Data processing method, device and equipment

Abstract

The embodiment of the invention provides a data processing method, device and equipment, relates to the technical field of network security, and is used for improving the accuracy of detecting a counterfeit website. The method comprises the following steps: acquiring website data of a first website according to the first website to be detected; inputting website data into the trained industry classification model to obtain a first industry category of the first website; according to the first industry category, a first counterfeit website detection model matched with the first industry category is determined from a pre-stored counterfeit website detection model set, and the first counterfeit website detection model is obtained through training according to semantic features of sample website data corresponding to the first industry category; the first industry category and the website data are input into the first counterfeit website detection model, a detection result is obtained, and the detection result is used for indicating whether the first website is a counterfeit website or not.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data processing method, device and equipment. Background Art

[0002] With the rapid development of Internet technology, websites have become information display platforms for major enterprises, organizations or institutions, providing channels for information exchange and communication between enterprises, organizations or institutions and users. However, due to the openness and anonymity of the network environment, it provides opportunities for some lawless elements to take advantage of. These lawless elements create fake websites in the name of some normal brands or enterprises, and use fake websites to defraud network users of personal information or property information.

[0003] To address this type of security issue, a counterfeit website detection method based on the universal features of websites has been proposed. However, the traditional universal feature detection method still has certain limitations when detecting features of websites of different categories, resulting in low accuracy in detecting counterfeit websites. Summary of the invention

[0004] The present application provides a data processing method, apparatus and device for improving the accuracy of detecting counterfeit websites.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, comprising: obtaining website data of the first website to be detected according to the first website to be detected; inputting the website data into a trained industry classification model to obtain a first industry category of the first website; according to the first industry category, determining a first counterfeit website detection model that matches the first industry category from a pre-stored counterfeit website detection model set, wherein the first counterfeit website detection model is trained based on semantic features of sample website data corresponding to the first industry category; inputting the first industry category and the website data into the first counterfeit website detection model to obtain a detection result, wherein the detection result is used to indicate whether the first website is a counterfeit website.

[0006] In the embodiment of the present application, the website data to be detected is first input into the trained industry classification model, and the first industry category of the first website is identified by the trained industry classification model, and then the first counterfeit website detection model dedicated to detecting counterfeit websites of the first industry category is selected based on the first industry category. Since the first counterfeit website detection model is trained based on the semantic features of the sample website data corresponding to the first industry category, or the first counterfeit website detection model is optimized based on the sample website data of the first industry category, the first counterfeit website detection model has a better understanding and processing capability for the website data of the first industry category. Therefore, compared with the general detection method, the embodiment of the present application detects the first website through the first counterfeit website detection model, and the accuracy of the detection result obtained is higher, that is, the accuracy of detecting counterfeit websites is improved.

[0007] Moreover, when training the first counterfeit website detection model, it is trained through the semantic features of the sample website data, so that when the trained first counterfeit website detection model detects whether the first website is a counterfeit website, it can also be based on the semantic feature recognition in the website data, and can more accurately detect counterfeit websites that do not achieve the purpose of fraud or diversion by directly counterfeiting content or directly misusing brands, thereby further improving the accuracy of detecting counterfeit websites.

[0008] In a possible implementation, the method further includes: generating a first rule set based on a pre-collected first sample website data set and a preset rule induction algorithm, wherein the first rule set is a plurality of first rules obtained by expanding, classifying, and summarizing semantic features in the first sample website data set through the rule induction algorithm; processing the first rule set and the rules in the predefined second rule set according to a preset rule processing operation to generate a third rule set, wherein the rules in the third rule set are obtained by merging rules that have an inclusion relationship and rules that have a conflict relationship in the first rule set and the second rule set; and training the initial first counterfeit website detection model based on the semantic features of the first industry category in the third rule set and the common features of the first industry category, combined with cross-validation and grid search algorithms, to obtain the trained first counterfeit website detection model.

