Methods, devices, equipment, storage media, and program products for identifying illegal websites

Abstract

This invention provides a method, apparatus, device, storage medium, and program product for identifying illegal websites. The method includes: determining at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of a domain name, a URL, and an IP address; and determining whether the website to be identified is an illegal website based on the website address and page content. The technical solution provided by the embodiments of this invention can automatically, intelligently, and accurately detect websites to be identified.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, storage medium, and program product for identifying illegal websites. Background Technology

[0002] Online activities involving the illegal acquisition of substantial amounts of public or private property through fabricated facts or concealed truths, or gambling with valuable items, are all considered violations. With the development of the internet, these violations have increasingly taken place online, and their content is complex and varied, posing a greater challenge to violation detection. Therefore, technological means play an indispensable role in preventing and combating online violations. Currently, threats related to violations primarily stem from data and risk assessment of sites such as apps, URLs, and mini-programs; over 70% of cases are currently related to apps or websites. Timely detection of these risky websites and timely content understanding can significantly enhance efforts to combat violations.

[0003] The current mainstream approach primarily involves security personnel manually accessing suspected risky websites, leveraging their experience to discover entry points or process flows for related violations, while also employing simple text and image recognition algorithms for detection. However, this approach heavily relies on human experience, lacks the self-learning capabilities of intelligent systems, and has poor adaptability. If violators change their methods or tactics, the system will be unable to identify and issue timely and effective warnings. Summary of the Invention

[0004] This invention provides a method, apparatus, device, storage medium, and program product for identifying illegal websites, which solves the problem that the detection of illegal websites in the prior art relies on manual methods, and realizes automatic, intelligent, and accurate detection of websites to be identified.

[0005] This invention provides a method for identifying illegal websites, including:

[0006] Determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of a domain name, a URL, and an IP address;

[0007] Based on at least one of the website address and page content, determine whether the website to be identified is a violation website.

[0008] According to a method for identifying illegal websites provided by the present invention, determining whether the website to be identified is an illegal website based on at least one of the website address and page content includes one or more of the following:

[0009] Based on the website address, determine whether the website to be identified is a violation website;

[0010] Based on the page content, determine whether the website to be identified is a violation website.

[0011] According to a method for identifying illegal websites provided by the present invention, determining whether the website to be identified is an illegal website based on the website address includes:

[0012] Based on the characteristics of the website address, determine whether the website to be identified is a violation website; wherein, the characteristics of the website address include at least one of the following: DGA domain name characteristics, URL path characteristics, registration information characteristics, location characteristics, filing characteristics, URL arrangement characteristics, URL statistics characteristics, sensitive word characteristics, inbound and outbound link characteristics, and traffic characteristics.

[0013] According to a method for identifying illegal websites provided by the present invention, determining whether the website to be identified is an illegal website based on the website address includes:

[0014] Obtain the source code of the website to be identified;

[0015] Based on the source code, extract the implicit links from the website to be identified and determine the address information of the implicit links;

[0016] The website to be identified is determined as a violation website based on the website address and the address information.

[0017] According to a method for identifying illegal websites provided by the present invention, the step of extracting implicit links from the source code includes:

[0018] The attribute values ​​of the Uniform Resource Locator (URL) of the website to be identified and the size of the URL in the page content are determined based on the source code.

[0019] The implicit link is extracted based on the attribute value and the size.

[0020] According to a method for identifying illegal websites provided by the present invention, the step of extracting implicit links from the website to be identified based on the source code includes:

[0021] The system detects whether the attribute values ​​are complete or abnormal, and obtains a first detection result; and

[0022] The second detection result is obtained by detecting whether the size meets the abnormal size requirements; and

[0023] The third detection result is obtained by detecting whether the Uniform Resource Locator (URL) displays an anomaly.

[0024] The implicit link is extracted based on the first detection result, the second detection result, or the third detection result.

[0025] According to a method for identifying illegal websites provided by the present invention, determining whether the website to be identified is an illegal website based on the page content includes:

[0026] Input features are constructed based on the page content;

[0027] The input features are input into a preset website detection model to obtain the detection results output by the website detection model;

[0028] Based on the detection results, it is determined whether the website to be identified is a violation website.

[0029] According to the method for identifying illegal websites provided by the present invention, the website detection model is trained based on the Transformer model, and a relative bias term is added to the self-attention mechanism of the Transformer model.

[0030] According to the method for identifying illegal websites provided by the present invention, the training process of the preset website detection model includes:

[0031] Obtain sample input features corresponding to the content of multiple sample pages; wherein, each sample page content includes at least one sample image / text token;

[0032] The sample input features are input into the self-attention mechanism to obtain the processing result output by the self-attention mechanism;

[0033] The attention score is calculated based on the processing result, and the relative bias is calculated based on the browsing order and page content layout of the sample image and text tokens.

[0034] The Transformer model is trained based on the attention score and the relative bias term to obtain the website detection model.

[0035] According to a method for identifying illegal websites provided by the present invention, the step of constructing input features based on the page content includes:

[0036] Based on the page content, a first feature vector representing the browsing order of the page content, a second feature vector representing the layout of the page content, a third feature vector representing the positional relationship of the page content, a fourth feature vector representing the partitioning of the page content, and a fifth feature vector representing the semantics of the page content are constructed.

[0037] The second feature vector is input into the adaptive mapping layer to obtain the layout mapping feature vector output by the adaptive mapping layer;

[0038] The input features of the page content are constructed based on the first feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the layout mapping feature vector.

[0039] According to a method for identifying illegal websites provided by the present invention, the construction of a first feature vector representing the browsing order of the page content includes:

[0040] The page content is segmented to obtain multiple image and text tokens, and each image and text token is enhanced.

[0041] Construct a first projection profile function that maps the enhanced image-text token to a first coordinate axis, and construct a second projection profile function that maps the enhanced image-text token to a second coordinate axis;

[0042] The node position information of each graphic token as a leaf node in the website space browsing tree to be constructed is determined according to the first projection profile function and the second projection profile function, and the website space browsing tree is constructed according to the node position information;

[0043] The first feature vector is obtained based on the index of the leaf node in the website space browsing tree.

