or content body of the content to determine whether it contains flow keywords and other features, so as to determine whether it is a flow behavior. There are the following problems in using the active scanning scheme to govern the flow content: in order to prevent being discovered by the audit strategy, the flow user often confuses the link, and may also embed the link in the multimedia content, which causes great overhead for content identification. At the same time, since the content itself is not illegal, there is no effective audit feedback mechanism to judge whether the flow target is bad content, so the flow miss rate / false positive rate is high. SUMMARY

[0003] At least one embodiment of the present application provides a content identification method, a network device and a computer readable storage medium, which are used to solve the problem of limitations in identifying bad content by using the active scanning scheme in the prior art, and the problem of easy false positives.

[0004] In order to solve the above technical problems, the present application is implemented as follows:

[0005] In a first aspect, the embodiments of the present application provide a content identification method applied to a first device, comprising:

[0006] According to the collected domain name system (DNS) log, a user access record corresponding to suggestive content is identified; the suggestive content is suspected flow content;

[0007] According to the user access record, it is determined whether an external address in the user access record exists flow behavior;

[0008] If it is determined that the external address exists flow behavior, a target external address existing flow behavior is sent to a second device for content audit; the second device is a device having a subscription relationship with the first device;

[0009] The audit result of the target external address sent by the second device is received.

[0010] Optionally, according to the user access record, it is determined whether the corresponding external address in the user access record exists flow behavior, comprising:

[0011] According to the preconfigured waiting time window threshold and the user access record, a user jump rate from accessing the suggestive content to accessing the external address is determined;

[0012] determine that the external address exists the flow behavior when the user jump rate is greater than the jump rate threshold.

[0013] Optionally, according to the preconfigured waiting time window threshold and the user access record, a user jump rate from accessing the suggestive content to accessing the external address is determined, including:

[0014] According to the user access record, first user information accessing the suggestive content is determined; the first user information includes a total number of users and external address information corresponding to each user access;

[0015] According to the first user information and user address attributes, a number of times of accessing the external address corresponding to the first user information when the waiting time does not exceed the waiting time window threshold is determined; the user address attributes include a personal address or a proxy address; the waiting time is a time from closing a page corresponding to the suggestive content to opening a page corresponding to the external address;

[0016] According to a ratio of the number of times of accessing the external address to the total number of users, the user jump rate from accessing the suggestive content to accessing the external address is determined.

[0017] Optionally, according to the collected domain name system (DNS) log, user access records corresponding to the suggestive content are identified, including:

[0018] A content mapping relationship database is established; the content mapping relationship database includes a corresponding relationship between a suggestive content address and a content publisher;

[0019] According to the collected DNS log and the content mapping relationship database, a target user accessing the suggestive content is determined, and all access records corresponding to the target user are obtained;

[0020] The all access records corresponding to the target user are determined as the user access records corresponding to the suggestive content.

[0021] Optionally, after receiving the audit result of the target external address sent by the second device, the method further includes:

[0022] According to the audit result, it is determined whether the corresponding content of the target external address is bad content;

[0023] When it is determined that the corresponding content of the target external address is bad content, according to a preconfigured address mapping relationship, an address of a target suggestive content corresponding to the target external address is determined; the address mapping relationship includes a corresponding relationship between an external address and an address of a suggestive content;

[0024] According to a first preset processing strategy, the target suggestive content is disposed.

[0025] Optionally, after the address of the target suggestive content corresponding to the target external address is determined, the method further includes:

[0026] According to a preconfigured content mapping relationship, a target content publisher corresponding to the target suggestive content is determined; the content mapping relationship includes a corresponding relationship between an address of a suggestive content and a content publisher;

[0027] A tolerance of the target content publisher is acquired; the tolerance is a number of times of publishing a suggestive content by a user, and / or a ratio of a number of suggestive contents published by the user to a number of all contents published by the user;

[0028] When the tolerance is greater than a tolerance threshold, the target content publisher is disposed according to a second preset processing strategy.

[0029] Optionally, before the domain name system (DNS) log is acquired, the method further includes:

[0030] A subscription message of the second device is received.

[0031] According to the subscription message, a subscription relationship with the second device is established, and a subscription number is allocated to the second device.

[0032] In a second aspect, an embodiment of the present application provides a content identification method, applied to a second device, and including:

[0033] A target external address with a flow diversion behavior is received from a first device.

[0034] Content auditing is performed on the external address, and an auditing result of the target external address is determined.

[0035] The auditing result of the target external address is sent to the first device.

[0036] Optionally, the method further includes:

[0037] A subscription message is sent to the first device.

[0038] A subscription relationship with the first device is established, and a subscription number allocated by the first device is received.

[0039] In a third aspect, an embodiment of the present application provides a network device, which is a first device, including a transceiver and a processor, wherein,

[0040] The processor is configured to identify user access records corresponding to the suggestive content according to the collected domain name system (DNS) logs, wherein the suggestive content is suspected diversion content.

[0041] The processor is further configured to determine whether external addresses in the user access records have diversion behaviors according to the user access records.

[0042] The processor is further configured to send target external addresses having the diversion behaviors to a second device for content review if it is determined that the external addresses have the diversion behaviors, wherein the second device is a device having a subscription relationship with the first device.

[0043] The transceiver is configured to receive review results of the target external addresses sent by the second device.

