Privacy collection compliance detection method and platform based on Llama3 model

Abstract

The invention provides a privacy collection compliance detection method and platform based on an Llama3 large model, and relates to the field of website privacy collection compliance detection. The method comprises the steps of obtaining a privacy declaration of a to-be-detected website; obtaining a JS file of the website to be detected; detecting the legality of the privacy declaration based on an Llama3 big model, and generating a first detection result; website behavior consistency is judged, and a second detection result is generated; generating a website detection result according to the first detection result and the second detection result: if the first detection result is illegal, judging that the website is not compliant; if the first detection result is legal, judging a second detection result; and if the second detection result is inconsistent, determining that the result is not compliant, otherwise, determining that the result is compliant. On the basis of various detection means, more comprehensive detection and higher feasibility of detection operation, the method better adapts to the change and complexity of legal provisions, and ensures the accuracy of the detection coverage range and the detection effect.

Description

Technical Field

[0001] The present invention relates to the field of website privacy collection compliance detection, and in particular to a privacy collection compliance detection method and platform based on the Llama3 large model. Background Art

[0002] In today's environment of rapid development of the Internet, network security and personal privacy information security are receiving more and more attention. However, due to the large number and variety of websites on the Internet, some websites lack privacy policy clauses, and some websites have wide, unclear and ambiguous descriptions of privacy policy clauses, which increases the difficulty for netizens to understand and maintain their own privacy rights. On the other hand, the loopholes in the opacity of privacy policy statements and information collected by actual websites will cause some websites to illegally collect user privacy information. Therefore, in the case of worrying user privacy security, the legality detection of website privacy information clauses and collection behavior has become a technical problem that needs to be solved urgently.

[0003] Currently, among the common privacy compliance tests, the most widely used area is the privacy compliance test of mobile apps. Website privacy compliance test has not received much attention and practical application.

[0004] Today, the methods for website privacy collection compliance detection mainly focus on the following aspects:

[0005] 1. Directly compare the privacy policy text with the relevant privacy policy provisions stipulated by the state; compare the privacy policy text published on the website or APP with the relevant privacy policy provisions stipulated by the state. By analyzing relevant indicators such as personal information storage, determine whether its privacy policy complies with relevant regulations.

[0006] 2. Analyze the use of cookies and related technologies; pay attention to whether websites or apps maliciously use cookies and other technologies to collect and use personal user information without authorization, and determine whether the behavior of the website or app is compliant by analyzing relevant indicators.

[0007] 3. Adopt technologies such as crowdsourcing, natural language processing and machine learning; use technology to automatically or semi-automatically extract significant details from private texts to determine whether privacy policies are compliant more quickly and accurately.

[0008] The above privacy collection compliance tests have different focuses, but at the same time there are technical problems such as single detection means, incomplete detection (often only one-sided comparative analysis, lack of overall consideration), low adaptability to changes and complexity of legal provisions, and low accuracy of detection results. Summary of the invention

[0009] In order to solve the above technical problems existing in the prior art, the present invention proposes a method for detecting the compliance of the privacy policy of the website based on a large model, and at the same time using the Web API (Web Application Programming Interface) to detect whether the website's collection behavior is illegal and consistent with the declared terms. By detecting the legitimacy of the website's privacy policy and the consistency of the website's information collection behavior, it is used to protect the green Internet environment and the personal privacy security of users. It aims to achieve an accurate and feasible website privacy collection compliance detection solution.

[0010] Specifically, the present invention provides a privacy collection compliance detection method based on the Llama3 large model, and the technical solution includes:

[0011] Obtain the privacy statement of the website to be tested;

[0012] Get the JS (Java Script) file of the website to be tested;

[0013] The legality of the privacy statement is tested based on the Llama3 large model, and the first test result is generated;

[0014] Determine the consistency of website behavior and generate a second detection result;

[0015] Generate a website detection result according to the first detection result and the second detection result, specifically:

[0016] If the first test result is illegal, it is judged as non-compliant;

[0017] If the first test result is legal, then determine the second test result;

[0018] If the second detection result is inconsistent, it is determined to be non-compliant, otherwise it is determined to be compliant.