[0044] According to a method for identifying illegal websites provided by the present invention, the step of determining the node position information of each of the graphic tokens as leaf nodes in the website space browsing tree to be constructed based on the first projection profile function and the second projection profile function includes:

[0045] The set of points that are determined to be 0 from the first projection profile function is the first valley point, and the set of points that are determined to be 0 from the second projection profile function is the second valley point;

[0046] By cutting according to the first valley point and the second valley point respectively, multiple first-type clusters and multiple second-type clusters are obtained;

[0047] The node location information is determined by the corresponding coordinate values ​​of the graphic tokens in the first cluster and the second cluster.

[0048] According to a method for identifying illegal websites provided by the present invention, the enhancement processing of each of the graphic tokens includes:

[0049] The random variables corresponding to each of the graphic tokens on each coordinate axis are determined based on a preset uniform distribution.

[0050] If the absolute value of the random variable is greater than a preset variable threshold, the movement data is determined based on the absolute value of the random variable, and the movement direction is determined based on the sign of the random variable.

[0051] The coordinate values ​​of each graphic token are enhanced based on the corresponding movement data and movement direction.

[0052] The present invention also provides a device for identifying illegal websites, comprising:

[0053] The first determining module is configured to determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of the domain name, URL, and IP address;

[0054] The second determining module is configured to determine whether the website to be identified is a violation website based on at least one of the website address and page content.

[0055] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the above-described methods for identifying illegal websites.

[0056] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the illegal website identification method as described above.

[0057] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described methods for identifying illegal websites.

[0058] The present invention provides a method, apparatus, device, storage medium, and program product for identifying illegal websites. When identifying a website to be identified, it determines the website based on at least one of the website address and page content. Both the website address and the page content can characterize the website to be identified. Therefore, it can automatically, accurately, and comprehensively identify illegal websites. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0060] Figure 1 This is a flowchart illustrating the method for identifying illegal websites provided by the present invention;

[0061] Figure 2 This is a schematic diagram of the process for determining whether a website is illegal based on its address in an embodiment of the present invention;

[0062] Figure 3 This is a flowchart illustrating step 230 in an embodiment of the present invention;

[0063] Figure 4 This is a flowchart illustrating the training process of the preset website detection model provided by the present invention;

[0064] Figure 5 This is a schematic diagram of the website detection model in an embodiment of the present invention;

[0065] Figure 6 This is a schematic diagram of the process of constructing input features in an embodiment of the present invention;

[0066] Figure 7 This is a flowchart illustrating step 610 in an embodiment of the present invention;

[0067] Figure 8 This is a flowchart illustrating step 730 in an embodiment of the present invention;

[0068] Figure 9 This is a flowchart illustrating step 710 in an embodiment of the present invention;

[0069] Figure 10 This is a schematic diagram of the structure of the illegal website identification device provided by the present invention;

[0070] Figure 11 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0072] The pages of illegal websites differ from ordinary pages. In the process of verifying illegal websites, there are often more complex data types and structures, such as images, tables, bank cards, and ID documents. Their positions cannot usually be simply ordered "from left to right" or "from top to bottom," but rather exhibit rich hierarchical structures. Ordinary algorithms cannot handle such complex situations. Furthermore, they heavily rely on human experience, lack intelligent self-learning capabilities, and have poor growth potential. If individuals engaging in illegal activities change their methods, it will be impossible to identify and warn them in a timely and effective manner. Moreover, some hidden gambling and fraudulent resources are often not detected in a timely manner.

[0073] The illegal website identification method, apparatus, equipment, storage medium, and program products provided in this invention are mainly used in the intelligent website inspection module of the violation management system in actual business applications. The datasets in this invention are all derived from DPI (Deep Packet Inspection) data of mobile communication traffic, and are obtained after deduplication, cleaning, and model classification.

[0074] The following is combined Figures 1-9 This invention describes the method for identifying illegal websites.

[0075] Figure 1 This is a flowchart illustrating a method for identifying illegal websites according to an exemplary embodiment. Figure 1 As shown in an exemplary embodiment, the method for identifying illegal websites includes steps 110 to 120, which are described in detail below:

[0076] Step 110: Determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of the domain name, URL, and IP address.

[0077] In this embodiment, the website to be identified is the website whose violation needs to be determined. The website displays corresponding page content, which can be text and / or images. To identify whether the website to be identified is in violation, the corresponding website address and page content are obtained.

[0078] Step 120: Determine whether the website to be identified is a violation website based on at least one of the website address and page content.

[0079] In this embodiment of the application, the determination of whether a website to be identified is a violation website is based on at least one of the website address and page content of the website to be identified.

[0080] In this embodiment of the application, when identifying a website to be identified, it is determined based on at least one of the website address and page content of the website to be identified. Both the website address and the page content can represent the website to be identified. Therefore, it is possible to automatically, accurately and comprehensively identify violations of the website to be identified.

[0081] In an exemplary embodiment of the present invention, determining whether the website to be identified is a violation website based on at least one of the website address and page content in step 120 includes one or more of the following steps, which are described in detail below:

[0082] Based on the website address, determine whether the website to be identified is a violation website;

[0083] Based on the page content, determine whether the website to be identified is a violation website.

[0084] In this embodiment of the application, when determining whether a website to be identified is a violation website, it can be determined based on the website address, or based on the webpage content, or based on both the website address and the webpage content.

[0085] In this embodiment of the application, when determining whether a URL to be identified is a violation website based on a webpage, it can be determined based on at least one of the following: access context features, page text features, page image features, and page structure features. Access context features characterize the context in which the user browses the webpage. Page text features are the features specific to the text portion of the webpage. Page image features are the features specific to the image portion of the webpage. Page structure features characterize the structure of the webpage.

[0086] In an exemplary embodiment of the present invention, the step of determining whether the website to be identified is a violation website based on the website address includes the following steps, which are described in detail below:

[0087] Based on the characteristics of the website address, determine whether the website to be identified is a violation website; wherein, the characteristics of the website address include at least one of the following: DGA domain name characteristics, URL path characteristics, registration information characteristics, location characteristics, filing characteristics, URL arrangement characteristics, URL statistics characteristics, sensitive word characteristics, inbound and outbound link characteristics, and traffic characteristics.

[0088] In this embodiment of the application, when determining whether a website to be identified is a violation website based on its website address, the determination can be based on the characteristics of the website address, which include at least one of the above-mentioned characteristics.