[0044] In a fourth aspect, an embodiment of the present application provides a network device, which is a second device, comprising a transceiver and a processor, wherein,

[0045] The transceiver is configured to receive target external addresses having the diversion behaviors sent by a first device.

[0046] The processor is configured to review the external addresses to determine review results of the target external addresses.

[0047] The transceiver is further configured to send the review results of the target external addresses to the first device.

[0048] In a fifth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, steps of the method according to any one of the preceding aspects are implemented.

[0049] Compared with the prior art, the content identification method, the network device and the computer readable storage medium provided by the embodiments of the present application can collect DNS logs, identify user access records corresponding to suggestive content, further analyze whether there is a diversion behavior in the user access records, send target external addresses having the diversion behaviors to a second device for review, receive review results of the target external addresses sent by the second device, and thus determine whether the content corresponding to the target external addresses is bad content, that is, determine whether accessing the target external addresses is normal diversion behavior. The first device of the present application provides diversion behavior discovery capability, and the second device reviews target external addresses having the diversion behaviors. Through the interaction between the first device and the second device, multi-party collaborative governance of bad diversion behaviors is realized, and the efficiency and accuracy of identifying bad content can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0050] Various other advantages and benefits will become apparent to those of ordinary skill in the art, upon reading the following detailed description of the preferred embodiment. The accompanying drawings are included to provide a better understanding of the preferred embodiment, and are not intended to be a limitation on the scope of the application. Moreover, in the drawings, like reference numerals refer to similar components, and:

[0051] Figure 1 A flow chart for applying the content recognition method of the embodiment of the present application to the first device;

[0052] Figure 2 A flow chart for establishing the content mapping relationship library according to the embodiment of the present application;

[0053] Figure 3 A flow chart for determining whether there is a behavior association between the user access record and the user address according to the embodiment of the present application;

[0054] Figure 4 A flow chart for triggering the content handling strategy according to the embodiment of the present application;

[0055] Figure 5 A flow chart for obtaining the content publisher according to the embodiment of the present application;

[0056] Figure 6 A flow chart for the subscription of the first device and the second device according to the embodiment of the present application;

[0057] Figure 7 A flow chart for applying the content recognition method of the embodiment of the present application to the second device;

[0058] Figure 8 A flow chart for the interaction of the first device and the second device according to the embodiment of the present application;

[0059] Figure 9 A structure diagram of the network device according to an embodiment of the present application;

[0060] Figure 10 A structure diagram of the network device according to another embodiment of the present application;

[0061] Figure 11 A structure diagram of the network device according to yet another embodiment of the present application;

[0062] Figure 12 A structure diagram of the network device according to yet another embodiment of the present application. DETAILED DESCRIPTION

[0063] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. While exemplary embodiments of the present application are illustrated, it is to be understood that the application is not limited to the embodiments described herein, which are presented as examples. Rather, the present application is applicable in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

[0064] The terms "first", "second", and the like, in the description and in the claims of this application are used for distinguishing between similar objects and are not necessarily used to describe a particular sequential or chronological order. It is to be understood that the use of the term "or" in the present application is to be interpreted in the inclusive sense as meaning "one or the other, or both". Therefore, such an embodiment is to be understood as being within the meant scope of the application. Also, the use of "including", "comprising" and "having" are intended to be interpreted as specifying the presence of stated steps or the components, but not precluding the presence of one or more other steps, ranges, or components, or groups thereof. It is also to be understood that wherever aspects are described in the application that they can also be applicable to the corresponding aspects described in the claims.

[0065] The following description provides examples, and is not limiting of the scope, applicability, or configuration set forth in the claims. Changes can be made in the function and arrangement of elements discussed without departing from the scope of the disclosure. Various examples can omit, substitute, or add various procedures or components as appropriate. For instance, the methods described can be performed in an order different from that described, and various steps can be added, omitted, or combined. Also, features described with respect to certain examples can be combined in other examples.

[0066] As described in the background, in the prior art, the governance of the diversion content using the active scanning scheme usually has the following problems: in the content itself without violation, the link is confused or embedded in the multimedia content, which causes a great overhead for content identification, and there is no effective audit feedback mechanism to judge whether the diversion target is bad content, which seriously affects the accuracy of identifying bad content. To solve at least one of the above problems, the embodiments of the present application provide a content identification method, which can reduce or avoid the above situation, and improve the accuracy of identifying bad content.

[0067] Please refer to Figure 1 The content identification method provided by the embodiments of the present application is applied to a first device, and includes:

[0068] Step 11, according to the collected domain name system (DNS) log, identifying the user access record corresponding to the suggestive content; the suggestive content is suspected diversion content.

[0069] It should be noted that the suspected diversion content is content that is not in violation of the rules itself, but has a risk of diversion. For example, the suspected diversion content is a video that has multiple segments, at least one of which is a characteristic video about "exposure", "oral link", or includes a "diversion" keyword, and has suspected diversion behavior. Such content is referred to as suggestive content.

[0070] It should be noted that the DNS log is a log recorded by the DNS server each time it processes a DNS request. The DNS log can be collected from the DNS server or network equipment.

[0071] In the embodiments of the present application, the user generates access records using the user internet protocol address (IP address). The user access record is all access records generated by the IP address of the user accessing the suggestive content. The present application obtains data that needs to be analyzed and judged through the DNS log, ensuring the authenticity of the data source and the universality of the data source.