[0009] In this embodiment, the pre-stored second rule set may be a rule set obtained by manual extraction. In this case, the third rule set includes the first rule set automatically extracted by the rule induction algorithm and the second rule set obtained by manual extraction, so that the third rule set used to train the first counterfeit website detection model is richer, thereby improving the understanding and processing capabilities of the trained first counterfeit website detection model for counterfeit website data. In addition, since redundant rules (rules with inclusion relationships) may lead to repeated detection results, and conflicting rules may lead to confusing or contradictory detection results, the rules are merged, including merging redundant rules and eliminating conflicting rules, which can reduce the false alarm rate of the detection results, reduce the number of rules and optimize the detection results, simplify the detection process, and improve the detection efficiency.

[0010] In a possible implementation, a first rule set is generated based on a pre-collected first sample website data set and a preset rule induction algorithm, including: generating a feature vector set for each first sample website data based on the occurrence frequency of each word in each first sample website data of the first sample website data set, a first threshold and a pre-stored vocabulary; generating a rule set for each first sample website data based on the feature vector set and the rule induction algorithm, wherein each rule in the rule set is associated with a confidence level; and the rules in the rule set of each first sample website data of the first sample website data whose confidence level exceeds a second threshold are combined into the first rule set.

[0011] In this implementation, the rule induction algorithm is used to realize automatic rule mining, which can greatly reduce the workload of manual rule mining and improve the generation efficiency of the first rule set.

[0012] In a possible implementation, according to a preset rule processing operation, the rules in the first rule set and the predefined second rule set are merged to generate a third rule set, including: associating a confidence level for each rule in the first rule set and the second rule set according to the confidence of each rule in the first rule set and the second rule set and the preset confidence level; if it is determined that there is a first rule in the first rule set whose condition range is greater than the condition range indicated by the second rule, then judging whether the first rule and the second rule belong to the same confidence level, the second rule being any rule in the second rule set or any rule in the first rule set except the first rule; if the first rule and the second rule do not belong to the same confidence level, deleting the rule with a lower confidence level; if the first rule and the second rule belong to the same confidence level, deleting the first rule; generating the third rule set according to the merged first rule set and the second rule set.

[0013] In a possible implementation, according to a preset rule processing operation, the rules in the first rule set and the predefined second rule set are merged to generate a third rule set, including: determining whether there are a third rule and a fourth rule in the first rule set, the third rule and the fourth rule are associated with the same website data, and the industry categories indicated by the third rule and the fourth rule are different; if so, determining whether the rule conditions included in the third rule and the fourth rule overlap; if so, deleting the rule with a lower confidence level; if not, merging the third rule and the fourth rule into a fifth rule, and according to the second industry category input by the user based on the fifth rule, associating the fifth rule with the second industry category and storing it in the first rule set; determining the second rule set and the merged first rule set as the third rule set.

[0014] In a possible implementation, the method further includes: extracting a keyword set of each industry category from the second sample website data set; counting the number of occurrences and frequency of each keyword in the keyword set in each industry category, and determining the information gain of each keyword, wherein the information gain is used to indicate the degree of association between each keyword and each industry category; and determining sample keywords of each industry category based on the information gain of each keyword in the keyword set and a third threshold. Based on the sample keywords of each industry category, the initial industry classification model is trained in combination with cross-validation and grid search algorithms to obtain the trained industry classification model.

[0015] In this implementation, information gain is used to screen and obtain sample keywords, which can effectively reduce the number of keywords and improve the model utility.

[0016] In a second aspect, an embodiment of the present application provides a data processing device, comprising: an acquisition module, used to acquire website data of the first website to be detected; a determination module, used to input the website data into a trained industry classification model to obtain a first industry category of the first website; the determination module is also used to determine, according to the first industry category, a first counterfeit website detection model that matches the first industry category from a pre-stored counterfeit website detection model set, wherein the first counterfeit website detection model is trained based on semantic features of sample website data corresponding to the first industry category; a detection module, used to input the first industry category and the website data into the first counterfeit website detection model to obtain a detection result, wherein the detection result is used to indicate whether the first website is a counterfeit website.

