URL detection methods, devices, electronic equipment, and storage media

Abstract

This application relates to the field of CDN service detection technology, and provides a URL detection method, apparatus, electronic device, and storage medium. The method includes: generating simulated non-cooperative service URL data based on cooperative service description data of a Content Delivery Network (CDN) using an attacker; extracting features from multiple fields of the simulated non-cooperative service URL data using a feature extraction unit to obtain field feature vectors corresponding to each field, and extracting features from the cooperative service description data to obtain a first cooperative service feature vector; determining the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector using a fully connected unit; and obtaining a URL detection result based on the service type. This method effectively improves the accuracy of URL detection while ensuring detection efficiency, and helps to accurately identify CDN non-cooperative service URLs.

Description

Technical Field

[0001] This application relates to the field of CDN service detection technology, and in particular to a URL detection method, apparatus, electronic device and storage medium. Background Technology

[0002] Currently, with the development of Content Delivery Network (CDN) services, targeted traffic fraud by CDN users, namely Internet Content Providers (ICPs), is on the rise.

[0003] Existing methods for detecting Uniform Resource Locators (URLs) for non-cooperative CDN-directed traffic mainly rely on expert experience and manual judgment. However, these methods are inefficient and require highly skilled personnel. Furthermore, the URLs for non-cooperative CDN services are highly variable, making it difficult to guarantee the accuracy of URL detection. Summary of the Invention

[0004] This application provides a URL detection method, apparatus, electronic device, and storage medium to address the shortcomings of existing technologies, such as low detection efficiency and difficulty in guaranteeing URL detection accuracy. This method requires no manual intervention and, through attackers and identifiers (including feature extraction units and fully connected units) in a generative adversarial network model, can accurately determine the service type (i.e., CDN cooperative service / CDN non-cooperative service) of simulated non-cooperative service URL data, thereby determining the URL detection result. This URL detection result can effectively characterize whether targeted traffic fraud corresponding to CDN non-cooperative service URLs has occurred. While ensuring detection efficiency, it effectively improves the accuracy of URL detection, helps to accurately identify CDN non-cooperative service URLs, reduces the risk of ICPs suffering from targeted traffic fraud, and lays the foundation for improving the automation and intelligence level of ICP targeted traffic fraud identification.

[0005] In a first aspect, embodiments of this application provide a URL detection method, the class generative adversarial network model including: an attacker and a recognizer, the recognizer including: a feature extraction unit and a fully connected unit, the method including the following steps.

[0006] The attacker generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN).

[0007] The feature extraction unit extracts features from multiple fields of the simulated non-cooperative business URL data to obtain the field feature vectors corresponding to each field, and extracts features from the cooperative business description data to obtain the first cooperative business feature vector.

[0008] The business type of the simulated non-cooperative business URL data is determined by the fully connected unit based on multiple field feature vectors and the first cooperative business feature vector.

[0009] Based on the business type, the URL detection result is obtained.

[0010] In one embodiment, the fully connected unit includes a fully connected attention layer and a first output layer. Determining the business type of the simulated non-cooperative business URL data using the fully connected unit based on multiple field feature vectors and the first cooperative business feature vector includes: determining the correlation result between each field feature vector and the first cooperative business feature vector using the attention mechanism in the fully connected attention layer; determining the attention weight corresponding to each of the multiple field feature vectors based on the correlation result of each field feature vector using the fully connected attention layer; determining the product between each field feature vector and its corresponding attention weight using the fully connected attention layer, and determining the sum of all products as a weighted sum result; and processing the weighted sum result using the first output layer to obtain the business type of the simulated non-cooperative business URL data.

[0011] In one embodiment, the recognizer further includes: an input layer for splitting the simulated non-cooperative business URL data into multiple fields; the feature extraction unit includes: a word embedding layer and a Long Short-Term Memory (LSTM) layer; the step of extracting features from the multiple fields of the simulated non-cooperative business URL data through the feature extraction unit to obtain field feature vectors corresponding to each of the multiple fields includes: converting the multiple fields into corresponding numerical vectors through the word embedding layer; and extracting features from the multiple numerical vectors through the LSTM layer to obtain field feature vectors corresponding to each of the multiple numerical vectors.

[0012] In one embodiment, the attacker includes: a service description encoder, a noise encoder, a merging layer, a decoder, and a second output layer. The step of generating simulated non-cooperative service URL data based on cooperative service description data from a Content Delivery Network (CDN) using the attacker includes: determining a second cooperative service feature vector corresponding to the cooperative service description data using the service description encoder; determining a noise feature vector corresponding to the acquired random noise data using the noise encoder; merging the second cooperative service feature vector and the noise feature vector using the merging layer to obtain a combined vector; extracting features from the combined vector using the decoder to generate initial simulated non-cooperative service URL data; and processing the initial simulated non-cooperative service URL data using the second output layer to obtain the simulated non-cooperative service URL data.

[0013] In one embodiment, the original class-generative adversarial network model includes an original attacker and an original recognizer. The class-generative adversarial network model is trained based on the following steps: S1, using the original attacker, generating simulated non-cooperative business URL data based on cooperative business description data samples and random noise data samples; S2, using the original recognizer, determining the predicted business type corresponding to the simulated non-cooperative business URL data based on the simulated non-cooperative business URL data and the cooperative business description data samples; S3, updating the model parameters of the original recognizer based on the predicted business type and the business type samples corresponding to the non-cooperative business URL data samples to obtain an updated recognizer; updating the model parameters of the original attacker based on the predicted business type to obtain an updated attacker; S4, using the updated recognizer as the new original recognizer and the updated attacker as the new original attacker, repeating the above steps S1-S3 until the final recognizer satisfies the convergence condition, and determining the final recognizer and the corresponding attacker as the trained class-generative adversarial network model.