[0072] The collected DNS log can be data obtained in a period of interest. The period of interest can be a configured or preconfigured time period, or a time period in which it is necessary to verify whether the current content contains suggestive content or illegal content.

[0073] Step 12, according to the user access record, determining whether the external address in the user access record has diversion behavior.

[0074] The first device of the present application has a judgment function. The first device itself uses the judgment function to analyze and process the external address in the user access record. The analysis and processing includes analyzing whether there is a behavior of diverting from the suggestive content to the external address within a certain time period. Using the analysis and processing, it is determined whether there is diversion behavior in the external address in the user access record. According to the recognition and analysis ability of the first device, the time for sending to the second device for content recognition is improved, and the content recognition efficiency is improved.

[0075] Step 13, if it is determined that the external address has diversion behavior, the target external address with diversion behavior is sent to the second device for content review; the second device is a device that has a subscription relationship with the first device.

[0076] Step 14, receiving the review result of the target external address sent by the second device.

[0077] It should be noted that the first device can obtain DNS logs of user access to different platforms; the first device has content monitoring, public opinion monitoring and other content identification capabilities. The first device includes but is not limited to operators, communication device manufacturers, security manufacturers such as antivirus software, cloud manufacturers, regulatory platforms, etc. The second device is a content platform with weak content identification capability, insufficient regulatory experience, easy to become a target of flow and need to be governed; it can also be a platform or team responsible for content review. There is a subscription relationship between the first device and the second device in the present application.

[0078] In the embodiment of the present application, when it is determined that there is a flow behavior by using the external address, the target external address corresponding to the flow behavior is sent to the second device side for review to determine whether the corresponding content of the flow behavior of the target external address is bad content. After the second device reviews, a review tag will be marked on the target external address. The review tag is a bad information category label for the target external address. The review result can also be directly fed back. The review result is "yes" or "no". The first device can receive the review result sent by the second device and perform subsequent processing.

[0079] The first device of the present application provides flow behavior discovery capability, and the second device reviews the target external address with flow behavior. Through the interaction between the first device and the second device, multi-party collaborative governance of bad flow behavior is realized, which can improve the efficiency and accuracy of identifying bad content. It can also be understood that suspected flow content is identified based on DNS log analysis, and content discovery, review and disposal are completed by multi-party collaboration, which can effectively discover flow behavior and effectively obtain review feedback.

[0080] Optionally, step 11 above includes:

[0081] A content mapping relationship library (content map library) is established. The content mapping relationship library includes the corresponding relationship between the suggestive content address and the content publisher.

[0082] Referring to Figure 2 In the embodiment of the present application, the content map library with content identification capability is established according to the bad strategy library. The present application can establish the content identification capability of non-explicitly illegal content according to the title, text, multimedia content, etc. of non-explicitly illegal content by means of content crawler, or establish the content identification capability of non-explicitly illegal content according to the above-mentioned bad strategy library. The present application can discover non-explicitly illegal suggestive content through the constructed content identification capability.

[0083] For example, taking the image recognition capability as an example: based on deep learning, an image classification algorithm for a specific theme can be trained, which can classify images into "normal", "exposure", "violation" and other categories. The violation picture is directly disposed of the violation content. The "exposure" picture itself is not in violation, but it may be a risk content for diversion to the violation content, that is, it belongs to suggestive content. This application refers to the risk content (such as "exposure" picture) that has no violation but has the risk of diversion to the violation address as suggestive content (the content has the risk of hidden variation). Here, the content map library constructed by the application includes the corresponding relationship between the suggestive content address and the content publisher, which can be represented in the form of "content map {suggestive content address, content publisher}".

[0084] According to the collected domain name system (DNS) log and the content mapping relationship library, a target user who has accessed the suggestive content is determined, and all access records corresponding to the target user are obtained;

[0085] All access records corresponding to the target user are determined as user access records corresponding to the suggestive content.

[0086] The application can parse the DNS log collected, for example, the following information can be parsed from the collected DNS log: timestamp; source IP; user IP; target IP: accessed IP. The target IP of the DNS record is the most fine-grained address. For example, taking the DNS log of an operator as an example, the resource granularity can be recorded for a network disk, the resource page granularity can be recorded for a resource sharing application (APP), the payment page granularity can be recorded for a payment application (such as the payment interface granularity of a smart watch, the payment page link information of a mobile phone APP, etc.), and WeChat can record the public number applet granularity. The application can set a jump white list before or after parsing, and add platform homepages such as "www.baidu.com" and portal websites to the white list, which are considered to be reasonable jumps.

[0087] The application performs first retrieval collection on each content map {suggestive content address, content publisher}: in the DNS original log, taking the "suggestive content address" as the "target IP", collecting all DNS logs in the concerned time period as the data set A, that is, determining the target user who has accessed the suggestive content, that is, obtaining the user IP who has accessed the "suggestive content".

[0088] Further, the application performs a second retrieval of user IP: in the DNS original log, collect all data in the concerned time period, with a timestamp greater than the minimum timestamp in data set A, and a "source IP" value appearing in data set A "source IP", and a "target IP" excluding all data of the white list website, as data set B, which is used for subsequent analysis.