[0089] Among them, DGA (Domain Generation Algorithm) domains refer to domains with high randomness generated through algorithms. URL path features characterize the URL path of the website to be identified. Registration information features, location features, and filing features characterize the registration information, location, and filing information of the website to be identified with the relevant authorities, respectively. URL arrangement features characterize the arrangement of characters in the website address of the website to be identified. Sensitive word features characterize whether the website address of the website to be identified contains sensitive words. Inbound and outbound link features characterize the inbound and outbound link characteristics for the website to be identified. Traffic features characterize the number of times users visit the website to be identified.

[0090] In this embodiment of the application, when determining whether a website to be identified is a violation website based on its website address, the determination can be made based on blacklists or heuristic methods, similarity matching methods, machine learning or deep learning methods, federated learning methods, etc.

[0091] One approach, based on a blacklist, stores a blacklist of websites found to be violating regulations in a feature knowledge base. This base allows for feature value matching of the website to be identified, checking if it possesses features from the database. If a match is found, the website is marked as a risk website. If the feature database detects a website as violating regulations, it is determined to be a risk website and recorded.

[0092] Heuristic methods involve setting rules for identifying illegal websites and matching the characteristics of the website address with the set rules. If the characteristics of the website address match the set rules, the website to be identified can be determined as an illegal website.

[0093] Methods based on machine learning or deep learning, and methods based on federated learning, train corresponding detection models based on machine learning, deep learning, or federated learning. The features of the website address are input into the trained detection model for detection, and then the output of the detection model is used to determine whether the website to be identified is a violation website.

[0094] In an exemplary embodiment of the present invention, please refer to Figure 2 The step of determining whether the website to be identified is a violation website based on the website address includes steps 210 to 230, which are detailed below:

[0095] Step 210: Obtain the source code of the website to be identified.

[0096] In this embodiment, implicit links are links on a website that are hidden to make them difficult to find. They are often concealed within the website's source code and are hard to spot just by looking at the webpage. Therefore, when determining whether a website is illegal based on its URL, implicit links can be used as a basis for this determination.

[0097] Step 220: Extract the implicit links from the website to be identified based on the source code, and determine the address information of the implicit links.

[0098] In this embodiment of the application, the extraction of implicit links in the website to be identified is mainly obtained by analyzing the source code. The original URL is accessed through the source code to extract the hidden web page links inside the web page, and the address information of the discovered implicit links is determined.

[0099] Step 230: Determine whether the website to be identified is a violation website based on the website address and the address information.

[0100] In this embodiment, whether a website is a violation website is determined by comprehensively considering the website address and the address information of the implicit links. At the same time, when determining the website address, the characteristics of the website address can be used as a basis. Through the solution provided in this embodiment, implicit links are extracted from the source code of the website to be identified, and some implicit illegal resources can be detected in a timely manner, enabling more accurate identification of illegal websites.

[0101] In an exemplary embodiment of the present invention, step 220, which involves extracting implicit links from the website to be identified based on the source code, includes the following steps, detailed below:

[0102] The attribute values ​​of the Uniform Resource Locator (URL) of the website to be identified and the size of the URL in the page content are determined based on the source code; the implicit links are extracted based on the attribute values ​​and the size.

[0103] In this embodiment of the application, the attribute value of the Uniform Resource Locator (URL) of the website to be identified and the size of the URL in the web page are determined according to the source code. The size of the URL in the web page is the font size of the URL.

[0104] In this embodiment, implicit links in the website to be identified are extracted based on determined attribute values ​​and sizes.

[0105] In an exemplary embodiment of the present invention, please refer to Figure 3 Step 230, which involves extracting the implicit link based on the attribute value and the size, includes steps 310 to 340, detailed below:

[0106] Step 310: Detect whether the attribute value is complete or abnormal, and obtain the first detection result.

[0107] In this embodiment, the detection of whether the attribute values ​​are complete is specifically defined as follows: the attribute values ​​should include width, height, visibility, display, and style. Detecting whether the attribute values ​​are complete means checking whether all of the attribute values ​​width, height, visibility, display, and style are present, or whether any attribute values ​​are hidden. The method for detecting whether the attribute values ​​are complete is as follows:

[0108] <[^>! *((width\s*?0)|(heigh\s*?)|(visibility:\s*?hidden)|(display:\s*?none)|(style\s*?= \s*? "hidden")|(left\s*?:\s*?-[0-9]{3,}\s*?px;)|(color\s*?:\s*?#FFFFFF))[^>]*>(\s*?<a\s*?href\s*?=[”’]?((http|https):\ / \ / )?(\w+\.){1,}((\w)|()\ / \w)|(\.\w)+[^> ]*>)+

[0109] This function checks for abnormal attribute values, specifically whether the values ​​corresponding to the attributes width, height, visibility, display, and style are out of the question. The method for checking for abnormal attribute values ​​is shown below:

[0110] <[^>! ]*((top\s*?:\s*?-[0-9]{3,}\s*?px;)|(left\s*?:\s*?-[0-9]{3,}\s*?px;))[^>! ]*<a\s*?herf\s*?=[”’]?(http|https):\ / \ / )?(\w+\.){1,}((\w|(\ / \w)|(\.\w))+[^> \s*? [^<! ]*]+

[0111] Step 320: Detect whether the size meets the abnormal size requirements to obtain the second detection result.

[0112] In this embodiment, the size of the Uniform Resource Locator (URL) on the webpage is detected to determine whether it meets the abnormal size requirement, thus obtaining a second detection result. The abnormal size requirement is preset, and the detection of whether the size meets the abnormal size requirement is as follows:

[0113] <a\s*?href\s*?=[”’]?((http|https):\ / \ / )?(\w+\.){1,}((\w)|(\ / \w)|(\.\w)+\s*?[^> ]*? font-size\s*? :\s*? 1px[^>]*>

[0114] Step 330: Detect whether the Uniform Resource Locator displays an anomaly, and obtain the third detection result.

[0115] In this embodiment, a third detection result is obtained by detecting whether the Uniform Resource Locator (URL) displays abnormally, specifically whether the URL is flickering abnormally. The detection of abnormal flickering is shown below:

[0116] <[^>! ]*(MARQUEE[Mm]arquee)\w*? (height\s*?=\s*?[0-9])(width\s*?=\s*?[0-9])[^>! ]*>([^<]*?a\s*?href\s*?=["']?((http|https):\ / \ / )?(\w+\.){1,}((\w)|(\ / \w)|(\.\w))+[^>]*>\s*?[^<!*])+

[0117] Step 340: Extract the implicit link based on the first detection result, the second detection result, or the third detection result.