[0014] In one embodiment, the method further includes: acquiring initial cooperative business description data; and serializing the initial cooperative business description data using a preset text preprocessor to obtain the cooperative business description data.

[0015] Secondly, embodiments of this application provide a URL detection device, which includes a generative adversarial network model comprising an attacker and an identifier, wherein the identifier comprises a feature extraction unit and a fully connected unit, and the device comprises the following modules.

[0016] The service type determination module is used to generate simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN) using the attack tool; to extract features from multiple fields of the simulated non-cooperative service URL data using the feature extraction unit to obtain the field feature vectors corresponding to each of the multiple fields, and to extract features from the cooperative service description data to obtain a first cooperative service feature vector; and to determine the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector using the fully connected unit.

[0017] The detection result determination module is used to obtain the URL detection result based on the business type.

[0018] Thirdly, embodiments of this application provide a terminal, including a memory, a transceiver, and a processor.

[0019] The memory is used to store computer programs; the transceiver is used to send and receive data under the control of the processor; the processor is used to read the computer programs in the memory and perform the following operations.

[0020] The attacker generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URLs to obtain field feature vectors for each field, and extracts features from the cooperative service description data to obtain a first cooperative service feature vector. The fully connected unit determines the service type of the simulated non-cooperative service URLs based on the multiple field feature vectors and the first cooperative service feature vector. Based on the service type, a URL detection result is obtained.

[0021] Fourthly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the URL detection method described in the first aspect.

[0022] Fifthly, embodiments of this application also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the URL detection method described in the first aspect.

[0023] In a sixth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the URL detection method described in the first aspect.

[0024] The URL detection method, apparatus, electronic device, and storage medium provided in this application generate simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN) using an attacker; extract features from multiple fields of the simulated non-cooperative service URL data using a feature extraction unit to obtain field feature vectors corresponding to each field, and extract features from the cooperative service description data to obtain a first cooperative service feature vector; determine the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector using a fully connected unit; and obtain the URL detection result based on the service type. This method requires no human intervention. By using attackers and recognizers (including feature extraction units and fully connected units) in a generative adversarial network model, it can accurately determine the service type (i.e., CDN cooperative service / CDN non-cooperative service) of simulated non-cooperative service URL data, and then determine the URL detection result. This URL detection result can effectively characterize whether targeted traffic fraud behavior corresponding to CDN non-cooperative service URLs has occurred. While ensuring detection efficiency, it effectively improves the accuracy of URL detection, helps to accurately identify CDN non-cooperative service URLs, reduces the risk of ICPs suffering from targeted traffic fraud, and lays the foundation for improving the automation and intelligence level of ICP targeted traffic fraud identification. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of a CDN service system provided by existing technology.

[0027] Figure 2 This is a flowchart illustrating the URL detection method provided in the embodiments of this application.

[0028] Figure 3 This is a schematic diagram of the attacker provided in the embodiments of this application.

[0029] Figure 4 This is a schematic diagram of the structure of the identifier provided in the embodiments of this application.

[0030] Figure 5 This is a schematic diagram of the URL detection device provided in the embodiments of this application.

[0031] Figure 6 This is a schematic diagram of the terminal structure provided in the embodiments of this application.

[0032] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0034] To better understand the embodiments of this application, the background technology will first be described in detail.

[0035] With the continuous development of mobile internet technology and 5G technology, and the arrival of the 5G+ era, the number of users in the mobile internet environment is gradually increasing. High-definition live streaming, such as 4K and 50fps original quality, is becoming more common, leading to a significant increase in inter-network traffic. The original single-site streaming service model can no longer meet user needs. At the same time, the limitations of a single operator's network bandwidth and the latency of cross-network responses all have varying degrees of impact on user experience. Using CDN acceleration for streaming media and image resources can provide users with a better mobile internet experience.

[0036] Against this backdrop, operators provide CDN services to accelerate content across the entire network, thereby enhancing user experience. CDN acceleration services primarily include: video-on-demand acceleration, live streaming acceleration, download acceleration, and acceleration of resources such as images and web pages, providing users with acceleration services from major national Internet Service Providers (ISPs) on personal computers (PCs), mobile phones, tablets, and set-top boxes.

[0037] For example, Figure 1 This is a schematic diagram of a CDN service system provided by existing technology. From... Figure 1 As can be seen, content center nodes, regional nodes, and edge service nodes are the main service nodes of the CDN network. These three nodes form a three-tiered network structure from top to bottom, collectively constituting the CDN's business system and realizing the "data service" function. The data service function in the CDN network includes: accessing, storing / caching, processing (data slicing, transcoding, etc.) and distributing user-accessed content.

[0038] The URL list for CDN-directed traffic data is limited to the URLs of business servers used in partner business applications (APPs), and cannot include URLs of servers from non-partner businesses. Existing methods for detecting non-partner business URLs in CDN-directed traffic mainly rely on expert experience and manual judgment. However, these methods are inefficient and require highly skilled personnel. Furthermore, CDN non-partner business URLs are highly variable, making it difficult to guarantee the accuracy of URL detection.