[0089] The application determines the above-mentioned user IP and all access records corresponding to the user IP as user access records corresponding to the suggestive content, providing data support for subsequent data analysis.

[0090] To calculate whether there is a behavioral association between the user access record and the user address, the above-mentioned step 12 optionally includes:

[0091] According to the pre-configured waiting time window threshold and the user access record, determine the user jump rate from accessing the suggestive content to accessing the external address;

[0092] When the user jump rate is greater than the jump rate threshold, it is determined that there is a flow diversion behavior.

[0093] It should be noted that if there is a flow diversion link in the suggestive content or content comment, the user may need to "repair" the flow diversion link through intermediate processes such as copying and pasting, deleting disturbance characters in the link, and identifying the two-dimensional code by screenshot, during which APP switching may occur, rather than directly jumping to the external address. Therefore, the jump of the user within a short time interval can still be considered as being diverted by the suggestive content. The time interval is the waiting time window threshold. The waiting time window threshold can be confirmed according to experience or data statistical results, or can be a configured or pre-configured value.

[0094] In the embodiment of the application, according to the waiting time window threshold and the user access record, the user jump rate from the suggestive content to the external address is determined, which is the jump frequency or person-time determined by the user from the suggestive content to the external website. Further, a jump rate threshold baseline is established, and the user jump rate is greater than the jump rate threshold baseline, and it is considered that there is a flow diversion behavior.

[0095] In one implementation, the establishment of the jump rate threshold baseline can select known "non-flow diversion content" as the content address, perform DNS log collection and behavior correlation analysis. The same waiting time window and the same algorithm are used to calculate the jump rate for each external address, and the average jump rate upward deviation is selected as the jump rate threshold baseline.

[0096] In another implementation, a known diversion content is selected, the user jump rate in the case of successful diversion is analyzed, and the jump rate threshold baseline is selected as the average jump rate deviation.

[0097] In another implementation, the jump rate threshold baseline can also be confirmed based on the experience of diversion behavior analysis. In some scenarios, due to the accuracy of external address records, the jump rate threshold baseline can even be 1 / n, where n represents the number of user IPs that have accessed the suggestive content address.

[0098] Optionally, according to the preconfigured waiting time window threshold and the user access record, the user jump rate from accessing the suggestive content to accessing the external address is determined, including:

[0099] According to the user access record, first user information that has accessed the suggestive content is determined; the first user information includes the number of all users and external address information corresponding to each user;

[0100] According to the first user information and user address attributes, the number of times that the corresponding user in the first user information accesses the external address when the waiting time does not exceed the waiting time window threshold is determined; the user address attributes include a personal address or a proxy address; the waiting time is the time between closing the page corresponding to the suggestive content and opening the page corresponding to the external address;

[0101] According to the ratio of the number of times of accessing the external address to the number of all users, the user jump rate from accessing the suggestive content to accessing the external address is determined.

[0102] In the embodiments of the present application, according to the user access record, the number of all users that have accessed the suggestive content and the external address information corresponding to each user are determined, and further, according to the number of users, the external address information corresponding to each user, and the user address attributes, the ratio of the number of times of accessing to the number of all users is determined to determine the user jump rate. The number of times of accessing can represent the number of visits or the frequency of visits, and the corresponding number of times of accessing is determined according to the different user address attributes.

[0103] In one implementation of the present application, the user address attribute is a personal IP, the number of personal IPs that have accessed the suggestive content address is N, and in the case that the time window of user waiting for jump is less than or equal to the waiting time window threshold, h users access the external address x, j users access the external address y, and k users access the external address z. Therefore, the jump rate from the suggestive content to the external address x is h / N, the jump rate from the suggestive content to the external address y is j / N, and the jump rate from the suggestive content to the external address z is k / N. Here, the number of times of accessing in the numerator corresponds to the number of visits rather than the frequency of visits.

[0104] In another implementation of the present application, the user address attribute is a proxy IP, the number of personal IPs accessing the suggestive content address is M, in the case that the time window of the user waiting for the jump is less than or equal to the waiting time window threshold, wherein the user IP has accessed the external address x h times in total; the user IP has accessed the external address y j times in total; the user IP has accessed the external address z k times in total; then: the jump rate of the suggestive content to the external address x is h / M; the jump rate of the suggestive content to the external address y is j / M; the jump rate of the suggestive content to the external address z is k / M. Here, the number of accesses of the molecule corresponds to the access frequency rather than the number of access persons.

[0105] Further, if for a certain suggestive content: the jump rate h / M to the external address x > the jump rate threshold to the external address y j / M > the jump rate threshold baseline; it is confirmed that there is a flow behavior of the suggestive content address to the external address x and the external address y. For each external address with flow, record the address map {external address, suggestive content address}. For example: {external address x, suggestive content address a}; {external address y, suggestive content address a}.

[0106] Referring to Figure 3 It can be considered that the user accessing the suggestive content is a "triggering behavior" of the flow, and the user jumping to the external address is a "focus behavior" of the flow. The purpose of the above steps is to confirm whether the two behaviors are associated. It is analyzed whether there is a behavior of jumping to other platforms (external addresses) after the user accesses the suggestive content. The present application can determine whether there is flow content in the accessed external address in the first device, and further send the target external address with flow behavior to the second device, so as to improve the identification accuracy and efficiency of the bad content through the cooperative processing of the first device and the second device.

