Gambling website identification method and equipment based on POST message aggregation and medium

Abstract

The invention relates to a POST message aggregation-based gambling website identification method and device and a medium, and the method comprises the following steps: S1, obtaining POST messages of a website, performing tabulation processing, and extracting key features; s2, integrating the key features by adopting a meta-embedding aggregation feature integration method, so that POST messages generated based on the same template are weighted and integrated into a record, and normalized data are obtained; s3, pre-training is carried out by adopting a variational auto-encoder, a graph structure is established, node embedding representation is extracted from the graph structure, clustering results are mapped to a gambling website template through agglomeration hierarchical clustering to form marks, and marked data are obtained; s4, performing preliminary feature extraction on the marked data, screening through a mutual information method to obtain message high-correlation features, and processing through a multi-scale fusion attention mechanism to obtain fusion data; and S5, performing multi-classification through the variational graph convolutional network, and outputting an identification result. Compared with the prior art, gambling websites can be identified efficiently and accurately.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and traffic analysis, and in particular relates to a gambling website identification method, device and medium based on POST message aggregation. Background Art

[0002] Nowadays, the Internet is the main way for people to obtain information, but it is also full of malicious content, especially gambling websites, which have caused great harm to society. Existing gambling website identification methods can be mainly summarized into the following categories: blacklist method, URL feature-based identification method, web page content identification method and hybrid feature method. Although the above methods can assist in identifying gambling websites to a certain extent, they also have some defects:

[0003] 1) The blacklist method relies on the collection and maintenance of malicious URLs (Uniform Resource Locator) or domain names. This method is more effective in identifying known gambling websites, but it has problems such as high maintenance costs and inability to respond to the emergence of new gambling websites in a timely manner. Over time, the effectiveness and coverage of the blacklist will decrease.

[0004] 2) The recognition method based on URL features classifies by analyzing the text patterns in the URL, but the information contained in the URL is relatively limited, making it difficult to accurately distinguish between normal websites and gambling websites. Therefore, this method has a low accuracy rate and cannot effectively identify complex gambling websites.

[0005] 3) Web content recognition methods identify gambling websites by analyzing content features such as HTML text, images, links, JavaScript codes, etc. However, this method has certain limitations when dealing with the complexity of web content. In addition, gambling websites often use dynamic loading technology or content obfuscation strategies to evade detection, further increasing the difficulty of identification.

[0006] 4) The hybrid feature method combines multiple features such as URL and web page content to improve the accuracy of classification, but it is still difficult to guarantee efficiency and accuracy when faced with large amounts of data and complex features. In particular, when gambling websites are automatically generated using template technology, traditional hybrid feature methods are difficult to deal with effectively.

[0007] In summary, although the existing gambling website identification methods can provide certain effects in specific scenarios, they still have many shortcomings when facing the ever-changing and complex gambling websites. Therefore, it is urgent to design a new gambling website identification method that can efficiently and accurately identify gambling websites. Summary of the invention

[0008] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a gambling website identification method, device and medium based on POST message aggregation to efficiently and accurately identify gambling websites.

[0009] The purpose of the present invention can be achieved by the following technical solutions:

[0010] The present invention provides a gambling website identification method based on POST message aggregation, comprising the following steps:

[0011] S1. Obtain the POST message of the website and process it in a table to generate structured data, and extract key features based on the structured data, including the URL in the request line, the Cookie parameter in the request header, and the request body related parameters;

[0012] S2, using a meta-embedded aggregate feature integration method to integrate the key features extracted in step S1 to obtain normalized data, in which POST messages generated based on the same template are weighted and integrated into one record;

[0013] S3, using a variational autoencoder to pre-train the normalized data to obtain a low-dimensional feature representation, and then establish a graph structure, using a graph autoencoder to extract node embedding representations from it, perform agglomerative hierarchical clustering, and map the clustering results to the gambling website template to form a label to obtain labeled data;

[0014] S4, performing preliminary feature extraction on the labeled data, screening to obtain highly relevant features of the message through the mutual information method, and processing through a multi-scale fusion attention mechanism to obtain fused data;

[0015] S5. Establish a graph structure according to the fused data, initialize the node representation in the graph through a variational autoencoder, and then send it into a variational graph convolutional network for multi-classification, and output the recognition result.