[0039] To address the aforementioned issues, embodiments of this application provide a URL detection method, apparatus, electronic device, and storage medium. This method requires no manual intervention and, through attackers and identifiers (including feature extraction units and fully connected units) in a generative adversarial network model, can accurately determine the service type (i.e., CDN cooperative service / CDN non-cooperative service) of simulated non-cooperative service URL data, thereby determining the URL detection result. This URL detection result can effectively characterize whether targeted traffic fraud behavior corresponding to CDN non-cooperative service URLs has occurred. While ensuring detection efficiency, it effectively improves the accuracy of URL detection, helps to accurately identify CDN non-cooperative service URLs, reduces the risk of ICPs suffering from targeted traffic fraud, and lays the foundation for improving the automation and intelligence level of ICP targeted traffic fraud identification.

[0040] Furthermore, existing Generative Adversarial Network (GAN) models mainly consist of two parts: a generator (G) and a discriminator (D). These two components compete against each other. Simply put, a discriminator is added during the generation process to distinguish between real and generated data, creating a competitive dynamic. The discriminator strives to differentiate between real and generated data, while the generator works to improve itself and generate data that can fool the discriminator—i.e., generated data (fake data). Over time, the generator and discriminator continuously compete. When the discriminator can no longer distinguish between real and fake data, the generator is considered to have achieved a high level of performance.

[0041] Existing Conditional Generative Adversarial Networks (CGANs) add a condition 'y' to the GAN framework. Conditions are incorporated into the generator and discriminator during training, allowing the trained model to generate the required data based on the set conditions. Both the generator and discriminator add extra information 'y' as a condition; 'y' can be any information, such as category information or data from other modalities. By feeding this extra information 'y' to the generator and discriminator, a conditional GAN ​​is achieved.

[0042] A notable characteristic of GANs is that after successful training, only the generator is typically retained, while the discriminator is mostly discarded. However, in a well-designed GAN, the generator and discriminator usually have roughly the same number of parameters. Discarding the discriminator means wasting half of its parameters. This application's embodiment modifies the discriminator, enabling it to be used for online identification of CDN-targeted traffic URLs.

[0043] Figure 2 This is a flowchart illustrating the URL detection method provided in an embodiment of this application. (Refer to...) Figure 2 This application provides a URL detection method. The class generative adversarial network model may include an attacker and a recognizer. The recognizer may include a feature extraction unit and a fully connected unit. The method includes the following steps 201 and 204.

[0044] Step 201: Using the attacker, generate simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN).

[0045] Among them, the attacker can also be called a CDN non-cooperative business URL attacker; the identifier can also be called a CDN targeted traffic URL fraud identifier.

[0046] Optionally, the cooperation business description data may include: description information such as the content and characteristics of the CDN cooperation business.

[0047] After obtaining the CDN's cooperative service description data, the electronic device processes the cooperative service description data through an attacker to generate simulated non-cooperative service URL data, providing data support for the subsequent identifier to determine the service type of the simulated non-cooperative service URL data.

[0048] In one embodiment, the attacker may include: a service description encoder, a noise encoder, a merging layer, a decoder, and a second output layer. The electronic device, using the attacker, generates simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN). This process may include: the electronic device determining a second cooperative service feature vector corresponding to the cooperative service description data using the service description encoder; the electronic device determining a noise feature vector corresponding to the acquired random noise data using the noise encoder; the electronic device merging the second cooperative service feature vector and the noise feature vector using the merging layer to obtain a combined vector; the electronic device extracting features from the combined vector using the decoder to generate initial simulated non-cooperative service URL data; and the electronic device processing the initial simulated non-cooperative service URL data using the second output layer to obtain simulated non-cooperative service URL data.

[0049] Optionally, the random noise data can be randomly sampled from a normal distribution by an electronic device, and can be represented by u.

[0050] It should be noted that the timing of the electronic device determining the second cooperative service feature vector through the service description encoder and the electronic device determining the noise feature vector through the noise encoder is not limited.

[0051] For example, Figure 3 This is a schematic diagram of the attack device provided in an embodiment of this application. From... Figure 3 As can be seen, the attacker mainly consists of an encoder and a decoder. The encoder includes a service description encoder and a noise encoder. The service description encoder is composed of a Long Short-Term Memory (LSTM) network with three LSTM layers, each with 64 neurons and the ReLU activation function. The noise encoder is also composed of three LSTM layers, each with 32 neurons and the ReLU activation function. In this way, the electronic device inputs the cooperative service description data into the service description encoder, obtaining the second cooperative service feature vector C corresponding to the cooperative service description data output by the encoder. Figure 3 (abbreviated as feature vector C). Simultaneously, the electronic device acquires random noise data u and inputs it into the noise encoder to obtain the noise feature vector U corresponding to the random noise sample u output by the noise encoder. Figure 3 (abbreviated as eigenvector U).

[0052] Next, the electronic device inputs the second cooperative service feature vector C and the noise feature vector U into the merging layer. The merging layer merges the second cooperative service feature vector C and the noise feature vector U to obtain the combined vector V. Figure 3 The decoder in the system consists of three LSTM layers, each with 128 neurons and a ReLU activation function. The electronic device inputs a concatenated vector V into the decoder, which extracts features from V to generate initial simulated non-cooperative business URL data. This initial simulated non-cooperative business URL data is then input into the second output layer for processing. Figure 3 The fully connected layer (Dense) is the second output layer. The number of neurons in the Dense fully connected layer is set to be the same as the dimension of the initial simulated non-cooperative business URL data. The activation function is set to softmax. The output of softmax is fed into the multi-class cross-entropy loss function, so that the dimension of the output result is transformed into the target dimension of the final output, thus obtaining the simulated non-cooperative business URL data.

[0053] In one embodiment, the method may further include: an electronic device acquiring initial cooperative business description data; the electronic device serializing the initial cooperative business description data using a preset text preprocessor to obtain cooperative business description data.

[0054] The initial cooperation business description data is unprocessed data.