[0107] Optionally, the present application further discloses a method for disposing flow content after receiving the audit result of the target external address sent by the second device, and the above method further comprises:

[0108] determining whether the corresponding content of the target external address is bad content according to the audit result;

[0109] when it is determined that the corresponding content of the target external address is bad content, determining the address of the target suggestive content corresponding to the target external address according to a pre-configured address mapping relationship; the address mapping relationship comprises a corresponding relationship between the external address and the address of the suggestive content;

[0110] disposing the target suggestive content according to a first preset processing strategy.

[0111] In the embodiments of the present application, the audit result can be represented by "yes" or "no", wherein "yes" indicates that the corresponding content of the target external address is determined as bad content, and "no" indicates that the corresponding content of the target external address is determined as non-bad content; or the audit result can carry an explicit bad information label, and the target external address can be directly determined as a bad external address through the label. Here, only when the corresponding content of the target external address is determined as bad content, the subsequent disposal strategy is executed. When the corresponding content of the target external address is determined as bad content, the target suggestive content address corresponding to the target external address is determined according to a preconfigured address mapping relationship, the address mapping relationship can include {target external address, target suggestive content address}, so that the target suggestive content address corresponding to the target external address can be determined, and the first device can dispose the content corresponding to the target suggestive content address according to a first preset disposal strategy, the first preset disposal strategy includes but is not limited to deleting, unlisting a link including suggestive content, etc.

[0112] In a specific embodiment provided by the present application, referring to FIG. 1, Figure 4 As shown in FIG. 1, the discoverer (the first device) receives the audit result for the external address x, if it is yes (or other labels representing bad diversion behaviors), the address map (which can be understood as an address mapping relationship) is triggered to obtain the suggestive content address corresponding to the external address x, and the disposal strategy is triggered to dispose the suggestive content, and the measures such as unlisting and deleting can be taken.

[0113] Optionally, after the present application determines the address of the target suggestive content corresponding to the target external address, the above-mentioned method further includes:

[0114] determining the target content publisher corresponding to the target suggestive content according to a preconfigured content mapping relationship; the content mapping relationship includes the corresponding relationship between the address of the suggestive content and the content publisher;

[0115] obtaining the tolerance of the target content publisher; the tolerance is the number of times of publishing the suggestive content by the user, and / or the ratio of the number of the suggestive content published by the user to the number of all the content published by the user;

[0116] when the tolerance is greater than a tolerance threshold, disposing the target content publisher according to a second preset disposal strategy.

[0117] In the embodiments of the present application, according to the pre-configured content mapping relationship, the target content publisher corresponding to the target suggestive content address is determined, that is, the content map (content mapping relationship) is queried to determine the target content publisher corresponding to the target suggestive content. Here, the content map can be represented as {target suggestive content address, target content publisher}. After determining the target content publisher, the tolerance of the target content publisher needs to be obtained, which can be calculated in real time. For example, the tolerance of the target publisher can be calculated by counting, such as directly determining according to the number of times of publishing suggestive content by the target content publisher; or calculating the proportion of accessing the suggestive content corresponding to the target suggestive content address in all videos published by the target content publisher to determine a proportion ratio and determine the tolerance. Of course, the present application can also use the counting method to calculate when the user publishes less content, and use the content proportion method to determine the tolerance when the published content reaches a certain amount, which is not limited by the present application.

[0118] Further, according to the comparison between the tolerance and the preset tolerance threshold, a comparison result is determined. For example, when the counting method is used to calculate, the tolerance threshold is a specific number of times; when the content proportion method is used to determine the tolerance, the tolerance threshold is a percentage value of the content proportion. The comparison result here can be one of three results: "exceeding the tolerance threshold", "less than the tolerance threshold", and "equal to the tolerance threshold". According to the second preset processing strategy and the above comparison result, the target content publisher can be disposed when the result is "exceeding the tolerance threshold"; the target content publisher can be warned when the result is "equal to the tolerance threshold"; and the target content publisher can be not disposed when the result is "less than the tolerance threshold".

[0119] Optionally, the second preset processing strategy of the present application can also score the target content publisher according to the comparison result of the tolerance, and send the scored user reputation value to the second device to intuitively display the reputation of the target content publisher. For example, in order to avoid the user account being deducted when it is used for the first time, an initial reputation value can be allocated to each account when registering the account. The initial reputation value can be set according to the demand, for example, the more the deduction items are set, the larger the initial reputation value can be. In one example, the initial reputation value can be 100 points. The second device can gradually restore the specified reputation points of the target publisher after a monitoring time length, which can be ten days, eight days, five days, etc. The specified reputation points can be 0.5 points, 1 point, 2 points, etc.

[0120] In summary, the application triggers a dual map query based on the feedback result, i.e., an address map (which can be understood as an address mapping relationship) and a content map (a content mapping relationship), realizes that the first device further disposes the purpose of diverting content and users based on the effective feedback of the second device, provides a scheme for multiple parties to complete content discovery, review and disposal, and achieves the purpose of analyzing the reputation of the target content publisher and disposing bad content.

[0121] Referring to Figure 5 After obtaining the suggestive content address corresponding to the external address x in the content disposal, further, the content map is queried to obtain the content publisher. The discoverer (the first device) sets the tolerance and the tolerance threshold for the user.