[0016] Furthermore, in step S1, the generation process of the structured data is specifically as follows:

[0017] Use the Fiddler tool to capture the POST message of the website, extract the request line of the POST message as a header to record the request line information, including the request method, URL and protocol version; extract the request header of the POST message as a header to record the request header parameters, including Cookie, User-Agent and Referer; extract the request body content of the POST message as a header to record the request body data, including form data or JSON data.

[0018] Furthermore, the specific process of step S2 is as follows:

[0019] S201, using the pre-trained Word2Vec model, the URL, Cookie parameters and request body related parameters in each POST message are represented as embedded vectors;

[0020] S202: Perform weighted averaging on the embedding vectors of the POST messages generated based on the same template to obtain a comprehensive vector v site :

[0021]

[0022] Where n represents the number of POST messages generated by the same template, a i represents the weight of the i-th message, v i Represents the embedding vector of the i-th message.

[0023] Furthermore, in step S3, the process of establishing the graph structure based on the low-dimensional feature representation is specifically as follows:

[0024] Each low-dimensional feature is represented as a node, the similarity between nodes is calculated by Euclidean distance, and then the weight is calculated as the edge. The weight calculation formula is as follows:

[0025]

[0026] d ij =||z i -z j ||

[0027] Among them, w ij is the weight between the i-th node and the j-th node, d ij is the i-th low-dimensional feature representation z i and the jth low-dimensional feature representation z j The similarity between them is σ, and σ is the scale parameter of the distance.

[0028] Furthermore, in step S3, the parameters of the variational autoencoder are optimized by maximizing the variational lower bound.

[0029] Furthermore, in step S3, when performing agglomerative hierarchical clustering, the clustering strategy is dynamically adjusted according to the semantic information of the graph structure and the embedding representation extracted by the graph autoencoder.

[0030] Furthermore, in step S4, TF-IDF technology is used to extract features from the labeled data.

[0031] Furthermore, in step S5, the multi-classification task is iteratively trained with the goal of minimizing the cross entropy loss function.

[0032] The present invention also provides an electronic device, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the above method when executing the program.

[0033] The present invention also provides a computer-readable storage medium on which a computer program is stored, and the program implements the above method when executed by a processor.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] Many gambling websites are automatically generated using website building script technology. These websites have highly similar HTTP POST data features. Therefore, the present invention provides a gambling website identification method based on POST message aggregation. First, the POST message of the website is tabulated and key features are extracted, including the URL in the request line, the Cookie parameter in the request header and the request body related parameters. Then, the extracted key features are integrated using a meta-embedded aggregation feature integration method, so that the POST messages generated based on the same template are weighted and integrated into a record to obtain normalized data, thereby improving the consistency of the data and helping to improve the accuracy of subsequent identification. Subsequently, a variational autoencoder is used to pre-train the normalized data to obtain a low-dimensional feature representation, and then a graph structure is established. A graph autoencoder is used to extract a node embedding representation from it, and agglomerative hierarchical clustering is performed. The clustering results are mapped to the gambling website template to form a label to obtain the labeled data. This step not only considers the distance in the feature space, but also utilizes the graph. Structural information is used to aggregate similar POST messages more accurately, further improving the clustering effect and recognition accuracy. Secondly, preliminary feature extraction is performed on the labeled data, and high-correlation features of the messages are obtained by screening through the mutual information method. The fused data is processed through a multi-scale fusion attention mechanism to obtain fused data. The fused data not only combines the correlation of text information and mutual information selection, but also incorporates the interactive relationship at multiple scales, thereby effectively improving the accuracy and effect of classification. Finally, a graph structure is established based on the fused data, and the node representation in the graph is initialized by a variational autoencoder and then sent to a variational graph convolutional network for multi-classification, and the recognition results are output. The variational graph convolutional network combines variational reasoning and graph convolution operations. By introducing hidden variables to represent the potential spatial distribution of data, it can better capture the uncertainty and complexity in the data, and can also achieve accurate and efficient classification when facing complex distributed graph data. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flow chart of the method of the present invention;

[0037] Figure 2 It is a flowchart of the multi-level focusing feature extraction method;

[0038] Figure 3 Flowchart of data processing for variational graph convolutional networks. DETAILED DESCRIPTION

[0039] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0040] Example:

[0041] This embodiment provides a gambling website identification method based on POST message aggregation, such as Figure 1 As shown, the following steps are included:

[0042] S1. Obtain the POST message of the website and process it in a table to generate structured data. Extract key features based on the structured data. The specific steps are as follows:

[0043] S11. Use the Fiddler tool to capture the POST messages of the website, focusing on capturing the POST message data related to operations such as login, registration, adding bank cards, and betting.