[0055] Electronic devices can first receive the initial cooperative service description data sent by the CDN application party ICP forwarded by the CDN scheduling center, and then use a preset text preprocessor to serialize the initial cooperative service description data to obtain the cooperative service description data.

[0056] Step 202: Through the feature extraction unit, feature extraction is performed on multiple fields of the simulated non-cooperative business URL data to obtain the field feature vectors corresponding to each field, and feature extraction is performed on the cooperative business description data to obtain the first cooperative business feature vector.

[0057] The electronic device can extract features from multiple fields of the simulated non-cooperative business URL data through the feature extraction unit, obtaining the field feature vectors corresponding to each field. Simultaneously, the electronic device can also extract features from the cooperative business description data through the same feature extraction unit, obtaining a first cooperative business feature vector. This allows the fully connected unit to subsequently determine the business type of the simulated non-cooperative business URL data.

[0058] In one embodiment, the recognizer may further include: an input layer for splitting simulated non-cooperative business URL data into multiple fields; a feature extraction unit may include: a word embedding layer and a Long Short-Term Memory (LSTM) layer; the electronic device extracts features from the multiple fields of the simulated non-cooperative business URL data through the feature extraction unit to obtain field feature vectors corresponding to each field, which may include: the electronic device converting the multiple fields into their respective numerical vectors through the word embedding layer; the electronic device extracting features from the multiple numerical vectors through the LSTM layer to obtain field feature vectors corresponding to each of the multiple numerical vectors.

[0059] For example, a URL can typically be represented as: <scheme>:<scheme description>; the specific syntax rule is: scheme: / / host.domain:port / path / filename.

[0060] Here, scheme specifies the type of internet service. The most common type is Hypertext Transfer Protocol (HTTP).

[0061] domain: Specifies the internet domain name, such as: crazyit.org, fkjava.org, etc.

[0062] host: Specifies the host in this domain. If omitted, the default host for HTTP is the World Wide Web (WWW).

[0063] port: Specifies the port number of the host. The port number can usually be omitted; the default port number for HTTP services is 80.

[0064] path: Specifies the path on the remote server. This path can also be omitted. If omitted, the default path will be the root directory of the website.

[0065] filename: Specifies the name (i.e., filename) of the remote document. If this filename is omitted, it will typically locate files such as index.html, index.htm, or other files set up by the web server.

[0066] For example, Figure 4 This is a schematic diagram of the structure of the identifier provided in an embodiment of this application. Figure 4 As can be seen, the electronic device first splits the simulated non-cooperative business URL data into 6 fields through the input layer: scheme, domain, host, port, path, and filename. Figure 4In this design, the number of neurons in both the word embedding layer and the LSTM layer is set to 32, and the activation function is set to ReLU. In this way, the electronic device uses the word embedding layer to convert the six fields into their corresponding numerical vectors, and then uses the LSTM layer to extract features from these six numerical vectors, obtaining the field feature vectors corresponding to each of the six numerical vectors.

[0067] Optionally, the electronic device may extract features from the cooperative business description data through a feature extraction unit to obtain a first cooperative business feature vector. This may include: the electronic device converting the cooperative business description data into a target numerical vector through a word embedding layer; and the electronic device extracting features from the target numerical vector through an LSTM layer to obtain the first cooperative business feature vector.

[0068] Step 203: Using the fully connected unit, determine the business type of the simulated non-cooperative business URL data based on multiple field feature vectors and the first cooperative business feature vector.

[0069] After determining multiple field feature vectors and the first cooperative business feature vector, the electronic device analyzes and processes the multiple field feature vectors and the first cooperative business feature vector through a fully connected unit to obtain the business type (CDN cooperative business / CDN non-cooperative business) of the simulated non-cooperative business URL data.

[0070] In one embodiment, the fully connected unit may include a fully connected attention layer and a first output layer. The electronic device, through the fully connected unit, determines the business type of the simulated non-cooperative business URL data based on multiple field feature vectors and a first cooperative business feature vector. This determination may include: for each field feature vector among the multiple field feature vectors, the electronic device determines the correlation result between the field feature vector and the first cooperative business feature vector through the attention mechanism in the fully connected attention layer; the electronic device, through the fully connected attention layer, determines the attention weight corresponding to each of the multiple field feature vectors based on the correlation results; the electronic device, through the fully connected attention layer, determines the product between each field feature vector and its corresponding attention weight, and determines the sum of all products as a weighted sum result; the electronic device, through the first output layer, processes the weighted sum result to obtain the business type of the simulated non-cooperative business URL data.

[0071] from Figure 4As can be seen, the fully connected attention layer comprises two sub-fully connected attention layers (Denseattention). The electronic device inputs the aforementioned six field feature vectors and the first cooperative business feature vector into the fully connected attention layer. For each of the six field feature vectors, the electronic device uses the attention mechanism in the fully connected attention layer to focus on the relevant parts between the field feature vector and the first cooperative business feature vector, that is, to determine the correlation result between the field feature vector and the first cooperative business feature vector. In this way, the electronic device, through the fully connected attention layer, determines the attention weight corresponding to each of the six field feature vectors based on the correlation result corresponding to each of the six field feature vectors. Then, the electronic device, through the fully connected attention layer, can determine the product between each field feature vector and its corresponding attention weight, and determine the sum of all products as the weighted sum result. Finally, the electronic device inputs this weighted sum result into the first output layer for processing. Figure 4 The fully connected layer (Dense) in the first output layer contains one Dense fully connected neuron with the activation function set to sigmoid. The output of sigmoid is fed into the binary cross-entropy loss function. The final output value of the first output layer is 1 or 0 (1 represents that the simulated non-cooperative business URL data belongs to the CDN cooperative business, and 0 represents that the simulated non-cooperative business URL data belongs to the CDN non-cooperative business). The business type (CDN cooperative business / CDN non-cooperative business) of the simulated non-cooperative business URL data can be obtained.