[0122] The calculation method of the tolerance can be counting: the number of suggestive contents published by the user and confirmed to point to bad content. Each time the bad content diversion behavior is found, the tolerance of the user is increased by one. In this scenario, the tolerance threshold is the maximum number of bad behavior diversion that the platform can accept.

[0123] The calculation method of the tolerance can be content ratio: the ratio of the suggestive contents published by the user and confirmed to point to bad content in all the contents published by the user. The ratio is updated as the user diversion behavior occurs. In this scenario, the tolerance threshold is a percentage.

[0124] In the application, when the tolerance of the user is greater than the tolerance threshold, the platform disposes the related user according to the information management and governance requirements.

[0125] Optionally, before step 11, the method further includes:

[0126] receiving a subscription message of the second device;

[0127] According to the subscription message, a subscription relationship is established with the second device, and a subscription number is allocated to the second device.

[0128] Before step 11, the application receives a subscription message sent by the second device (the subscriber can be one or more), and according to the subscription message, the application establishes a corresponding subscription relationship for each second device and allocates a subscription number to each second device, which is beneficial to the subsequent management of the first device to the subscriber.

[0129] Referring to Figure 6As shown, in a specific embodiment of the present application, the corresponding subscriber number is obtained through the external address x. The discoverer sends the address x to the subscriber. The subscriber audits the content corresponding to the external address x and feeds back the result to the discoverer. The subscriber can conduct manual audit or use a lightweight content recognition tool to conduct audit. The feedback result can be "yes" or "no", or an explicit bad information label. If more than one subscriber subscribes to the external address x, the discoverer publishes the address to multiple subscribers at the same time, and if the multiple subscribers return different results, the feedback result of any party is "yes", then the content of the external address x is considered as bad content.

[0130] In summary, compared with establishing a complex content scanning and recognition strategy, the DNS log analysis based on the diversion behavior is simple and more efficient. Moreover, the DNS log records the real jump behavior, which can improve the accuracy of the diversion behavior discovery.

[0131] Reference Figure 7 As shown, the present application also provides a content recognition method applied to a second device, comprising:

[0132] Step 71, receiving a target external address with diversion behavior sent by a first device;

[0133] Step 72, auditing the content of the external address to determine the audit result of the target external address;

[0134] Step 73, sending the audit result of the target external address to the first device.

[0135] In the embodiment of the present application, since there are multiple external addresses, the target external address with diversion behavior is determined according to the recognition and analysis ability of the first device. The second device further audits and analyzes the target external address to determine whether the target external address is a bad (or illegal) address or the content corresponding to the target external address is bad content, so as to obtain the audit result of the target external address and send the audit result of the target external address to the first device. In the present application, the direct audit of the target external address by the second device improves the accuracy of the recognition of bad diversion behavior.

[0136] In the interaction process of the present application and the first device: the first device improves its bad information recognition ability by means of its own recognition and analysis ability; the first device realizes the management of bad diversion content by means of the audit ability of the second device; and the first device further disposes the diversion content and the diversion user based on the effective feedback of the second device. The content recognition method of the present application is applicable to judging whether there is a behavior of malicious diversion by taking advantage of network violence events.

[0137] Optionally, the above method further comprises:

[0138] sending a subscription message to the first device;

[0139] establishing a subscription relationship with the first device, and receiving a subscription number allocated by the first device.

[0140] In the present application, the first device sends a subscription message to the second device, which is a subscription party. After the first device publishes an external address of a content with a diversion, the second device further audits the external address through the subscription relationship, thereby providing security for the audit identity.

[0141] Referring to Figure 8 The present application provides an interaction process diagram between a first device (discoverer) and a second device (subscriber), which includes the following steps:

[0142] The subscriber initiates registration to the discoverer and provides an IP segment. The IP segment can be an IP segment of the subscriber's own platform or an IP segment participated by the subscriber in the audit. The discoverer allocates a subscription number to the subscriber. The discoverer monitors various content platforms / APPs through content recognition, collects DNS logs, and analyzes and processes the collected DNS logs to determine the user IP that has accessed the "suggestion content" and all access records of the user IP, and determine whether there is an association between the user IP that has accessed the "suggestion content" and other access records, that is, whether there is a diversion behavior in the access to the external address based on the behavior analysis of the DNS logs. The external address with the diversion behavior is published, the subscriber verifies the content of the external address to determine whether it is bad or illegal content, and feeds back the audit result to the discoverer. The discoverer further determines whether it is bad content based on the audit result, and if it is bad content, performs content disposal and reputation analysis. The interaction between the discoverer and the subscriber in the present application realizes the multi-party collaborative governance of bad diversion behavior, and improves the efficiency and accuracy of identifying bad content.

[0143] The above introduces various methods of embodiments of the present application. The following will further provide a device for implementing the above method.

[0144] Referring to Figure 9 The present application also provides a network device 900, which is a first device and includes a transceiver 901 and a processor 902, wherein,

[0145] The processor 902 is configured to identify user access records corresponding to suggestion content according to collected domain name system (DNS) logs, wherein the suggestion content is suspected diversion content.

[0146] The processor 902 is further configured to determine whether an external address in the user access records has a diversion behavior according to the user access records.