[0044] S12, extract the request line of the POST message into a header, record the request method, URL and protocol version and other information; extract the request header of the POST message into a header, record the various parameters in the request header, such as Cookie, User-Agent, Referer, etc.; extract the request body content of the POST message into a header, used to record the request body data, usually form data or JSON data. Finally, the POST message is structured and organized into a table format.

[0045] S13. Analyze the structured data to identify key features that help cluster websites. These features include the URL in the request line, the Cookie parameter in the request header, and the related parameters in the request body. Each feature corresponds to a column in the table.

[0046] S2. The key features extracted in step S1 are integrated by using the meta-embedded aggregation feature integration method, and the POST messages generated based on the same template are weighted and integrated into one record to obtain normalized data. The specific steps are as follows:

[0047] S21. Use the pre-trained Word2Vec model to represent the URL, Cookie parameters, and request body related parameters in each POST message as an embedded vector.

[0048] The goal of Word2Vec is to learn the embedding vector of each word by maximizing the co-occurrence probability of the target word and its context words. For each word w and context c, Word2Vec learns the embedding vector by maximizing the following objective function:

[0049]

[0050] Among them, P(c|w) represents the probability calculated by the softmax function.

[0051] S202, weighted average the embedding vectors of the POST messages generated based on the same template to generate a comprehensive vector representation. This process ensures that all messages from the same website can be integrated into one record to uniformly reflect the overall characteristics of the website. For n POST messages from the same website, their embedding vectors are represented as v1, v2, …, v n , after weighted averaging, we get the comprehensive vector v site , expressed as:

[0052]

[0053] Among them, a i The weight of the i-th message can be set according to the importance of the message. In this embodiment, the importance of each behavior is ranked as follows: betting>adding bank card>entering game>login>registering>others.

[0054] Step S2 can effectively aggregate multiple POST messages generated under the same template through the meta-embedded aggregation feature integration method, thereby integrating the data of the same website into one record. This integration not only improves the consistency and standardization of the data, but also enhances the recognition ability of the model.

[0055] S3. Pre-train the normalized data using a variational autoencoder to obtain a low-dimensional feature representation, and then establish a graph structure. Use the graph autoencoder to extract node embedding representations from it, perform agglomerative hierarchical clustering, and map the clustering results to the gambling website template to form a label to obtain the labeled data. The specific steps are as follows:

[0056] S31. Pre-train the normalized data through variational autoencoder (VAE) to obtain low-dimensional feature representation.

[0057] Normalized data is a high-dimensional feature vector, denoted as Among them, d represents the feature dimension.

[0058] For the encoder, the high-dimensional input data x is mapped to the latent space

[0059]

[0060] where μ φ (x) and σ φ (x) are the mean and variance functions of the latent space respectively, and I is the identity matrix.

[0061] For the decoder, the feature z in the latent space is reconstructed back to the original high-dimensional space:

[0062]

[0063] Among them, μ φ (z) and σ θ (z) is the decoder function.

[0064] The parameters of the VAE are then optimized by maximizing the variational lower bound (ELBO):

[0065]

[0066] Among them, D KL represents the Kullback-Leibler divergence, which is used to measure the difference between the latent space distribution and the prior distribution p(z).

[0067] Finally, a low-dimensional feature representation is generated Used for subsequent graph structure construction.

[0068] S32. Use low-dimensional feature representation to construct a graph structure that reflects the similarity of POST message data.

[0069] Each low-dimensional feature is represented as a node, and the similarity between nodes is calculated by Euclidean distance:

[0070] d ij =||z i -z j || (6)

[0071] By calculating the similarity, we construct the edge weight w ij , the formula is as follows:

[0072]

[0073] Among them, w ij is the weight between the i-th node and the j-th node, d ij is the i-th low-dimensional feature representation z i and the jth low-dimensional feature representation z j The similarity between them is σ, and σ is the scale parameter of the distance.

[0074] Then all POST message nodes and their similarity edges are connected to form a graph structure G = (V, E), where V is the node set and E is the edge set.

[0075] S32. Use graph autoencoder (GAE) to extract high-quality node embedding representations.

[0076] Input graph structure G = (V, E) and node feature matrix Z, and then use graph convolutional network (GCN) to extract the embedded representation of the node:

[0077] H (l+1) =σ(AH (l) W (l) ) (8)

[0078] Among them, H (0) = Z, A is the normalized adjacency matrix, W (l) is the weight matrix of the lth layer, and σ is the nonlinear activation function.