[0118] In this embodiment of the application, if any one of the following is true: the first detection result indicates that the attribute value is incomplete or abnormal; the second detection indicates that several characteristic sizes meet the abnormal size requirements; and the third detection result indicates that the Uniform Resource Locator (URL) is abnormally flashing, then it is determined that there is an implicit link, and the URL that meets the characteristics of an implicit link is extracted from the webpage as the implicit link.

[0119] In this embodiment of the invention, a source code detection method based on implicit feature link extraction is proposed, which expands the coverage and comprehensiveness of active website detection.

[0120] In an exemplary embodiment of the present invention, the step of determining whether the website to be identified is a violation website based on the page content includes the following steps, which are described in detail below:

[0121] Input features are constructed based on the page content; the input features are input into a preset website detection model to obtain the detection results output by the website detection model.

[0122] In this embodiment of the application, input features are constructed based on the page content of the website to be identified, that is, the text, images, structural information, etc. of the web pages of the website to be identified are obtained to construct input features.

[0123] In this embodiment of the application, a website detection model is pre-trained. The constructed input features are input into the website detection model, and the website detection model outputs the corresponding detection results based on the input features. The detection results can characterize whether the website to be identified is a violation website.

[0124] Based on the detection results, it is determined whether the website to be identified is a violation website.

[0125] In this embodiment of the application, the website to be identified is directly determined as a violation website based on the detection results output by the website detection model.

[0126] In an exemplary embodiment of the present invention, the website detection model is trained based on a Transformer model, and a relative bias term is added to the self-attention mechanism of the Transformer model.

[0127] In this embodiment, the website detection model is built based on the Transformer model, which is a model that uses an attention mechanism to improve the training speed. The attention mechanism of the Transformer model in this embodiment adopts a self-attention mechanism. Considering the special characteristics of the variable browsing logic and complex structure of websites, the self-attention mechanism in the Transformer is improved. The relative bias term is obtained based on the browsing order and the layout of the web page, so that the final website detection model can cope with complex web page layers and thus detect the URL to be identified intelligently and accurately.

[0128] The illegal website identification method provided in this invention significantly improves the intelligence level and performance indicators of illegal detection systems, providing a powerful tool for the governance of illegal activities.

[0129] In an exemplary embodiment of the present invention, please refer to Figure 4 The pre-defined website detection model training process, including steps 410 to 440, is detailed below:

[0130] Step 410: Obtain the sample input features corresponding to the content of multiple sample pages respectively; wherein, each sample page content includes at least one sample image / text token.

[0131] In this embodiment of the application, sample web pages are pre-set, and each sample web page is constructed with corresponding sample input features. After each sample web page is segmented, multiple sample image and text tokens are formed.

[0132] Step 420: Input the sample input features into the self-attention mechanism to obtain the processing result output by the self-attention mechanism.

[0133] In this embodiment, the sample input features are fed into a self-attention mechanism for processing to obtain the processing result, such as... Figure 5 As shown, after obtaining the sample input features through the aggregation layer, the input through the self-attention mechanism is linearly transformed through a linear layer to obtain matrices Q (query), K (key), and V (value). These can be represented using a linear transformation matrix W. Q W K W V express.

[0134] Step 430: Calculate the attention score based on the processing result, and calculate the relative bias term based on the browsing order and page content layout of the sample image and text tokens.

[0135] In this embodiment of the application, the attention score α is calculated based on the processing result at the Attention scores layer. ij :

[0136]

[0137] In the above formula, x i W Q Represents the query matrix, x i W K Let Q represent the key-value matrix, d represent the dimensions of matrices Q and K, and T represent the transpose.

[0138] When constructing sample input features, a first sample feature vector representing the browsing order of sample web pages and a second sample feature vector representing the layout of web pages are constructed.

[0139] Let C be a positive integer, where C >> 1. Define the normalized outer border of the i-th sample image-text token as bbox. i = (x1,x2,y1,y2), where (x1,x2,y1,y2) are the boundary coordinates of the top left and bottom right corners of the i-th sample image / text token, which are mapped to a two-dimensional position coordinate system. The relative bias term is expressed by the following formula:

[0140]

[0141] In the above formula, H(l) and V(l) are trainable weight matrices for every integer l∈[-C,C).

[0142] The final self-attention score α is obtained by adding a relative bias layer. i ′ j :

[0143] β i ′ j =α ij +β ij

[0144] Step 440: Train the Transformer model based on the attention score and the relative bias term to obtain the website detection model.

[0145] In this embodiment, an N-layer Transformer encoder is used to extract features by combining a self-attention mechanism, Add&Norm layers, and Feed&Forward layers. At the input end, it utilizes three modalities simultaneously: text, image, and layout information. The Transformer's context encoding capability is used for unified encoding and alignment, while the powerful modeling capabilities of deep neural networks are leveraged to achieve multimodal deep fusion. In the Add&Norm layers, Add stands for Residual Connection, used to prevent network degradation, and Norm stands for Layer Normalization, used to normalize the input of each layer and accelerate convergence. The Feed&Forward layer is a two-layer fully connected layer; the first layer uses ReLU activation function, while the second layer does not use an activation function.

[0146] In this embodiment of the invention, a relative bias term β is explicitly added to the traditional self-attention mechanism. ij This helps pre-trained models deepen their understanding of the browsing order of website content and the layout of web pages.

[0147] In an exemplary embodiment of the present invention, please refer to Figure 6 The step of constructing input features based on the page content includes steps 610 to 630, which are described in detail below:

[0148] Step 610: Based on the page content, construct a first feature vector representing the browsing order of the page content, a second feature vector representing the layout of the page content, a third feature vector representing the positional relationship of the page content, a fourth feature vector representing the partitioning of the page content, and a fifth feature vector representing the semantics of the page content.

[0149] In this embodiment of the invention, a first feature vector o representing the browsing order of web pages is constructed. i Specifically, a Website-Space-Browsing-Order-Tree (WSBOT) based on an enhanced Website-Space-Projection-Surface Segmentation Mechanism is pre-constructed. Simultaneously, the webpage is segmented to obtain multiple image-text tokens, with the bounding box of each token represented by the top-left and bottom-right corner coordinates (x1, y1, x2, y2). The enhanced browsing order of each image-text token is obtained from the Website-Space-Browsing-Order-Tree, and subsequent processing methods are the same as BERT.