[0017] In a possible implementation, the detection module is further used to: generate a first rule set based on a pre-collected first sample website data set and a preset rule induction algorithm, wherein the first rule set is a plurality of first rules obtained by expanding, classifying, and summarizing semantic features in the first sample website data set through the rule induction algorithm; process the first rule set and the rules in the predefined second rule set according to a preset rule processing operation to generate a third rule set, wherein the rules in the third rule set are obtained by merging rules that have an inclusion relationship and rules that have a conflict relationship in the first rule set and the second rule set; train the initial first counterfeit website detection model based on the semantic features of the first industry category in the third rule set and the common features of the first industry category, combined with cross-validation and grid search algorithms, to obtain the trained first counterfeit website detection model.

[0018] In a possible implementation, the detection module is specifically used to: generate a feature vector set for each first sample website data of the first sample website data set according to the occurrence frequency of each word in each first sample website data of the first sample website data set, a first threshold and a pre-stored vocabulary; generate a rule set for each first sample website data according to the feature vector set and the rule induction algorithm, wherein each rule in the rule set is associated with a confidence level; and organize the rules in the rule set of each first sample website data of the first sample website data whose confidence level exceeds a second threshold into the first rule set.

[0019] In a possible implementation, the detection module is specifically used to: associate a confidence level with each rule in the first rule set and the second rule set according to the confidence and preset confidence level of each rule in the first rule set and the second rule set; if it is determined that there is a first rule in the first rule set whose condition range is greater than the condition range indicated by the second rule, determine whether the first rule and the second rule belong to the same confidence level, and the second rule is any rule in the second rule set or any rule in the first rule set except the first rule; if the first rule and the second rule do not belong to the same confidence level, delete the rule with a lower confidence level; if the first rule and the second rule belong to the same confidence level, delete the first rule; and generate the third rule set based on the merged first rule set and the second rule set.

[0020] In a possible implementation, the detection module is specifically used to: determine whether there are a third rule and a fourth rule in the first rule set, the third rule and the fourth rule are associated with the same website data, and the industry categories indicated by the third rule and the fourth rule are different; if so, determine whether the rule conditions included in the third rule and the fourth rule overlap; if so, delete the rule with a lower confidence level; if not, merge the third rule and the fourth rule into a fifth rule, and according to the second industry category input by the user based on the fifth rule, associate the fifth rule with the second industry category and store it in the first rule set; determine the second rule set and the merged first rule set as the third rule set.

[0021] In a possible implementation, the determination module is further used to: extract a keyword set of each industry category from the second sample website data set; count the number of occurrences and frequency of each keyword in the keyword set in each industry category to determine the information gain of each keyword, the information gain is used to indicate the degree of association between each keyword and each industry category; determine the sample keywords of each industry category based on the information gain of each keyword in the keyword set and a third threshold. Based on the sample keywords of each industry category, the initial industry classification model is trained in combination with cross-validation and grid search algorithms to obtain the trained industry classification model.

[0022] In a third aspect, an embodiment of the present application provides a data processing device, comprising: at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method described in the first aspect and any possible implementation manner by executing the instructions stored in the memory.

[0023] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and any possible implementation manner.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation method to be implemented.

[0025] The beneficial effects of the second to fifth aspects can be referred to the contents described in the first aspect above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of an application scenario of a data processing method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of a process for training a counterfeit website detection model provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0032] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0033] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0034] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0035] In order to facilitate understanding of the specific implementation methods provided in the embodiments of the present application, some terms involved in the embodiments of the present application are explained below.

[0036] 1. Natural language processing (NLP) word segmentation is an important task in natural language processing. Its purpose is to segment continuous natural language text into words or phrases with semantic units.

[0037] 2. The naive Bayes model is a classification algorithm based on the Bayesian theorem. The basic idea is to calculate the conditional probability of each feature in each category based on the data of known categories, and then use the Bayesian theorem to calculate the probability that the new sample belongs to each category, and select the category with the largest probability as the prediction result.