[0079] The graph structure is reconstructed, and the decoder optimizes the embedding representation by minimizing the reconstruction error. Finally, a high-quality node embedding representation H is output for subsequent clustering analysis.

[0080] S34. Based on the node representation generated by graph embedding, an agglomerative hierarchical clustering algorithm is applied to cluster the POST message data.

[0081] Using the node embedding representation H extracted from GAE, the distance between nodes is calculated in the embedding space as the basis for the clustering process:

[0082] d ij =||h i -h j || (9)

[0083] Through the agglomerative hierarchical clustering algorithm, similar nodes are gradually clustered together. The algorithm forms the final clustering result by continuously merging the most similar nodes or node groups. During the clustering process, the clustering strategy is dynamically adjusted by combining the graph structure information and the feature representation obtained by self-supervised learning to improve the accuracy and consistency of the clustering results.

[0084] S35, according to the clustering results, each POST message data is marked accordingly for further analysis and processing. Each clustering result is mapped to a specific website template to form a mark, and a marked POST message data set is generated for subsequent classification and analysis steps.

[0085] For the high-dimensional data obtained in step S2, step S3 proposes a graph embedding self-supervised hierarchical clustering method. This method combines self-supervised feature learning with graph embedding technology to enhance the performance of traditional agglomerative hierarchical clustering on high-dimensional data. First, the POST message data is pre-trained by variational autoencoder (VAE). The self-supervisory mechanism enables the model to learn the intrinsic representation of the data, compress the features of different messages into a low-dimensional space, and maintain the semantic relationship between the features. These semantic relationships are reflected in the similarity between feature vectors, which can capture the intrinsic connection between different POST messages in request structure, parameter settings and their contents. After obtaining the low-dimensional feature representation generated by self-supervised learning, a graph structure is constructed, and a graph autoencoder (GAE) is used to further extract high-quality embedding representations of nodes. At this time, the semantic relationship extracted by graph embedding is reflected by the edge connection between nodes. These edges represent the similarity of POST messages in the feature space, so that similar messages are closely connected in the graph. On this basis, the node representation generated by graph embedding is used for agglomerative hierarchical clustering. This clustering method not only considers the distance in the feature space, but also utilizes the global information in the graph structure, so that similar POST messages can be clustered together more accurately. In addition, the clustering strategy is dynamically adjusted during the clustering process, combining the semantic relationship extracted by graph embedding and the features of self-supervised learning. Specifically, the algorithm monitors the distribution of clustering results in real time during the clustering process, and adaptively adjusts the number of clusters or merges clusters with high similarity based on the similarity and semantic relationship of the features. When it is found that the number of samples in some clusters is too small or the similarity is low, the algorithm will automatically merge these clusters to ensure that the clustering results can accurately reflect the internal structure of the data. Finally, based on the clustering results of the website, each individual POST message data is marked accordingly.

[0086] S4, perform preliminary feature extraction on the labeled data, filter out high-correlation features of the message through the mutual information method, and process it through the multi-scale fusion attention mechanism to obtain fused data, such as Figure 2 As shown, the specific steps are as follows:

[0087] S41. Use the TF-IDF (Term Frequency-Inverse Document Frequency) method to vectorize the request header, the Cookie parameter in the request line, and the text data in the request body.

[0088] TF-IDF measures the importance of a term in a specific document by calculating the frequency of the term in the document and its inverse document frequency in the entire corpus. Each text feature is represented as a sparse TF-IDF vector, as follows:

[0089]

[0090] where TF(t,d) is the frequency of term t in document d, N is the total number of documents in the corpus, and |{d∈D:t∈d}| is the number of documents containing term t.

[0091] S42. Based on the initially extracted TF-IDF vector, the mutual information method (MI) is used for feature selection. The mutual information method measures the information gain between the feature and the target variable to identify the most valuable features for the classification task. The definition of mutual information is as follows:

[0092]

[0093] Among them, X represents the feature variable, Y represents the target variable, and p(x,y) represents the joint probability distribution of X and Y. By calculating the mutual information between each feature and the target variable, the features with high correlation with the target variable (classification label) are screened out. Specifically, a threshold τ(0.1) is set, and when the mutual information value is greater than the threshold 0.1, the feature is retained. This process can effectively reduce the data dimension and improve the training efficiency and performance of the model.