[0150] Construct the second feature vector l representing the layout of the web page i ,like Figure 5 The layout embeddings shown refer specifically to the two-dimensional spatial relationship of the graphic tokens within the entire webpage. The boxes of all graphic tokens are standardized, for example, transforming the entire webpage's box from (0,0,W,H) to (0,0,W / H,1). The embedding mapping rule for a single coordinate t is defined as follows:

[0151]

[0152] Then, by concatenating the four box coordinates of the graphic token, we can obtain a... The vectors in the space can be used to obtain the vectors of all image and text tokens, and then the second feature vector l can be obtained. i .

[0153] Construct a third feature vector p representing the positional relationships of web pages. i ,like Figure 3 The positions shown are Embeddings, specifically the third feature vector p. i That is, the one-dimensional positional relationship representation between image and text tokens, which obtains the third feature vector p in the same way as the BERT (Bidirectional Encoder Representation from Transformers) model. i .

[0154] Construct the fourth feature vector s of webpage partitions i ,like Figure 3 The partitioning embeddings shown, specifically the fourth feature vector s i That is, the Segment information, which marks the text in the image and text token as the [A] partition and the image as the [C] partition.

[0155] Construct the fifth feature vector t representing the semantics of a webpage i ,like Figure 3 The semantic embeddings shown are as follows: For text, a conventional approach is used, employing OCR (Optical Character Recognition) tools to obtain the text content. Let L be the maximum sequence length. The original input text is segmented using a Chinese word segmentation tool, then [CLS] and [SEP] markers are added, and [PAD] markers are used to pad the length, resulting in a text input sequence of length L: {[CLS], w1, w2, ..., [SEP], [PAD], [PAD], ...}. The semantic representation sequence of the text is obtained using the BERT model. For images, a ResNeXt-101 network is used as a feature encoder to extract features from the image. The image is then divided into grids and averaged to a fixed 7*7 size. The pooling hyperparameters can be adjusted as needed. After flattening the feature map, the image representation sequence is obtained. The semantic representation sequence of the text and the image representation sequence are used as the fifth feature vector t. i .

[0156] Step 620: Input the second feature vector into the adaptive mapping layer to obtain the layout mapping feature vector output by the adaptive mapping layer.

[0157] In this embodiment of the invention, the second feature vector is passed through a trainable adaptive mapping layer L to obtain a layout mapping feature vector. The adaptive mapping layer can gradually enhance the influence of the second feature vector on the overall input embedding in the early stages of training. Furthermore, it can map it to a suitable subspace during training to reduce the impact on the original representational ability of the BERT model, further reducing the information loss from the sum of multiple embeddings. The adaptive mapping L follows a normal distribution N(0, σ). 2 The initialization is performed using σ, which is a hyperparameter with an initial value of 0.02.

[0158] Step 630: Construct the input features of the page content based on the first feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the layout mapping feature vector.

[0159] In this embodiment of the invention, the text modality and the image modality are concatenated, and the first feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the layout mapping feature vector are added together to construct the input feature x of the webpage. i :

[0160] x i =t i +pi +o i +s i +L(l i )

[0161] In this invention, the input features of the website to be identified are constructed through five categories of semantic representation of images and text, layout representation, sequence position representation, partition representation, and browsing order representation. This can combine multiple modalities to accurately describe the web page, thereby enabling the website detection model to accurately detect whether the website to be identified is a violation website.

[0162] In an exemplary embodiment of the present invention, please refer to Figure 7 The construction of the first feature vector representing the browsing order of the page content in step 610 includes steps 710 to 740, which are detailed below:

[0163] Step 710: The page content is segmented to obtain multiple image and text tokens, and each image and text token is enhanced.

[0164] In this embodiment, the webpage is segmented to obtain multiple image-text tokens, each representing a word. The entire webpage is then preprocessed to obtain a box set. Wherein, the box of the i-th image / text token is K represents the total number of image and text tokens on this webpage. Each image and text token undergoes enhancement processing.

[0165] Step 720: Construct a first projection profile function that maps the enhanced image-text token to the first coordinate axis, and construct a second projection profile function that maps the enhanced image-text token to the second coordinate axis.

[0166] In this embodiment of the invention, the enhanced graphic token is mapped to a first coordinate axis, which can be the x-axis in the horizontal direction of a two-dimensional coordinate system. A first projection profile function Hbi(y) is constructed based on the mapping result. Similarly, the enhanced graphic token is mapped to a second coordinate axis, which can be the y-axis in the vertical direction of a two-dimensional coordinate system. A second projection profile function V is constructed based on the mapping result. B (x).

[0167] Specifically, the projected profile in the horizontal direction is calculated, each box is traversed and mapped to a one-dimensional horizontal direction, forming a series of projection intervals, and the corresponding indicator function is constructed.

[0168]

[0169] Summing all boxes yields the first projected profile function H. B (y), which is the number of boxes that intersect at y-values, and the first projection profile function H. B (y) is shown in the following formula:

[0170]

[0171] Similarly, calculate the projected profile in the vertical direction, iterate through each box and map it to the one-dimensional vertical direction, forming a series of projection intervals, and construct the corresponding indicator function.

[0172]

[0173] By summing all the boxes, we obtain the second projection profile function V. B (x), which represents the number of boxes that intersect at points x, and the second projection profile function V. B (x) is shown in the following formula:

[0174] Step 730: Determine the node position information of each of the graphic tokens when it is a leaf node in the website space browsing tree to be constructed according to the first projection profile function and the second projection profile function, and construct the website space browsing tree according to the node position information.

[0175] In this embodiment of the invention, the initial website space browsing tree has a root node without any index. Each image and text token is used as a leaf node in the website space browsing tree. When determining each image and text token as a leaf node, it is necessary to determine the node position information corresponding to each image and text token. The node position information can indicate which leaf node the image and text token is located in. The position of each leaf node in the website space browsing tree can indicate the position of the corresponding image and text token on the web page.

[0176] Step 740: Obtain the first feature vector based on the index of the leaf node in the website space browsing tree.