[0038] 3. The CN2-SD algorithm is a classification algorithm for data mining. It is an improved version of the CN2 (classificationbased on 2Rules algorithm) algorithm. It processes continuous data based on the CN2 algorithm and splits it into discrete values ​​to facilitate the construction of classification rules. The CN2-SD algorithm combines the improvement of the CN2 classification rule learner with the subgroup discovery (SD) technology to discover effective patterns in the training data. CN2 is used to summarize classification rules to predict category labels. The CN2-SD algorithm learns a set of rules through a top-down search strategy, starting from the conditional part with the most general form and iteratively expanding the conditional part to generate rules.

[0039] 4. Weighted Relative Accuracy (WRAcc) is an indicator used to evaluate the performance of classification algorithms, especially for multi-category imbalanced data sets.

[0040] 5. K-Nearest Neighbors (KNN) is a basic machine learning algorithm used for classification and regression tasks. Its basic principle is to perform classification or regression based on the distance measurement between samples.

[0041] 6. F1 score is an indicator that comprehensively considers precision and recall. It is often used to evaluate the performance of classification models and is the harmonic mean of precision and recall.

[0042] In order to better understand the technical solutions described in the embodiments of the present application, the background technology involved in the embodiments of the present application is briefly described below.

[0043] Traditional methods for detecting counterfeit websites mainly detect counterfeit websites based on the similarity of website content. However, in actual applications, the content and form of counterfeit websites are diverse, and counterfeit websites in different fields may present different appearance and behavior characteristics. For example, for counterfeit websites in the financial field, they may impersonate the brand names and logos of financial institutions such as banks and securities companies to carry out false propaganda or fraudulent activities. For counterfeit websites in the education field, they may impersonate the names of well-known schools or online education platforms to publish false enrollment information or teaching resources. This counterfeiting method makes the content of counterfeit websites different from that of normal websites, but when detecting such counterfeit websites, traditional content similarity detection methods will detect them as normal websites due to the difference in content. It can be seen that the accuracy of detecting counterfeit websites by traditional counterfeit website detection methods is low.

[0044] Based on this, the embodiment of the present application provides a data processing method, which classifies and identifies the website data of the first website through the trained industry classification model to determine the first industry category of the first website. Then, according to the first industry category, the first counterfeit website detection model matching the first industry category is determined from the pre-stored counterfeit website detection model set, the first industry category and the website data are input into the first counterfeit website detection model to obtain the detection result, and then according to the detection result, it can be determined whether the first website is a counterfeit website. Since the first counterfeit website detection model is trained based on the semantic features of the sample website data corresponding to the first industry category, even if the counterfeit website is different from the normal website content, since the first counterfeit website detection model has learned the semantic features of the website data of the first industry category in advance, the first counterfeit website detection model can also accurately identify the website data, solving the technical problem of low accuracy of the traditional counterfeit website detection method.

[0045] The following is an example of a scenario in which a data processing method provided in an embodiment of the present application is applicable. Figure 1 , is a schematic diagram of an application scenario of a data processing method provided in an embodiment of the present application. Figure 1 As shown, the schematic diagram includes a device 110 and a data processing apparatus 120. The device 110 and the data processing apparatus 120 can perform wired or wireless communication.

[0046] Device 110 may refer to a device that can support the operation of a website, such as a terminal device or a server, and the terminal device includes but is not limited to a mobile phone, a personal computer (PC), a tablet computer, a laptop computer, a PDA, a mobile Internet device (MID), etc. The server may be a physical server or a virtual server, etc., which is not limited in the embodiments of the present application. The data processing device 120 refers to a device or equipment with data processing capabilities. In the case where the data processing device is a device with data processing capabilities, the data processing device 120 may be a functional module in a device, which may be a terminal device or a server, which is not limited in the embodiments of the present application.

[0047] Exemplarily, the data processing device 120 detects the first website from the device 110, and then obtains the website data of the first website. The data processing device 120 inputs the website data into the trained industry classification model to obtain the first industry category of the first website, and according to the first industry category, determines the first counterfeit website detection model corresponding to the first industry category from the pre-stored counterfeit website detection model set, inputs the first industry category and the website data into the first counterfeit website detection model, and obtains the detection result output by the first counterfeit website detection model, and the detection result is used to indicate whether the first website is a counterfeit website. The specific implementation process of the data processing device 120 performing counterfeit detection on the first website will be described in detail below.