[0094] S43. After completing feature selection, a multi-scale fusion attention mechanism is introduced to further process the selected features. This mechanism captures the interactive relationship and hierarchical information between features by modeling features at multiple scales. Specifically, the multi-scale fusion attention mechanism uses convolution kernels of different scales (the scale is set to 1, 3, and 5) to perform convolution operations in the feature space to obtain feature matrices F1, F2, and F3 at different scales. Then, the weighting coefficients are calculated through the attention mechanism, and the weights are determined by the importance of each scale feature. Finally, the comprehensive feature representation F is obtained. final . Its mathematical expression is as follows:

[0095]

[0096] in, represents the attention weight of each scale feature, F i is the feature matrix at different scales, d k is the dimension of the key vector. In this way, the model can comprehensively consider the feature representations at different scales, thereby comprehensively describing the data features of each POST request and improving the accuracy and effect of classification.

[0097] S44, after being processed by the multi-scale fusion attention mechanism, the feature representations at each scale are integrated into a final feature vector. This vector not only combines the correlation of text information and mutual information selection, but also incorporates the interactive relationship at multiple scales to form a comprehensive description of each POST request. The final feature vector is used in the subsequent classification model, which significantly improves the accuracy and effect of classification.

[0098] Step S4 proposes a multi-level focused feature extraction method. Based on the TF-IDF feature vectorization and mutual information method, this method introduces a multi-scale fusion attention mechanism to improve the effect of feature extraction. Specifically, the TF-IDF technology is first used to perform preliminary text feature extraction, and each text feature is represented as a sparse TF-IDF vector. Subsequently, the mutual information method is used to select features for the preliminary extracted TF-IDF vector, and the features with high correlation with the target variable (message feature) are retained. On this basis, a multi-scale fusion attention mechanism is introduced to further process the screened features. This mechanism distributes attention to different parts of the features by modeling the features at multiple scales to capture the interactive relationship and hierarchical information between the features. Finally, the feature representation processed by the multi-scale fusion attention mechanism is integrated into the final feature vector, which not only combines the correlation of text information and mutual information selection, but also incorporates the interactive relationship at multiple scales, thereby more comprehensively describing the data features of each POST request and improving the accuracy and effect of classification.

[0099] S5. Build a graph structure based on the fused data, initialize the node representation in the graph through the variational autoencoder, and then send it to the variational graph convolutional network for multi-classification, and output the recognition result. The specific steps are as follows:

[0100] S51. Construct an initial graph structure based on previously processed POST request data. The nodes of the graph represent the feature vectors of each POST request, and the edges of the graph are defined based on the similarity between POST requests. The cosine similarity is used to measure the similarity between feature vectors. For POST requests from the same website, a dense subgraph is constructed to reflect the strong correlation between them.

[0101] Let G = (V, E) be the constructed graph, where V is the node set and E is the edge set. i ∈V corresponds to a feature vector v of a POST request i , edge ij ∈E corresponds to node v i and v j The similarity between them. The weight of the edge w ij It can be expressed as:

[0102]

[0103] S52. After completing the graph structure construction, use the variational autoencoder (VAE) to initialize the representation of each node in the graph. The variational autoencoder is a generative model that represents the potential spatial distribution of data through hidden variables z. Figure 3 As shown, first, the initial feature vector v of the node is i Mapped into the latent space, we get the hidden variable z i , and then z is converted into i Remap back to the original feature space.

[0104] The loss function of VAE includes reconstruction error and KL divergence, where the reconstruction error measures the difference between the original data and the reconstructed data, and the KL divergence measures the difference between the distribution of the latent variable and the standard normal distribution. The goal of VAE is to minimize the loss function

[0105]

[0106] Among them, q(z|x) is the approximate posterior distribution, p(x|z) is the decoder distribution, and p(z) is the prior distribution.

[0107] S53. After the node representation is initialized, a variational graph convolutional network (VGCN) operation is performed. The variational graph convolutional network combines graph convolution and variational reasoning to better capture the uncertainty in the data. The graph convolution operation updates the node representation by aggregating the information of neighboring nodes. The formula is as follows:

[0108]

[0109] in, represents the feature representation of node i in the l+1th layer, represents the set of neighbor nodes of node i, c ij is the normalization coefficient, W (l) is a learnable weight matrix, and σ is the activation function ReLU.