[0019] Preferably, static crawlers and dynamic crawlers are combined, and the python library and corresponding function methods are used to crawl the privacy statement of the website to be tested.

[0020] Preferably, the URL (Uniform Resource Locator) information of the JS file recorded in the browser performance log of the website to be detected is crawled through the function method of the selenium library, and then the URL path where the JS file is located is crawled to obtain the JS file.

[0021] Preferably, the legality of the privacy statement is detected based on the Llama3 large model to generate a first detection result, which is specifically:

[0022] Input the privacy statement into the trained Llama3 large model to detect the legality and output the first detection result;

[0023] The format of the first test result is "legal / illegal; explain the reason";

[0024] The training process of the Llama3 large model includes:

[0025] Collect privacy statement documents and label all of them with classification labels, including legal and illegal.

[0026] Input each privacy statement file and the corresponding classification label into the Llama3 model, and train the Llama3 model according to the pre-set training framework;

[0027] Among them, the training framework is the Llama Factory framework, the RankRAG (Rank Retrieval-Augmented Generation) framework or the SWIFT (Scalable light Weight Infrastructure for Fine-Tuning) framework.

[0028] Preferably, the private text data is classified and labeled in sequence through a multi-label text classification model to generate private text labels;

[0029] Represent the JS file as an abstract syntax tree;

[0030] Obtain the Web API based on the abstract syntax tree corresponding to the loading process of the website to be tested, classify it according to the API and corresponding classification information of the MDN Web Docs website, and generate JS tags;

[0031] Compare the privacy text tag and the JS tag to determine whether the privacy statement and information collection behavior of the website to be tested are consistent, specifically:

[0032] If the set of private text tags is greater than or equal to the set of JS tags, they are considered consistent; otherwise, they are considered inconsistent.

[0033] Furthermore, the website detection results are displayed through a visual web page.

[0034] On the other hand, the present invention also provides a privacy collection compliance detection platform based on the Llama3 large model, including a privacy text data acquisition module for combining a static crawler and a dynamic crawler, using a python library and corresponding function methods to crawl the privacy statement of a target website;

[0035] The JS file acquisition module is used to crawl the URL information of the JS file recorded in the browser performance log of the website to be tested through the function method of the selenium library, and then crawl the URL path where the JS file is located to obtain the JS file;

[0036] A legality detection module, used to detect the legality of the privacy statement through the Llama3 large model and generate a first detection result;

[0037] The judgment module includes a multi-label text classification module, an abstract syntax tree representation module, an API classification query module, and a consistency judgment module;

[0038] A multi-label text classification module is used to classify and annotate privacy statements in sequence through a multi-label text classification model to generate privacy text labels;

[0039] Abstract syntax tree representation module, used to represent JS files as abstract syntax trees;

[0040] The API classification query module is used to obtain the WebAPI based on the abstract syntax tree corresponding to the loading process of the website to be detected, and classify it according to the API and corresponding classification information of the MDN Web Docs website to generate JS tags;

[0041] A consistency determination module is used to compare the privacy text tag and the JS tag to determine whether the privacy statement and information collection behavior of the website to be detected are consistent, and generate a second detection result;

[0042] A result generating module generates a website detection result according to the first detection result and the second detection result.

[0043] The technical solution provided by the present invention detects the legality of privacy texts and determines the consistency of website behaviors, and conducts a relatively comprehensive inspection of the privacy collection compliance of the detected websites from two aspects. On the basis of diverse detection methods, more comprehensive detection, and higher feasibility of detection operations, it better adapts to the changes and complexity of legal provisions, and ensures the accuracy of detection coverage and detection effects; it can avoid websites from stealing privacy by not complying with legal privacy statements, and improve the security of user privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A diagram of a web page privacy collection compliance detection method and platform framework in one embodiment of the present invention.

[0045] Figure 2 This is a flow chart of the website privacy policy legitimacy detection in one embodiment of the present invention.

[0046] Figure 3 Schematic diagram of website collection behavior and privacy text consistency detection in one embodiment of the present invention.

[0047] Figure 4 The flowchart of web page Java script data acquisition and representation in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] Hereinafter, the technical solution provided by the present invention will be further elaborated in detail with reference to the accompanying drawings.