[0177] In this embodiment of the invention, each leaf node has a corresponding index in the website space browsing tree. The index can indicate the relationship between the leaf node and the root node, and the first feature vector representing the browsing order of the web pages can be obtained according to the index.

[0178] In this embodiment of the invention, considering the website browsing order issue and the potential noise problem generated by image-text tokens, the webpage is spatially recursively segmented, then enhanced, and finally a website spatial browsing tree is constructed, which can accurately represent the browsing order of webpages. The website spatial browsing tree provided in this embodiment of the invention can adapt to complex website page structures and generate different reasonable Chinese language browsing orders for websites, thereby improving the robustness and accuracy of the model and helping the model better understand the webpage content information.

[0179] In an exemplary embodiment of the present invention, please refer to Figure 8 Step 730, which determines the node position information of each graphic token as a leaf node in the website space browsing tree to be constructed based on the first projection profile function and the second projection profile function, includes steps 810 to 830, which are detailed below:

[0180] Step 810: The set of points that are determined to be 0 from the first projection profile function is the first valley point, and the set of points that are determined to be 0 from the second projection profile function is the second valley point.

[0181] In this embodiment of the application, the first projection profile function H is taken as such. B The set of points where (y) = 0 This is recorded as the first valley point. The minimum value of the y-coordinate in the first projection profile function is y. min and maximum value y max The resulting set. Similarly, take the second projection profile function V. B The set of points (x) = 0 This is recorded as the second valley point. The minimum value of the x-coordinate in the first projection profile function is x. min and maximum value x max The set formed.

[0182] Step 820: Cut according to the first valley point and the second valley point respectively to obtain multiple first-type clusters and multiple second-type clusters.

[0183] In this embodiment of the invention, cutting is performed at the first valley point of the first projection profile function to obtain several first clusters. The y-coordinates of the boxes of their image and text tokens are arranged in descending order to form new leaf nodes of the website space browsing tree, thus obtaining the corresponding node position information. At this time, the task of "obtaining the page browsing order of length K" is divided into subtasks in each cluster, and the number of boxes is used as the sequence length.

[0184] Similarly, performing a cut at the second valley point of the second projection profile function yields several second-class clusters. Arranging the x-coordinates of the boxes of their image / text tokens in descending order creates new leaf nodes in the website space browsing tree, thus obtaining the corresponding node position information. At this point, the task of "obtaining the page browsing order of length K" is divided into subtasks within each cluster, with the number of boxes serving as the sequence length.

[0185] Step 830: Determine the node location information of the image and text tokens in the first cluster and the second cluster according to their corresponding coordinate values.

[0186] In this embodiment of the invention, the processes of steps 810 and 820 are recursively executed alternately in the horizontal and vertical directions until no sufficient valley points are left in the two projection profiles. If a cluster contains multiple boxes and it cannot be divided into horizontal and vertical projection profiles, the page browsing order within this cluster will follow a pre-set heuristic rule, that is, first descending vertically, and then extending to the right horizontally.

[0187] In this embodiment of the invention, the image and text tokens are used as leaf nodes of the website space browsing tree, which can well represent the browsing order of each image and text token on the web page, so as to obtain the first feature vector.

[0188] In an exemplary embodiment of the present invention, please refer to Figure 9 The enhancement process for each of the graphic tokens described in step 710 includes steps 910 to 930, which are detailed below:

[0189] Step 910: Determine the random variables corresponding to each of the graphic tokens on each coordinate axis based on the preset uniform distribution.

[0190] In this application embodiment, a method based on triples (δ) is proposed. x ,δ y The enhancement strategy for ρ). Specifically, taking the horizontal direction as an example, δ x It is the threshold that determines the horizontal movement of the box, δ y This determines the threshold for moving the box vertically. For the x-coordinate of each box, a random variable v is generated from a pre-defined uniform distribution (-1, 1). x Similarly, for the y-coordinate of each box, a random variable v is generated from a pre-defined uniform distribution (-1, 1). y .

[0191] Step 920: If the absolute value of the random variable is greater than a preset variable threshold, determine the movement data based on the absolute value of the random variable, and determine the movement direction based on the sign of the random variable.

[0192] In this embodiment of the application, the absolute value |v| of the random variable corresponding to each graphic token is used. x |and variable threshold δ x Compare, if |v x |>δ x Then the box will be based on v x The positive and negative values ​​are expressed by ρ|v with direction. x | Pixel unit movement, i.e., according to v x The sign of the molecule determines the direction of movement, and then the direction of movement is determined by ρ|v. x | Determine mobile data.

[0193] Similarly, the absolute value of the random variable corresponding to each image / text token, |v y |and variable threshold δ y Compare, if |v y |>δ y Then the box will be based on v y The positive and negative values ​​are expressed by ρ|v with direction. y | Pixel unit movement, i.e., according to v y The sign of the molecule determines the direction of movement, and then the direction of movement is determined by ρ|v. y | Determine mobile data.

[0194] Step 930: Enhance the coordinate values ​​of each graphic token according to the corresponding movement data and movement direction.

[0195] In this embodiment of the application, each graphic token is moved according to its coordinate values ​​in a determined direction and with moving data to achieve enhanced processing.

[0196] In this embodiment of the invention, the image and text token positions on web pages are often identified by noise. Instead of using additional manual annotation, this embodiment proposes an enhancement strategy for these potentially noisy image and text box information to improve the robustness of the model and save costs.

[0197] The illegal website identification device provided by the present invention will be described below. The illegal website identification device described below can be referred to in correspondence with the illegal website identification method described above. It should be noted that the device provided in the following embodiments belongs to the same concept as the method provided in the above embodiments, and the specific way in which each module and unit performs its operation has been described in detail in the method embodiments, and will not be repeated here.

[0198] In one exemplary embodiment of the present invention, please refer to Figure 10 , Figure 10 An exemplary embodiment of a device for identifying illegal websites includes:

[0199] The first determining module 1010 is configured to determine at least one of the website address and page content of the website to be identified; wherein, the website address includes at least one of the domain name, URL, and IP address;

[0200] The second determining module 1020 is configured to determine whether the website to be identified is a violation website based on at least one of the website address and page content.

[0201] In an exemplary embodiment of the present invention, the second determining module 1020 includes:

[0202] The first determining submodule is configured to determine whether the website to be identified is a violation website based on the website address;

[0203] The second determination submodule is configured to determine whether the website to be identified is a violation website based on the page content.