[0072] In one embodiment, the original class generative adversarial network model may include: an original attacker and an original recognizer; the class generative adversarial network model is trained based on the following steps.

[0073] S1. Electronic devices generate simulated non-cooperative business URL data based on cooperative business description data samples and random noise data samples using the original attacker.

[0074] S2. The electronic device uses the original identifier to determine the predicted business type corresponding to the simulated non-cooperative business URL data based on the simulated non-cooperative business URL data and cooperative business description data samples.

[0075] S3. The electronic device updates the model parameters of the original recognizer based on the predicted business type and the business type sample corresponding to the non-cooperative business URL data sample, and obtains the updated recognizer; the electronic device updates the model parameters of the original attacker based on the predicted business type, and obtains the updated attacker.

[0076] S4. The electronic device uses the updated recognizer as the new original recognizer and the updated attacker as the new original attacker, and repeats the above steps S1-S3 until the final recognizer satisfies the convergence condition. The final recognizer and the corresponding attacker are then determined as the trained class generative adversarial network model.

[0077] Among them, the original class generative adversarial network model is an untrained model.

[0078] Optionally, the electronic device may determine that the final identifier meets the convergence condition if it determines that the final identifier cannot identify whether the simulated non-cooperative business URL data generated by the corresponding attacker is a CDN cooperative business or a CDN non-cooperative business.

[0079] Specifically, during the training of the original class generative adversarial network model (including the original attacker and the original recognizer), the electronic device can first acquire cooperative business description data samples, corresponding cooperative business URL data samples, corresponding non-cooperative business URL data samples, corresponding business type samples, corresponding business type samples, and random noise samples. Furthermore, the electronic device can initialize the model parameters of the original attacker and the original recognizer. The aforementioned cooperative business URL data samples and non-cooperative business URL data samples can be collectively referred to as URL data samples.

[0080] Next, in step S1, the electronic device inputs the cooperative business description data sample and the random noise sample into the original attacker. Based on the cooperative business description data sample and the random noise sample, the original attacker can generate simulated non-cooperative business URL data (fake data) corresponding to the aforementioned non-cooperative business URL data sample (real data sample). In step S2, the electronic device inputs the simulated non-cooperative business URL data and the cooperative business description data sample into the original recognizer. The original recognizer processes the simulated non-cooperative business URL data and the cooperative business description data sample to obtain the predicted business type corresponding to the simulated non-cooperative business URL data (hereinafter referred to as the first predicted business type for ease of representation). The original recognizer learns to assign a lower first prediction score to the first predicted business type. Furthermore, the electronic device can input the cooperative business URL data sample and the cooperative business description data sample into the original recognizer. The original recognizer processes the cooperative business URL data sample and the cooperative business description data sample to obtain the cooperative business URL. The original recognizer learns to assign a higher second prediction score to the second predicted business type corresponding to the data sample; S3, with the model parameters of the original attacker remaining unchanged, i.e., with the model parameters of the original attacker fixed, the original recognizer is trained: the electronic device can update the model parameters of the original recognizer according to the first predicted business type and the business type sample corresponding to the non-cooperative business URL data sample, as well as the business type sample corresponding to the second predicted business type and the cooperative business URL data sample, to obtain the updated recognizer; then, with the model parameters of the updated recognizer remaining unchanged, i.e., with the model parameters of the updated recognizer fixed, the original attacker is trained: the electronic device can update the model parameters of the original attacker according to the first predicted business type, with the goal of maximizing the first prediction score corresponding to the first predicted business type, to obtain the updated attacker. It can be understood that the first prediction score can be used as a reward in the learning process, thereby updating the model parameters of the original attacker.

[0081] Then, in step S4, the electronic device uses the updated recognizer as the new original recognizer and the updated attacker as the new original attacker, repeating steps S1-S3 until the final recognizer meets the convergence condition. The final recognizer and the corresponding attacker are then identified as the trained class generative adversarial network model. This class generative adversarial network model has high accuracy and strong generalization ability, which can guarantee the accuracy of the output results.

[0082] It should be noted that the original identifier is responsible for determining the extent of the difference between the simulated non-cooperative business URL data generated by the original attacker and the real non-cooperative business URL data sample.

[0083] For example, the cooperative business description data sample includes a large number of sub-cooperative business description data samples; the cooperative business URL data sample includes a large number of sub-cooperative business URL data samples, and the non-cooperative business URL data sample includes a large number of sub-non-cooperative business URL data samples; the business type samples corresponding to the cooperative business URL data samples include a large number of first sub-business type samples (all belonging to CDN cooperative businesses, carrying a marker of 1), and the business type samples corresponding to the non-cooperative business URL data samples include a large number of second sub-business type samples (all belonging to CDN non-cooperative businesses, carrying a marker of 0). Specifically, there is a one-to-one correspondence between the sub-cooperative business description data samples and the sub-cooperative business URL data samples, a one-to-one correspondence between the sub-cooperative business description data samples and the sub-non-cooperative business URL data samples, a one-to-one correspondence between the sub-cooperative business URL data samples and the first sub-business type samples, and a one-to-one correspondence between the sub-non-cooperative business URL data samples and the second sub-business type samples.