[0049] With the rapid development and broad prospects of artificial intelligence in recent years, especially the widespread application of large models such as ChatGPT. This invention, by understanding and studying the feasibility and accuracy of large models in legal compliance detection, proposes a method for detecting the compliance of the privacy policy of the website based on the large model, and at the same time using WebAPI to detect whether the website's collection behavior is illegal and consistent with the declared terms. By detecting the legitimacy of the website's privacy policy and the consistency of the website's information collection behavior, it is used to protect the green Internet environment and the personal privacy security of users.

[0050] The website privacy collection compliance detection platform based on big models combines traditional APP malware detection methods with the most popular big model technology, aiming to achieve higher accuracy and higher efficiency detection.

[0051] like Figure 1 As shown, the present invention provides a privacy collection compliance detection method based on the Llama3 large model, comprising the following steps:

[0052] Step S1: The step of obtaining the private text data of the website to be detected includes combining static crawler and dynamic crawler technology, using the Python library and its function methods to crawl the private text data of the target website.

[0053] Step S2: The step of obtaining the JS file of the website to be detected includes using the function method provided by the selenium library to first crawl the JS file URL information recorded in the browser performance log, and then crawl the URL path where the target JS file is located to obtain the target JS data.

[0054] Step S3: Figure 2As shown, the steps for detecting the legality of the privacy text include using the privacy text compliance detection big model, using the large amount of legal knowledge in its knowledge base to perform legality detection on the obtained privacy policy text, and generating the legality detection result of the privacy text. The legality of the privacy text data is detected by the Llama3 big model (legal big model). The trained Llama3 big model performs legality detection on the privacy text data provided by the user based on its extensive knowledge base and specific privacy-related legal data. If it complies with the laws related to privacy protection, the text data is judged to be legal; otherwise, the text data is illegal, and the reasons for its illegality are pointed out. Specifically, the format of the detection output result is "legal / illegal; explain the reason".

[0055] The training process of the Llama3 large model includes:

[0056] Collect privacy statement files from various websites and label them with classification labels, including legal and illegal. The labeling process is done manually.

[0057] Input each privacy statement file and the corresponding classification label into the Llama3 model, and train the Llama3 model according to the pre-set training framework. The format of the training data is: {"instruction":"Ask a question. Privacy statement text.","input":"","output":"Legal / illegal, legal basis"}.

[0058] Optionally, the training framework can be the Llama Factory framework, the RankRAG framework, the SWIFT framework, or XTuner fine-tuning.

[0059] Step S4: Figure 3 As shown, the steps to determine the consistency of website behavior include:

[0060] S41: a step of classifying and labeling the privacy policy text data, including using a multi-label text classification model ALBERT (A Lite Bidirectional Encoder Representations from Transformers) to classify the privacy text data and generate a privacy text label result;

[0061] S42: Figure 4As shown, the steps of representing the obtained JS file as an abstract syntax tree through the Esprima library are performed so as to parse the data structure of the JS file; specifically, the website behavior detection method can be adopted, firstly, the URL address of the JS file of the website is obtained through a crawler, and then the JS source code data of the website is crawled through the crawler, and the JS source code is transformed into the form of AST (Abstract Syntax Tree), and the WebAPI is converted into semantics and representation;

[0062] S43: According to the API and its classification information on the MDNWebDocs website, the WebAPI obtained during the loading process of the website to be detected is queried and classified to generate a JS tag result;

[0063] S44: Compare the JS tag result and the privacy text tag result to obtain the consistency test result of the privacy statement and the information collection behavior. If the privacy text tag set is greater than or equal to the JS tag set, it means that the website behavior is consistent with the statement; if the privacy text tag set is less than the JS tag set or there are tags in the JS tag set that are not in the privacy text tag set, the website behavior is inconsistent with the statement.

[0064] S5: The step of generating the final test result of the website according to the legality test result and the consistency test result, including displaying the test result in the form of a visual web page. If the first test result fails, that is, the privacy statement is illegal, the website compliance test result is non-compliant. If the first test result passes, that is, the privacy statement is legal, the second test result is judged. If the second test result passes, that is, the website information collection behavior is consistent with the privacy statement, the website compliance test result is compliant; if the second test result fails, that is, the website information collection behavior is inconsistent with the privacy statement, the website compliance test result is non-compliant.