[0204] In an exemplary embodiment of the present invention, the first determining submodule includes:

[0205] The first determining unit is configured to determine whether the website to be identified is a violation website based on the characteristics of the website address; wherein, the characteristics of the website address include at least one of the following: DGA domain name characteristics, URL path characteristics, registration information characteristics, location characteristics, filing characteristics, URL arrangement characteristics, URL statistics characteristics, sensitive word characteristics, inbound and outbound link characteristics, access volume characteristics, access context characteristics, page text characteristics, page image characteristics, and page structure characteristics.

[0206] In an exemplary embodiment of the present invention, the first determining submodule includes:

[0207] The acquisition unit is configured to acquire the source code of the website to be identified;

[0208] The extraction unit is configured to extract implicit links from the website to be identified based on the source code, and determine the address information of the implicit links.

[0209] The second determining unit is configured to determine whether the website to be identified is a violation website based on the website address and the address information.

[0210] In an exemplary embodiment of the present invention, the extraction unit includes:

[0211] The first determining subunit is configured to determine the attribute value of the Uniform Resource Locator (URL) of the website to be identified and the size of the URL in the page content based on the source code.

[0212] Extract sub-units, configured to extract the implicit links based on the attribute values ​​and the dimensions.

[0213] In an exemplary embodiment of the present invention, the extraction subunit includes:

[0214] A first detector is configured to detect whether the attribute value is complete or abnormal, and to obtain a first detection result; and

[0215] A second detector is configured to detect whether the size meets the abnormal size requirement, and to obtain a second detection result; and

[0216] The third detector is configured to detect whether the Uniform Resource Locator displays an anomaly and obtain a third detection result.

[0217] An extractor is configured to extract the implicit link based on the first detection result, the second detection result, or the third detection result.

[0218] In one exemplary embodiment of the present invention, the second determining submodule includes:

[0219] The construction unit is configured to construct input features based on the page content;

[0220] The input unit is configured to input the input features into a preset website detection model to obtain the detection result output by the website detection model;

[0221] The third determining unit is configured to determine whether the website to be identified is a violation website based on the detection result.

[0222] In an exemplary embodiment of the present invention, the website detection model is trained based on a Transformer model, wherein a relative bias term is added to the self-attention mechanism of the Transformer model.

[0223] In one exemplary embodiment of the present invention, the illegal website identification device further includes:

[0224] The acquisition module is configured to acquire sample input features corresponding to the content of multiple sample pages; wherein, each sample page content includes at least one sample image / text token;

[0225] The input module is configured to input the sample input features into the self-attention mechanism to obtain the processing result output by the self-attention mechanism;

[0226] The calculation module is configured to calculate an attention score based on the processing result, and to calculate the relative bias item based on the browsing order and page content layout of the sample image and text tokens;

[0227] The training module is configured to train the Transformer model based on the attention score and the relative bias term to obtain the website detection model.

[0228] In an exemplary embodiment of the present invention, the building unit includes:

[0229] The first construction subunit is configured to construct, based on the page content, a first feature vector representing the browsing order of the page content, a second feature vector representing the layout of the page content, a third feature vector representing the positional relationship of the page content, a fourth feature vector representing the partitioning of the page content, and a fifth feature vector representing the semantics of the page content.

[0230] The input subunit is configured to input the second feature vector into the adaptive mapping layer to obtain the layout mapping feature vector output by the adaptive mapping layer;

[0231] The second construction subunit is configured to construct the input features of the page content based on the first feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the layout mapping feature vector.

[0232] In an exemplary embodiment of the present invention, the first construction subunit includes:

[0233] A cutter is configured to cut the page content to obtain multiple image and text tokens, and to enhance each of the image and text tokens.

[0234] The first builder is configured to construct a first projection profile function that maps the enhanced graphic token to a first coordinate axis, and to construct a second projection profile function that maps the enhanced graphic token to a second coordinate axis.

[0235] The second builder is configured to determine the node position information of each of the graphic tokens when they are leaf nodes in the website space browsing tree to be constructed, based on the first projection profile function and the second projection profile function, and to construct the website space browsing tree based on the node position information.

[0236] The first feature vector generator is configured to obtain the first feature vector based on the index of the leaf node in the website space browsing tree.

[0237] In one exemplary embodiment of the present invention, the second builder includes:

[0238] The first determination structure is configured such that the set of points determined to be 0 from the first projection profile function is the first valley point, and the set of points determined to be 0 from the second projection profile function is the second valley point;

[0239] The cutting structure is configured to cut according to the first valley point and the second valley point respectively, to obtain multiple first-type clusters and multiple second-type clusters;

[0240] The second determination structure is configured to determine the node location information based on the corresponding coordinate values ​​of the image and text tokens in the first cluster and the second cluster.

[0241] In one exemplary embodiment of the present invention, the cutter includes:

[0242] The third determination structure is configured to determine the random variables corresponding to each of the graphic tokens on each coordinate axis based on a preset uniform distribution;

[0243] The fourth structure is determined as follows: if the absolute value of the random variable is greater than a preset variable threshold, the movement data is determined based on the absolute value of the random variable, and the movement direction is determined based on the sign of the random variable.

[0244] The enhanced processing structure is configured to enhance the coordinate values ​​of each graphic token based on the corresponding movement data and movement direction.

[0245] Figure 11 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 11 As shown, the electronic device may include: a processor 1110, a communications interface 1120, a memory 1130, and a communication bus 1140, wherein the processor 1110, the communications interface 1120, and the memory 1130 communicate with each other via the communication bus 1140. The processor 1110 can call logical instructions in the memory 1130 to execute a method for identifying illegal websites, the method including:

[0246] Determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of a domain name, a URL, and an IP address;

[0247] Based on at least one of the website address and page content, determine whether the website to be identified is a violation website.

[0248] Furthermore, the logical instructions in the aforementioned memory 1130 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0249] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the illegal website identification method provided by the above methods, the method comprising:

[0250] Determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of a domain name, a URL, and an IP address;

[0251] Based on at least one of the website address and page content, determine whether the website to be identified is a violation website.

[0252] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the illegal website identification method provided by the above methods, the method comprising:

[0253] Determine at least one of the website address and page content of the website to be identified; wherein the website address includes at least one of a domain name, a URL, and an IP address;

[0254] Based on at least one of the website address and page content, determine whether the website to be identified is a violation website.