[0147] The processor 902 is further configured to send the target external address with the redirection behavior to a second device for content review if it is determined that the external address has the redirection behavior; the second device is a device having a subscription relationship with the first device;

[0148] The transceiver 901 is configured to receive a review result of the target external address sent by the second device.

[0149] Optionally, the network device 900, wherein the processor 902 is further configured to:

[0150] determine a user jump rate from accessing the suggestive content to accessing an external address according to a preconfigured waiting time window threshold and the user access record;

[0151] determine that the external address has the redirection behavior when the user jump rate is greater than a jump rate threshold.

[0152] Optionally, the network device 900, wherein the processor 902 is further configured to:

[0153] determine first user information of users who have accessed the suggestive content according to the user access record; the first user information includes a total number of users and external address information corresponding to each user;

[0154] determine a number of times of accessing external addresses by users in the first user information when a waiting time does not exceed the waiting time window threshold according to the first user information and user address attributes; the user address attributes include personal addresses or proxy addresses; the waiting time is a time between closing a page corresponding to the suggestive content and opening a page corresponding to the external address;

[0155] determine a user jump rate from accessing the suggestive content to accessing an external address according to a ratio of the number of times of accessing external addresses to the total number of users. Optionally, the network device 900, wherein the processor 902 is further configured to:

[0156] establish a content mapping relationship library; the content mapping relationship library includes a corresponding relationship between suggestive content addresses and content publishers;

[0157] determine a target user who has accessed the suggestive content and obtain all access records corresponding to the target user according to the collected DNS logs and the content mapping relationship library;

[0158] determine all access records corresponding to the target user as user access records corresponding to the suggestive content.

[0159] Optionally, the network device 900, wherein the processor 902 is further configured to:

[0160] determine, according to the audit result, whether the corresponding content of the target external address is undesirable content;

[0161] when it is determined that the corresponding content of the target external address is undesirable content, determine, according to a preconfigured address mapping relationship, an address of target suggestive content corresponding to the target external address; the address mapping relationship includes a corresponding relationship between an external address and an address of suggestive content;

[0162] handle the target suggestive content according to a first preset processing policy.

[0163] Optionally, the network device 900, wherein the processor 902 is further configured to:

[0164] determine, according to a preconfigured content mapping relationship, a target content publisher corresponding to the target suggestive content; the content mapping relationship includes a corresponding relationship between an address of suggestive content and a content publisher;

[0165] obtain a tolerance of the target content publisher; the tolerance is a number of times of publishing suggestive content by a user, and / or a ratio of a number of published suggestive content by the user to a number of all content published by the user;

[0166] when the tolerance is greater than a tolerance threshold, handle the target content publisher according to a second preset processing policy.

[0167] Optionally, the network device 900, wherein the processor 902 is further configured to:

[0168] receive a subscription message of the second device;

[0169] establish a subscription relationship with the second device according to the subscription message, and allocate a subscription number to the second device.

[0170] It should be noted that the device in this embodiment is a device corresponding to the method applied to the first device side described above, and the implementation manners in each of the above embodiments are applicable to the embodiments of the device and can achieve the same technical effects. The device provided in the embodiments of the present application can implement all the method steps realized by the method embodiments and achieve the same technical effects. Therefore, the same parts and beneficial effects in the method embodiments will not be described in detail.

[0171] For reference Figure 10The embodiment of the present application further provides a network device 1000, the network device is a second device, comprising a transceiver 1001 and a processor 1002, wherein,

[0172] The transceiver 1001 is configured to receive a target external address with a diversion behavior sent by a first device.

[0173] The processor 1002 is configured to perform content review on the external address, and determine a review result of the target external address.

[0174] The transceiver is further configured to send the review result of the target external address to the first device.

[0175] Optionally, the network device 1000, wherein the transceiver 1001 is further configured to send a subscription message to the first device.

[0176] The transceiver 1001 is further configured to establish a subscription relationship with the first device, and receive a subscription number allocated by the first device.

[0177] It should be noted that the device in the embodiment is a device corresponding to the method applied to the second device side, and the implementation manners in the above embodiments are applicable to the embodiment of the device, and the same technical effects can be achieved. The device provided in the embodiment of the present application can implement all method steps achieved by the method embodiments, and can achieve the same technical effects. Here, the same parts and beneficial effects in the method embodiments will not be described in detail.

[0178] For reference Figure 11 The embodiment of the present application further provides a terminal 1100, comprising a processor 1101, a memory 1102, a computer program stored in the memory 1102 and executable on the processor 1101, which implements each process of the content recognition method embodiment executed by the first device when executed by the processor 1101, and can achieve the same technical effects. To avoid repetition, this will not be described here.

[0179] For reference Figure 12 The embodiment of the present application further provides a network device 1200, comprising a processor 1201, a memory 1202, a computer program stored in the memory 1202 and executable on the processor 1201, which implements each process of the content recognition method embodiment executed by the second device when executed by the processor 1201, and can achieve the same technical effects. To avoid repetition, this will not be described here.

[0180] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to realize each process of the content identification method embodiment and achieve the same technical effects. To avoid repetition, details are not described herein. The computer readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, an optical disk or the like.

[0181] It should be noted that, in this document, the terms "comprising", "containing" or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the process, method, article or apparatus that includes the element.

[0182] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, air conditioner or network device) execute the method described in each embodiment of the present application.