[0065] On the other hand, the present invention also provides a privacy collection compliance detection platform based on the Llama3 large model, including a module for obtaining the privacy text data of the website to be detected, a module for obtaining the JS file of the website to be detected, a privacy text legitimacy detection module, a website behavior consistency judgment module, and a result generation module.

[0066] The website behavior consistency judgment module includes a multi-label text classification model module, an abstract syntax tree representation module, an API classification query module, and a consistency judgment module.

[0067] The module for obtaining the private text data of the website to be detected is used to combine static crawler and dynamic crawler technology, use the Python library and its function methods to crawl the private text data of the target website.

[0068] The module for obtaining the JS file of the website to be tested is used to use the function method provided by the selenium library to first crawl the JS file URL information recorded in the browser performance log, and then crawl the URL path where the target JS file is located to obtain the target JS data.

[0069] The privacy text legality detection module is used to use the privacy text compliance detection model to perform legality detection on the obtained privacy policy text and generate legality detection results. The multi-label text classification model module is used to classify and label the privacy policy text data and generate privacy text label results;

[0070] The abstract syntax tree representation module is used to represent the acquired JS file as an abstract syntax tree for data structure parsing and analysis.

[0071] The API classification query module is used to query and classify the WebAPIs obtained during the loading process of the website to be tested based on the APIs and their classification information on the MDN Web Docs website, and generate JS tag results.

[0072] The consistency determination module is used to compare the JS tag results and the privacy text tag results to obtain the consistency detection results of the privacy statement and information collection behavior.

[0073] The result generation module is used to generate the final website detection results based on the legitimacy detection results and consistency detection results, and to display the detection results in the form of a visual web page.

[0074] The technical innovation of this invention lies mainly in its multi-level methodology and technical application. First, a comprehensive method of legal big model, multi-label text classification model and website behavior detection is adopted to comprehensively monitor the legality and compliance of the website. This comprehensive use of different technologies analyzes the website's statements and behaviors from multiple dimensions to ensure that they comply with legal and regulatory requirements.

[0075] Specifically, through the accumulation of large-scale corpus and the training of the legal big model, we have achieved a deep understanding and utilization of legal texts. The model can not only extract key information, but also analyze the context and logic of the text, thereby achieving more accurate and comprehensive compliance detection. Compared with traditional rule engines, the legal big model can better adapt to the changes and complexity of legal provisions, and improve the coverage and accuracy of detection.

[0076] Secondly, by using a multi-label text classification model, such as ALBERT, which can achieve high operating speed under low performance load, the privacy text of the website can be processed quickly. This model can sentence and label complex text information, thereby simplifying the expression of the text and reducing the complexity of processing. In this way, we can more effectively identify privacy issues on the website and provide users with more transparent and controllable privacy protection.

[0077] In addition, by using the website behavior detection method, the JS file is transformed into the form of AST (Abstract Syntax Tree), and the WebAPI is converted into semantics and representation. In this way, not only can the structure and content of the website be better understood, but also its behavior can be analyzed more deeply. By comprehensively detecting the legality and consistency of privacy text and privacy collection behavior, the security of user privacy information can be protected from all aspects from the aspects of website declarations and website information collection behavior, reducing the risk of users' privacy information being obtained by malicious websites.

[0078] In summary, the present invention combines multiple technical means to achieve comprehensive monitoring and protection of the legality and compliance of websites. The comprehensive use of different technologies not only improves the accuracy and efficiency of detection, but also further protects the security of user privacy information.

[0079] The technical solution provided by the present invention detects the legality of privacy texts and determines the consistency of website behavior, and conducts a more comprehensive inspection of the privacy collection compliance of the detected website from two aspects. On the basis of diverse detection methods, more comprehensive detection, and higher feasibility of detection operations, it better adapts to the changes and complexity of legal provisions and ensures the accuracy of detection coverage and detection results.