[0084] Example 1: For any cooperative service i (1≤i≤N) of the CDN, where N is the total number of cooperative services, assume that the number of sub-cooperative service description data samples included in the cooperative service description data sample is N, and any sub-cooperative service description data sample is available. express, ,in, Indicates the length of the target encoded sequence; Sub-cooperative business description data sample The corresponding sub-cooperative business URL data sample is available express, ,in, Indicates the length of the first target index sequence; Sub-cooperative business description data sample The corresponding non-cooperative business URL data sample is available. express, ,in, Indicates the length of the second target index sequence. Optional. and They can be equal or unequal.

[0085] Optionally, the method may further include: the electronic device performing unified serialization processing on the initial cooperative business description data sample to obtain a cooperative business description data sample; the electronic device marking the initial URL data sample corresponding to the initial cooperative business description data sample to obtain a target URL data sample; and the electronic device performing unified serialization processing on the target URL data sample to obtain a URL data sample.

[0086] The initial cooperation business description data sample and the corresponding initial URL data sample are both unprocessed samples.

[0087] The aforementioned tagging and serialization processes can both be referred to as preprocessing. Optionally, electronic devices can implement this preprocessing process using a preset text preprocessor.

[0088] The initial cooperation business description data sample includes a large number of sub-initial cooperation business description data samples. The corresponding initial URL data samples include: initial cooperation business URL data samples and initial non-cooperation business URL data samples. The initial cooperation business URL data samples include a large number of sub-initial cooperation business URL data samples, and the initial non-cooperation business URL data samples include a large number of sub-initial non-cooperation business URL data samples. The target URL data samples include: target cooperation business URL data samples and target non-cooperation business URL data samples. The target cooperation business URL data samples include a large number of sub-target cooperation business URL data samples, and the target non-cooperation business URL data samples include a large number of sub-target non-cooperation business URL data samples. There is a one-to-one correspondence between the sub-initial cooperation business description data samples and the sub-initial cooperation business URL data samples, as well as between the sub-initial cooperation business URL data samples and the sub-target non-cooperation business URL data samples.

[0089] Combining Examples 1 and 2, the initial cooperation business description data sample includes N sub-initial cooperation business description data samples. The electronic device takes the longest length among the N sub-initial cooperation business description data samples. As shown in Example 1, the target encoded sequence length is such that the electronic device performs unified serialization processing on N sub-initial cooperative service description data samples, padding the length of each sub-initial cooperative service description data sample with a length of 0. After unified serialization, N sub-cooperative business description data samples are obtained. Any sub-cooperative business description data sample is the one involved in Example 1. .

[0090] Combining Examples 1, 2, and 3, the electronic device marks the initial cooperative business URL data sample (including N sub-initial cooperative business URL data samples) as 1. The marked initial cooperative business URL data sample becomes the target cooperative business URL data sample (including N sub-target cooperative business URL data samples). Conversely, it marks the initial non-cooperative business URL data sample (including N sub-initial non-cooperative business URL data samples) as 0. The marked initial non-cooperative business URL data sample becomes the target non-cooperative business URL data sample (including N sub-target non-cooperative business URL data samples). The electronic device then selects the longest length among the N sub-target cooperative business URL data samples. As the first target index sequence length involved in Example 1, the electronic device performs unified serialization processing on N sub-target cooperative business URL data samples, padding the length of each sub-target cooperative business URL data sample with... After unified serialization, N sub-cooperative business URL data samples are obtained. Any sub-cooperative business URL data sample is the one involved in Example 1. Similarly, the electronic device takes the longest length among N sub-target non-cooperative business URL data samples. As the second target index sequence length involved in Example 1, the electronic device performs unified serialization processing on N sub-target non-cooperative business URL data samples, padding the length of each sub-target non-cooperative business URL data sample with... After unified serialization, N sub-non-cooperative business URL data samples are obtained. Any one of the sub-non-cooperative business URL data samples is the one involved in Example 1. .

[0091] Data sample describing sub-cooperative business and simulated non-cooperative business URL data For example, the objective function of the original recognizer can be expressed as: Objective function = ;in, This represents the model parameters of the original recognizer; This refers to the reward mentioned above. If the value is positive, then update the model parameters. To increase ,when If the value is negative, then update the model parameters. To reduce .

[0092] Step 204: Obtain URL detection results based on business type.

[0093] After determining the business type (CDN cooperative business / CDN non-cooperative business) of the simulated non-cooperative business URL data, the electronic device can obtain the URL detection result based on the business type. The URL detection result can effectively characterize whether targeted traffic fraud behavior corresponding to the CDN non-cooperative business URL has occurred.

[0094] In this embodiment, an attacker generates simulated non-cooperative service URL data based on the cooperative service description data of a Content Delivery Network (CDN). A feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URL data to obtain field feature vectors for each field, and extracts features from the cooperative service description data to obtain a first cooperative service feature vector. A fully connected unit determines the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector. Based on the service type, a URL detection result is obtained. This method requires no manual intervention. By using an attacker and a recognizer (including a feature extraction unit and a fully connected unit) in a generative adversarial network model, it can accurately determine the service type (i.e., CDN cooperative service / CDN non-cooperative service) of the simulated non-cooperative service URL data, thereby determining the URL detection result. This URL detection result can effectively characterize whether targeted traffic fraud corresponding to a CDN non-cooperative service URL has occurred. While ensuring detection efficiency, it effectively improves the accuracy of URL detection, helps to accurately identify CDN non-cooperative service URLs, reduces the risk of ICPs suffering from targeted traffic fraud, and lays the foundation for improving the automation and intelligence level of ICP targeted traffic fraud identification.

[0095] The URL detection device provided in the embodiments of this application is described below. The URL detection device described below can be referred to in correspondence with the URL detection method described above.