[0110] S54. Finally, use the trained variational graph convolutional network to perform multi-classification tasks on the nodes in the graph and classify each node (POST request) into the corresponding website template.

[0111] The goal of the multi-classification task is to minimize the cross entropy loss function The formula is as follows:

[0112]

[0113] Among them, N is the number of samples, C is the number of categories, and y ic is the label that sample i belongs to category c, and yic is the model's predicted probability that sample i belongs to category c.

[0114] After the model training is completed, each node (i.e. each POST request) is predicted and finally classified into the corresponding gambling website template.

[0115] Traditional graph convolutional networks mainly learn node representations based on graph structure information and feature information, but may have limitations when dealing with uncertainty or complex data distribution. Step S5 proposes a variational graph convolutional network (VGCN), which combines a deep learning model of variational reasoning and graph convolution operations. Compared with traditional graph convolutional networks, variational graph convolutional networks can better capture the complex distribution and uncertainty of data when learning graph structure data representation by introducing probabilistic modeling methods. The variational graph convolutional network introduces hidden variables to represent the potential spatial distribution of data through the idea of ​​variational autoencoders, and optimizes the model by maximizing the variational lower bound. Each POST request can be classified into the corresponding website template, greatly improving the accuracy and robustness of the recognition results.

[0116] If the above method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0117] The above description of the embodiments is to facilitate the understanding and use of the invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to these embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments, and improvements and modifications made by those skilled in the art based on the disclosure of the present invention without departing from the scope of the present invention should be within the scope of protection of the present invention.

Claims

1. A gambling website identification method based on POST message aggregation, characterized in that: The following steps are involved: S1. Obtain the POST message of the website and process it in a table to generate structured data, and extract key features based on the structured data, including the URL in the request line, the Cookie parameter in the request header, and the request body related parameters; S2, using a meta-embedded aggregate feature integration method to integrate the key features extracted in step S1 to obtain normalized data, in which POST messages generated based on the same template are weighted and integrated into one record; S3, using a variational autoencoder to pre-train the normalized data to obtain a low-dimensional feature representation, and then establish a graph structure, using a graph autoencoder to extract node embedding representations from it, perform agglomerative hierarchical clustering, and map the clustering results to the gambling website template to form a label to obtain labeled data; S4, performing preliminary feature extraction on the labeled data, screening to obtain highly relevant features of the message through the mutual information method, and processing through a multi-scale fusion attention mechanism to obtain fused data; S5. Establish a graph structure according to the fused data, initialize the node representation in the graph through a variational autoencoder, and then send it into a variational graph convolutional network for multi-classification, and output the recognition result.

2. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S1, the process of generating the structured data is specifically as follows: Use the Fiddler tool to capture the POST message of the website, extract the request line of the POST message as a header to record the request line information, including the request method, URL and protocol version; extract the request header of the POST message as a header to record the request header parameters, including Cookie, User-Agent and Referer; extract the request body content of the POST message as a header to record the request body data, including form data or JSON data.

3. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: The specific process of step S2 is as follows: S201, using the pre-trained Word2Vec model, the URL, Cookie parameters and request body related parameters in each POST message are represented as embedded vectors; S202: Perform weighted averaging on the embedding vectors of the POST messages generated based on the same template to obtain a comprehensive vector v site : Where n represents the number of POST messages generated by the same template, a i represents the weight of the i-th message, v i Represents the embedding vector of the i-th message.

4. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S3, the process of establishing the graph structure based on the low-dimensional feature representation is as follows: Each low-dimensional feature is represented as a node, the similarity between nodes is calculated by Euclidean distance, and then the weight is calculated as the edge. The weight calculation formula is as follows: d ij =||z i -z j || Among them, w ij is the weight between the i-th node and the j-th node, d ij is the i-th low-dimensional feature representation z i and the jth low-dimensional feature representation z j The similarity between them is σ, and σ is the scale parameter of the distance.

5. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S3, the parameters of the variational autoencoder are optimized by maximizing the variational lower bound.

6. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S3, when performing agglomerative hierarchical clustering, the clustering strategy is dynamically adjusted according to the semantic information of the graph structure and the embedding representation extracted by the graph autoencoder.

7. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S4, TF-IDF technology is used to extract features from the labeled data.

8. A gambling website identification method based on POST message aggregation according to claim 1, characterized in that: In step S5, the multi-classification task is iteratively trained with the goal of minimizing the cross entropy loss function.

9. An electronic device comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images