[0080] Furthermore, by displaying the website detection results on a visual web page, the legitimacy of the privacy text of the website to be detected can be more intuitively reflected; the system corresponding to the method can ensure the specific implementation of the technical solution provided by the present invention in various application environments.

Claims

1. A privacy collection compliance detection method based on the Llama3 large model, characterized in that: include: Obtain the privacy statement of the website to be tested; Get the JS file of the website to be tested; The legality of the privacy statement is tested based on the Llama3 large model, and the first test result is generated; Determine the consistency between the privacy statement and the website behavior and generate a second detection result; Generate website detection results based on the first detection result and the second detection result, specifically: If the first test result is illegal, it is judged as non-compliant; If the first test result is legal, then determine the second test result; If the second detection result is inconsistent, it is determined to be non-compliant, otherwise it is determined to be compliant.

2. A privacy collection compliance detection method based on the Llama3 large model as described in claim 1, characterized in that: The privacy statement of the website to be detected is obtained as follows: Combining static crawlers and dynamic crawlers, using Python libraries and corresponding function methods, crawl the privacy statement of the website to be tested.

3. A privacy collection compliance detection method based on the Llama3 large model as described in claim 1, characterized in that: The JS file of the website to be detected is obtained as follows: Through the function method of the selenium library, crawl the URL information of the JS file recorded in the browser performance log of the website to be tested, and then crawl the URL path where the JS file is located to obtain the JS file.

4. A privacy collection compliance detection method based on the Llama3 large model as described in claim 1, characterized in that: The legality of the privacy statement is detected based on the Llama3 large model, and a first detection result is generated, which is specifically: Input the privacy statement into the trained Llama3 large model to detect the legality and output the first detection result; The format of the first test result is "legal / illegal; explain the reason"; The training process of the Llama3 large model includes: Collect privacy statement documents and label all of them with classification labels, including legal and illegal. Input each privacy statement file and the corresponding classification label into the Llama3 model, and train the Llama3 model according to the pre-set training framework; Among them, the training framework is the Llama Factory framework, the RankRAG framework or the SWIFT framework.

5. A privacy collection compliance detection method based on the Llama3 large model as described in claim 1, characterized in that: The determination of the consistency between the privacy statement and the website behavior and the generation of the second detection result is specifically as follows: The private text data is classified and labeled in sequence through a multi-label text classification model to generate private text labels; Represent the JS file as an abstract syntax tree; Obtain the Web API based on the abstract syntax tree corresponding to the loading process of the website to be tested, classify it according to the API and corresponding classification information of the MDN Web Docs website, and generate JS tags; Compare the privacy text tag and the JS tag to determine whether the privacy statement and information collection behavior of the website to be tested are consistent, specifically: If the set of private text tags is greater than or equal to the set of JS tags, they are considered consistent; otherwise, they are considered inconsistent.

6. A privacy collection compliance detection method based on the Llama3 large model as described in claim 1, characterized in that: The generating of the website detection result further includes: Display website detection results through visual web pages.

7. A privacy collection compliance detection platform based on the Llama3 large model, characterized in that: include: The privacy text data acquisition module is used to combine static crawlers and dynamic crawlers, use Python libraries and corresponding function methods to crawl the privacy statements of target websites; The JS file acquisition module is used to crawl the URL information of the JS file recorded in the browser performance log of the website to be tested through the function method of the selenium library, and then crawl the URL path where the JS file is located to obtain the JS file; A legality detection module, used to detect the legality of the privacy statement through the Llama3 large model and generate a first detection result; The judgment module includes a multi-label text classification module, an abstract syntax tree representation module, an API classification query module, and a consistency judgment module; A multi-label text classification module is used to classify and annotate privacy statements in sequence through a multi-label text classification model to generate privacy text labels; Abstract syntax tree representation module, used to represent JS files as abstract syntax trees; The API classification query module is used to obtain the WebAPI based on the abstract syntax tree corresponding to the loading process of the website to be detected, classify it according to the API and corresponding classification information of the MDN Web Docs website, and generate JS tags; A consistency determination module is used to compare the privacy text tag and the JS tag to determine whether the privacy statement and information collection behavior of the website to be tested are consistent, and generate a second test result; A result generating module generates a website detection result according to the first detection result and the second detection result.

Images