[0096] Figure 5 This is a schematic diagram of the URL detection device provided in an embodiment of this application. (Refer to...) Figure 5 This application provides a URL detection device. The generative adversarial network model includes an attacker and an identifier. The identifier includes a feature extraction unit and a fully connected unit. The device includes a service type determination module 501 and a detection result determination module 502.

[0097] The service type determination module 501 is used to generate simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN) through the attack tool; to extract features from multiple fields of the simulated non-cooperative service URL data through the feature extraction unit to obtain the field feature vectors corresponding to each of the multiple fields, and to extract features from the cooperative service description data to obtain the first cooperative service feature vector; and to determine the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector through the fully connected unit.

[0098] The detection result determination module 502 is used to obtain the URL detection result based on the business type.

[0099] Optionally, the fully connected unit may include: a fully connected attention layer and a first output layer; the business type determination module 501 is specifically used to determine the correlation result between the field feature vector and the first cooperative business feature vector for each field feature vector in the multiple field feature vectors through the attention mechanism in the fully connected attention layer; through the fully connected attention layer, determine the attention weight corresponding to each of the multiple field feature vectors according to the correlation result corresponding to each of the multiple field feature vectors; through the fully connected attention layer, determine the product between each field feature vector and the corresponding attention weight, and determine the sum of all products as a weighted sum result; through the first output layer, process the weighted sum result to obtain the business type of the simulated non-cooperative business URL data.

[0100] Optionally, the recognizer may further include: an input layer for splitting the simulated non-cooperative business URL data into multiple fields; the feature extraction unit may include: a word embedding layer and a Long Short-Term Memory (LSTM) layer; and a business type determination module 501, specifically used to convert the multiple fields into their respective numerical vectors through the word embedding layer; and to perform feature extraction on the multiple numerical vectors through the LSTM layer to obtain the field feature vectors corresponding to each of the multiple numerical vectors.

[0101] Optionally, the attacker may include: a service description encoder, a noise encoder, a merging layer, a decoder, and a second output layer; the service type determination module 501 is specifically used to determine the second cooperative service feature vector corresponding to the cooperative service description data through the service description encoder; determine the noise feature vector corresponding to the acquired random noise data through the noise encoder; merge the second cooperative service feature vector and the noise feature vector through the merging layer to obtain a combined vector; extract features from the combined vector through the decoder to generate initial simulated non-cooperative service URL data; and process the initial simulated non-cooperative service URL data through the second output layer to obtain the simulated non-cooperative service URL data.

[0102] Optionally, the original class-based generative adversarial network model includes: an original attacker and an original recognizer; this class-based generative adversarial network model is trained based on the following steps: S1, using the original attacker, generating simulated non-cooperative business URL data based on cooperative business description data samples and random noise data samples; S2, using the original recognizer, determining the predicted business type corresponding to the simulated non-cooperative business URL data based on the simulated non-cooperative business URL data and the cooperative business description data samples; S3, updating the model parameters of the original recognizer based on the predicted business type and the business type samples corresponding to the non-cooperative business URL data samples, obtaining an updated recognizer; updating the model parameters of the original attacker based on the predicted business type, obtaining an updated attacker; S4, using the updated recognizer as the new original recognizer, and using the updated attacker as the new original attacker, repeating the above steps S1-S3 until the final recognizer satisfies the convergence condition, and determining the final recognizer and the corresponding attacker as the trained class-based generative adversarial network model.

[0103] Optionally, the business type determination module 501 is also used to obtain initial cooperation business description data; and to serialize the initial cooperation business description data using a preset text preprocessor to obtain the cooperation business description data.

[0104] The terminal involved in the embodiments of this application may be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The name of the terminal device may differ in different systems; for example, in a 5G system, the terminal device may be called a User Equipment (UE).

[0105] Figure 6 This is a schematic diagram of the terminal structure provided in the embodiments of this application, with reference to... Figure 6 This application also provides a terminal, which may include: a memory 610, a transceiver 620, and a processor 630.

[0106] The memory 610 is used to store computer programs; the transceiver 620 is used to send and receive data under the control of the processor 630; the processor 630 is used to read the computer programs in the memory 610 and perform the following operations.

[0107] This attack tool generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URLs to obtain the corresponding field feature vectors. It then extracts features from the cooperative service description data to obtain a first cooperative service feature vector. The fully connected unit determines the service type of the simulated non-cooperative service URLs based on the multiple field feature vectors and the first cooperative service feature vector. Finally, based on this service type, a URL detection result is obtained.

[0108] Among them, Figure 6 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 630) and memory (memory 610). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 620 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, the user interface 640 can also be an interface capable of connecting external or internal devices as needed.

[0109] The processor 630 is responsible for managing the bus architecture and general processing, while the memory 610 can store the data used by the processor 630 when performing operations.

[0110] The processor 630 executes any of the methods described in the embodiments of this application according to the obtained executable instructions by calling a computer program stored in the memory 610. The processor and the memory may also be physically separated.

[0111] It should be noted that the terminal provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0112] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 7As shown, the electronic device may include a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 may call a computer program stored in the memory 730 to execute the steps of the URL detection method, including the following steps.

[0113] This attack tool generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URLs to obtain the corresponding field feature vectors. It then extracts features from the cooperative service description data to obtain a first cooperative service feature vector. The fully connected unit determines the service type of the simulated non-cooperative service URLs based on the multiple field feature vectors and the first cooperative service feature vector. Finally, based on this service type, a URL detection result is obtained.

[0114] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0115] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the URL detection method provided in the above embodiments, including the following steps.