[0255] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0256] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0257] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying illegal websites, characterized in that, include: Determine the page content of the website to be identified; Based on the page content, determine whether the website to be identified is a violation website; The step of determining whether the website to be identified is a violation website based on the page content includes: Input features are constructed based on the page content; The input features are input into a preset website detection model to obtain the detection result output by the website detection model; wherein, the website detection model is trained based on the Transformer model, and a relative bias term is added to the self-attention mechanism of the Transformer model; Based on the detection results, determine whether the website to be identified is a violation website; The pre-defined website detection model training process includes: Obtain sample input features corresponding to the content of multiple sample pages; wherein, each sample page content includes at least one sample image / text token; The sample input features are input into the self-attention mechanism to obtain the processing result output by the self-attention mechanism; The attention score is calculated based on the processing result, and the relative bias is calculated based on the browsing order and page content layout of the sample image and text tokens. The Transformer model is trained based on the attention score and the relative bias term to obtain the website detection model.

2. The method for identifying illegal websites according to claim 1, characterized in that, Also includes: Based on the website address and the page content, determine whether the website to be identified is a violation website; wherein, the website address includes at least one of domain name, URL and IP address.

3. The method for identifying illegal websites according to claim 2, characterized in that, The step of determining whether the website to be identified is a violation website based on the website address and the page content includes: Based on the characteristics of the website address and the page content, it is determined whether the website to be identified is a violation website; wherein, the characteristics of the website address include at least one of the following: DGA domain name characteristics, URL path characteristics, registration information characteristics, location characteristics, filing characteristics, URL arrangement characteristics, URL statistics characteristics, sensitive word characteristics, inbound and outbound link characteristics, and traffic characteristics.

4. The method for identifying illegal websites according to claim 2, characterized in that, The step of determining whether the website to be identified is a violation website based on the website address and the page content includes: Obtain the source code of the website to be identified; Based on the source code, extract the implicit links from the website to be identified and determine the address information of the implicit links; The website to be identified is determined as a violation website based on the website address, the address information, and the page content.

5. The method for identifying illegal websites according to claim 4, characterized in that, The step of extracting implicit links from the website to be identified based on the source code includes: The attribute values ​​of the Uniform Resource Locator (URL) of the website to be identified and the size of the URL in the page content are determined based on the source code. The implicit link is extracted based on the attribute value and the size.

6. The method for identifying illegal websites according to claim 5, characterized in that, The step of extracting the implicit link based on the attribute value and the size includes: The system detects whether the attribute values ​​are complete or abnormal, and obtains a first detection result; and The second detection result is obtained by detecting whether the size meets the abnormal size requirements; and The third detection result is obtained by detecting whether the Uniform Resource Locator (URL) displays an anomaly. The implicit link is extracted based on the first detection result, the second detection result, or the third detection result.

7. The method for identifying illegal websites according to claim 1, characterized in that, The construction of input features based on the page content includes: Based on the page content, a first feature vector representing the browsing order of the page content, a second feature vector representing the layout of the page content, a third feature vector representing the positional relationship of the page content, a fourth feature vector representing the partitioning of the page content, and a fifth feature vector representing the semantics of the page content are constructed. The second feature vector is input into the adaptive mapping layer to obtain the layout mapping feature vector output by the adaptive mapping layer; The input features of the page content are constructed based on the first feature vector, the third feature vector, the fourth feature vector, the fifth feature vector, and the layout mapping feature vector.

8. The method for identifying illegal websites according to claim 7, characterized in that, The construction of the first feature vector representing the browsing order of the page content includes: The page content is segmented to obtain multiple image and text tokens, and each image and text token is enhanced. Construct a first projection profile function that maps the enhanced image-text token to a first coordinate axis, and construct a second projection profile function that maps the enhanced image-text token to a second coordinate axis; The node position information of each graphic token as a leaf node in the website space browsing tree to be constructed is determined according to the first projection profile function and the second projection profile function, and the website space browsing tree is constructed according to the node position information; The first feature vector is obtained based on the index of the leaf node in the website space browsing tree.

9. The method for identifying illegal websites according to claim 8, characterized in that, The step of determining the node position information of each of the graphic tokens as leaf nodes in the website space browsing tree to be constructed based on the first projection profile function and the second projection profile function includes: The set of points that are determined to be 0 from the first projection profile function is the first valley point, and the set of points that are determined to be 0 from the second projection profile function is the second valley point; By cutting according to the first valley point and the second valley point respectively, multiple first-type clusters and multiple second-type clusters are obtained; The node location information is determined by the corresponding coordinate values ​​of the graphic tokens in the first cluster and the second cluster.

10. The method for identifying illegal websites according to claim 8, characterized in that, The enhancement processing of each of the graphic tokens includes: The random variables corresponding to each of the graphic tokens on each coordinate axis are determined based on a preset uniform distribution. If the absolute value of the random variable is greater than a preset variable threshold, the movement data is determined based on the absolute value of the random variable, and the movement direction is determined based on the sign of the random variable. The coordinate values ​​of each graphic token are enhanced based on the corresponding movement data and movement direction.

11. A device for identifying illegal websites, characterized in that, include: The first determination module is configured to determine the page content of the website to be identified; The second determining module is configured to determine whether the website to be identified is a violation website based on the page content. The second determining module includes: The construction unit is configured to construct input features based on the page content; The input unit is configured to input the input features into a preset website detection model to obtain the detection result output by the website detection model; wherein the website detection model is trained based on a Transformer model, and a relative bias term is added to the self-attention mechanism of the Transformer model; The third determining unit is configured to determine whether the website to be identified is a violation website based on the detection result. The illegal website identification device also includes: The acquisition module is configured to acquire sample input features corresponding to the content of multiple sample pages; wherein, each sample page content includes at least one sample image / text token; The input module is configured to input the sample input features into the self-attention mechanism to obtain the processing result output by the self-attention mechanism; The calculation module is configured to calculate an attention score based on the processing result, and to calculate the relative bias item based on the browsing order and page content layout of the sample image and text tokens; The training module is configured to train the Transformer model based on the attention score and the relative bias term to obtain the website detection model.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the illegal website identification method as described in any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the illegal website identification method as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the illegal website identification method as described in any one of claims 1 to 10.

Images