[0048] Please refer to Figure 2 , is a flow chart of a data processing method provided in an embodiment of the present application. Figure 2 The steps shown are for example explanation. The execution device is, for example, Figure 1 The data processing device 120 is shown.

[0049] S201, acquiring website data of the first website according to the first website to be detected.

[0050] The website data of the first website may include web page content data such as text, pictures, sounds, videos, links, etc. in the website content.

[0051] Optionally, the website data of the first website may also include the domain name survival time of the first website, internet content provider (ICP) information, uniform resource locator (URL) information, hypertext markup language (HTML) information, header information, etc.

[0052] Specifically, the execution device may receive a detection instruction from the first device, the detection instruction being used to instruct to perform counterfeit website detection on the first website. Based on the detection instruction, the execution device may crawl the website data of the first website through a web crawler tool, or receive the first website and the website data of the first website from other devices, which is not limited in the embodiments of the present application.

[0053] The first device may refer to the execution device itself. In this case, the user can input the information of the first website to be detected through the display interface of the execution device, and the execution device generates a detection instruction based on the user input information. Alternatively, the first device may also be other devices that have a communication connection with the execution device, which is not limited in the embodiments of the present application.

[0054] S202, inputting the website data into the trained industry classification model to obtain the first industry category of the first website.

[0055] The first industry category may represent the field or industry to which the first website belongs, such as the financial industry, education industry, medical industry, construction industry, etc. It should be understood that the industries described in the embodiments of the present application may include currently existing industries and emerging industries to be generated in the future.

[0056] The trained industry classification model is obtained by training sample keywords of each industry category. The specific method of executing device training to obtain the industry classification model is described below.

[0057] Step 1: Extract keyword sets of various industry categories from the second sample website data set.

[0058] The second sample website data set includes counterfeit website data and normal website data, and each second sample website data in the second sample website data set is marked with an industry category. The second sample website data set is collected in advance by the execution device and stored in the device.

[0059] Exemplarily, the execution device can use a network mapping platform or a retrieval platform to search based on keywords, domain names, geographic locations, and other conditions to collect URL information of websites in various industries and fields. The network mapping platform or retrieval platform is, for example, an open source threat intelligence library. The execution device crawls the website data of the target website through a web crawler tool based on the collected URL information. For example, the web crawler tool is Beautiful Soup, Scrapy, etc. in Python. Finally, multiple normal website data and counterfeit website data are collected.

[0060] Optionally, the execution device can extract counterfeit features based on the collected counterfeit website data, and search and collect counterfeit website data from various platforms based on the extracted counterfeit features. The execution device can also perform counterfeit extension on normal website data to obtain expanded counterfeit website data, and the expanded counterfeit website data are all website data that are manually verified and confirmed to be real and have counterfeit behavior.

[0061] Specifically, the execution device may extract a keyword set of each industry category from each second sample website data in the second sample website data set. For example, the execution device may perform word segmentation on the text data in each sample website data according to the NPL word segmentation method. Exemplarily, the execution device may use Jieba to perform word segmentation on Chinese website data and use NLTK to perform word segmentation on English website data.

[0062] In order to improve the quality of keywords obtained by word segmentation, stop words are excluded during word segmentation, that is, some words without practical meaning are removed, which is conducive to extracting more meaningful keywords. Stem extraction is performed during English word segmentation to achieve feature vector dimensionality reduction, which is conducive to reducing the complexity of feature data.

[0063] Step 2, counting the number of occurrences and frequency of each keyword in the keyword set in each industry category, and determining the information gain of each keyword, where the information gain is used to indicate the degree of association between each keyword and each industry category.

[0064] Specifically, the execution device may determine the information gain of each keyword according to a preset formula and the number of occurrences and frequency of each keyword in each industry category. For example, a formula for calculating the information gain of each keyword is as follows:

[0065]

[0066] Where IG represents information gain; X represents a set of keywords; C represents the set of all industry categories, that is, the set of industry categories included in the sample website data set; p(x,c) is the probability of observing keyword x in the sample website data belonging to industry category c, or the frequency of occurrence of keyword x in the sample website data of industry category c; The probability that keyword x is not observed in the sample website data belonging to industry category c; p(x) is the probability of observing keyword x in the second sample website data set; p(c) is the probability that the sample website data belongs to industry category c; x∈X, c∈C.