[0116] This attack tool generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URLs to obtain the corresponding field feature vectors. It then extracts features from the cooperative service description data to obtain a first cooperative service feature vector. The fully connected unit determines the service type of the simulated non-cooperative service URLs based on the multiple field feature vectors and the first cooperative service feature vector. Finally, based on this service type, a URL detection result is obtained.

[0117] In another aspect, embodiments of this application also provide a processor-readable storage medium storing a computer program for causing a processor to execute the steps of the URL detection method provided in the above embodiments, including the following steps.

[0118] This attack tool generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative service URLs to obtain the corresponding field feature vectors. It then extracts features from the cooperative service description data to obtain a first cooperative service feature vector. The fully connected unit determines the service type of the simulated non-cooperative service URLs based on the multiple field feature vectors and the first cooperative service feature vector. Finally, based on this service type, a URL detection result is obtained.

[0119] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0120] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0121] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A URL detection method, characterized in that, The generative adversarial network model includes an attacker and a recognizer, wherein the recognizer includes a feature extraction unit and a fully connected unit, and the method includes: The attacker generates simulated non-cooperative service URLs based on the cooperative service description data of the Content Delivery Network (CDN). The feature extraction unit extracts features from multiple fields of the simulated non-cooperative business URL data to obtain the field feature vectors corresponding to each of the multiple fields, and extracts features from the cooperative business description data to obtain the first cooperative business feature vector. The business type of the simulated non-cooperative business URL data is determined by the fully connected unit based on multiple field feature vectors and the first cooperative business feature vector; Based on the business type, the URL detection result is obtained.

2. The URL detection method according to claim 1, characterized in that, The fully connected unit includes a fully connected attention layer and a first output layer; determining the business type of the simulated non-cooperative business URL data through the fully connected unit based on multiple field feature vectors and the first cooperative business feature vector includes: For each of the multiple field feature vectors, the correlation between the field feature vector and the first cooperative business feature vector is determined through the attention mechanism in the fully connected attention layer; Through the fully connected attention layer, the attention weights corresponding to each of the multiple field feature vectors are determined based on the correlation results corresponding to each of the multiple field feature vectors. The fully connected attention layer determines the product between the feature vector of each field and the corresponding attention weight, and the sum of all products is determined as the weighted sum result. The first output layer processes the weighted sum result to obtain the business type of the simulated non-cooperative business URL data.

3. The URL detection method according to claim 1, characterized in that, The recognizer further includes: an input layer, which is used to split the simulated non-cooperative business URL data into multiple fields; the feature extraction unit includes: a word embedding layer and a Long Short-Term Memory (LSTM) network layer. The step of extracting features from multiple fields of the simulated non-cooperative business URL data through the feature extraction unit to obtain the field feature vectors corresponding to each of the multiple fields includes: The word embedding layer converts the multiple fields into their respective numerical vectors. The LSTM layer is used to extract features from multiple numerical vectors to obtain the field feature vectors corresponding to each of the multiple numerical vectors.

4. The URL detection method according to claim 1, characterized in that, The attacker includes: a service description encoder, a noise encoder, a merging layer, a decoder, and a second output layer; the attacker generates simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN), including: The business description encoder determines the second cooperative business feature vector corresponding to the cooperative business description data; the noise encoder determines the noise feature vector corresponding to the acquired random noise data. The merging layer merges the second cooperative business feature vector and the noise feature vector to obtain a combined vector; the decoder extracts features from the combined vector to generate initial simulated non-cooperative business URL data. The initial simulated non-cooperative business URL data is processed through the second output layer to obtain the simulated non-cooperative business URL data.

5. The URL detection method according to any one of claims 1-4, characterized in that, The original class-based generative adversarial network model includes: an original attacker and an original recognizer; the class-based generative adversarial network model is trained based on the following steps: S1. Using the original attack tool, simulated non-cooperative business URL data is generated based on cooperative business description data samples and random noise data samples; S2. Using the original identifier, determine the predicted business type corresponding to the simulated non-cooperative business URL data based on the simulated non-cooperative business URL data and the cooperative business description data sample; S3. Based on the predicted business type and the business type sample corresponding to the non-cooperative business URL data sample, update the model parameters of the original recognizer to obtain the updated recognizer; based on the predicted business type, update the model parameters of the original attacker to obtain the updated attacker. S4. Take the updated recognizer as the new original recognizer and the updated attacker as the new original attacker, and repeat the above steps S1-S3 until the final recognizer satisfies the convergence condition. Then, determine the final recognizer and the corresponding attacker as the trained class generative adversarial network model.

6. The URL detection method according to any one of claims 1-4, characterized in that, The method further includes: Obtain initial cooperation business description data; The initial cooperative business description data is serialized using a preset text preprocessor to obtain the cooperative business description data.

7. A URL detection device, characterized in that, The generative adversarial network model includes an attacker and an identifier, wherein the identifier includes a feature extraction unit and a fully connected unit, and the device includes: The service type determination module is used to generate simulated non-cooperative service URL data based on the cooperative service description data of the Content Delivery Network (CDN) using the attack tool; to extract features from multiple fields of the simulated non-cooperative service URL data using the feature extraction unit to obtain the field feature vectors corresponding to each of the multiple fields, and to extract features from the cooperative service description data to obtain a first cooperative service feature vector; and to determine the service type of the simulated non-cooperative service URL data based on the multiple field feature vectors and the first cooperative service feature vector using the fully connected unit. The detection result determination module is used to obtain the URL detection result based on the business type.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the URL detection method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the URL detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the URL detection method as described in any one of claims 1 to 6.

Images