[0183] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, which are only illustrative and not restrictive. Those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the protection scope of the claims.

Claims

1. A content recognition method applied to a first device, the method comprising: receiving a content from a second device; determining a content identifier of the content; and transmitting the content identifier to the second device. The method comprises: According to the collected domain name system (DNS) log, identify the user access record corresponding to the suggestive content; the suggestive content is suspected to be a content diversion; According to the user access record, determine whether the external address in the user access record has a content diversion behavior; If it is determined that the external address has a content diversion behavior, send the target external address with the content diversion behavior to a second device for content review; the second device is a device that has a subscription relationship with the first device; Receive the review result of the target external address sent by the second device.

2. The method of claim 1, wherein, According to the user access record, determine whether the corresponding external address in the user access record has a content diversion behavior, comprising: According to the pre-configured waiting time window threshold and the user access record, determine the user jump rate from accessing the suggestive content to accessing the external address; When the user jump rate is greater than the jump rate threshold, it is determined that the external address has a content diversion behavior.

3. The method of claim 2, wherein, According to the pre-configured waiting time window threshold and the user access record, determine the user jump rate from accessing the suggestive content to accessing the external address, comprising: According to the user access record, determine the first user information of the user who has accessed the suggestive content; the first user information includes the number of all users and the external address information corresponding to each user; According to the first user information and the user address attribute, determine the number of times the user corresponding to the first user information accesses the external address when the waiting time does not exceed the waiting time window threshold; the user address attribute includes a personal address or a proxy address; the waiting time is the time between closing the page corresponding to the suggestive content and opening the page corresponding to the external address; According to the ratio of the number of times of accessing the external address to the number of all users, determine the user jump rate from accessing the suggestive content to accessing the external address.

4. The method of claim 1, wherein, According to the collected domain name system (DNS) log, identify the user access record corresponding to the suggestive content, comprising: Establish a content mapping relationship library; the content mapping relationship library includes the corresponding relationship between the suggestive content address and the content publisher; According to the collected DNS log and the content mapping relationship library, determine the target user who has accessed the suggestive content, and obtain all access records corresponding to the target user; Determine all access records corresponding to the target user as the user access record corresponding to the suggestive content.

5. The method of claim 1, wherein, After receiving the review result of the target external address sent by the second device, the method further comprises: According to the review result, determine whether the corresponding content of the target external address is bad content; When it is determined that the corresponding content of the target external address is bad content, according to the pre-configured address mapping relationship, determine the address of the target suggestive content corresponding to the target external address; the address mapping relationship includes the corresponding relationship between the external address and the address of the suggestive content; According to the first preset processing strategy, dispose the target suggestive content.

6. The method of claim 5, wherein, After determining the address of the target suggestive content corresponding to the target external address, the method further comprises: According to a pre-configured content mapping relationship, a target content publisher corresponding to the target suggestive content is determined; the content mapping relationship includes a corresponding relationship between an address of suggestive content and a content publisher; A tolerance of the target content publisher is obtained; the tolerance is a number of times of publishing suggestive content by a user, and / or a ratio of a number of suggestive content published by the user to a number of all content published by the user; When the tolerance is greater than a tolerance threshold, a second preset processing strategy is used to process the target content publisher.

7. The method of claim 1, wherein, Before the DNS log is collected, the method further includes: receiving a subscription message of the second device; establishing a subscription relationship with the second device according to the subscription message, and allocating a subscription number to the second device.

8. A content recognition method applied to a second device, comprising: It includes: receiving a target external address of the first device that has a flow diversion behavior; The target external address is determined by the first device according to the DNS log collected, identifying a user access record corresponding to suggestive content, determining whether the external address in the user access record has a flow diversion behavior according to the user access record, and if it is determined that the external address has a flow diversion behavior, the external address with the flow diversion behavior is determined as the target external address; the suggestive content is suspected flow diversion content; auditing the content of the external address to determine the audit result of the target external address; sending the audit result of the target external address to the first device.

9. The method of claim 8, wherein, The method further includes: sending a subscription message to the first device; establishing a subscription relationship with the first device and receiving a subscription number allocated by the first device.

10. A network device, comprising: The network device is the first device, including a transceiver and a processor, wherein, the processor is configured to identify a user access record corresponding to suggestive content according to the DNS log collected; the suggestive content is suspected flow diversion content; the processor is further configured to determine whether the external address in the user access record has a flow diversion behavior according to the user access record; the processor is further configured to send the target external address with the flow diversion behavior to a second device for content auditing if it is determined that the external address has a flow diversion behavior; the second device is a device having a subscription relationship with the first device; the transceiver is configured to receive the audit result of the target external address sent by the second device.

11. A network device, comprising: The network device is the second device, including a transceiver and a processor, wherein, the transceiver is configured to receive a target external address sent by the first device that has a flow diversion behavior; the target external address is determined by the first device according to the DNS log collected, identifying a user access record corresponding to suggestive content, determining whether the external address in the user access record has a flow diversion behavior according to the user access record, and if it is determined that the external address has a flow diversion behavior, the external address with the flow diversion behavior is determined as the target external address; the suggestive content is suspected flow diversion content; the processor is configured to audit the content of the external address to determine the audit result of the target external address; The transceiver is further configured to send an audit result of the target external address to the first device.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.

Images