[0067] Taking the calculation of p(x,c) as an example, the execution device can determine that the sample website data of industry category c includes a total of M keywords, where keyword x appears N times in the M keywords, and then the execution device can determine that p(x,c)=N / M.

[0068] The probability calculation methods involved in the above calculation formula can all refer to the calculation method of p(x,c), which will not be repeated here.

[0069] Step 3: Determine sample keywords for each industry category based on the information gain of each keyword in the keyword set and the third threshold.

[0070] Among them, the third threshold is pre-configured in the execution device, and the third threshold can be set according to actual needs. For example, the third threshold can indicate an information gain threshold, or a keyword quantity threshold, which is not limited in the embodiment of the present application.

[0071] Specifically, after the execution device determines the information gain of each keyword in the keyword set, it can classify them according to industry categories, and determine sample keywords for each industry category according to the third threshold and the information gain of all keywords in each industry category.

[0072] Exemplarily, taking the third threshold as the keyword quantity threshold as an example, the execution device may select keywords with the third threshold quantity as sample keywords for each industry category from all the keywords for each industry category according to the third threshold and in descending order of information gain.

[0073] Step 4: Based on the sample keywords of each industry category, the initial industry classification model is trained in combination with cross-validation and grid search algorithms to obtain a trained industry classification model.

[0074] Among them, cross-validation grid search is a commonly used machine learning model tuning method, which is usually used to select the hyperparameters of the model. In cross-validation grid search, a list of candidate values ​​for hyperparameters is first specified, and then cross-validation is performed on each set of hyperparameter combinations. The specific steps of cross-validation grid search training model are as follows:

[0075] (1) Specify the hyperparameter grid: Determine a list of candidate values ​​for each hyperparameter. For example, for a support vector machine (SVM) model, we might specify different kernel types and C values ​​(penalty parameter).

[0076] (2) Model building: For each set of hyperparameter combinations, a model is built using the training data.

[0077] (3) Cross-validation: For each set of hyperparameter combinations, the model is evaluated using cross-validation techniques. K-fold cross-validation is usually used to divide the training data into K subsets, one of which is used as the validation set and the remaining K-1 subsets are used as the training set.

[0078] (4) Select the best model: Based on the results of cross-validation, select the model that performs best on the validation set. Usually, the model with the best average performance is selected as the final model and retrained using all the training data.

[0079] (5) Evaluate the model: The final model is evaluated using the test data to assess its performance on unseen data.

[0080] Specifically, the execution device can train the initial industry classification model based on the specific steps described in the cross-validation grid search algorithm to obtain a trained industry classification model. The model training process of the industry classification model is consistent with other model training processes, and the embodiments of this application will not be described in detail.

[0081] Exemplarily, the industry classification model described in the embodiment of the present application can be implemented by a naive Bayesian model. The following is an example of the implementation process of the trained industry classification model obtained by training the embodiment of the present application in combination with the naive Bayesian model.

[0082] The execution device can construct a feature vector for the sample keywords included in each sample website data, and each dimension of the feature vector represents the number of occurrences and frequency of a sample keyword in the current sample. Based on the feature vector, the prior probability of each sample website data belonging to category c can be calculated, and the conditional probability of the feature vector can be calculated. Then, based on the calculated prior probability and conditional probability, a cross-validation grid search algorithm is used to tune and train to obtain a trained naive Bayes model.

[0083] Optionally, before training, in order to prevent the occurrence of zero probability, the Laplace smoothing method can be used to smooth the features with conditional probability of 0.

[0084] The trained industry classification model can identify the first industry category of the first website based on the website data. Therefore, the execution device can input the website data of the first website into the trained industry classification model to obtain the classification result output by the industry classification model, and determine that the first website belongs to the first industry category based on the classification result.

[0085] S203, according to the first industry category, determine a first counterfeit website detection model matching the first industry category from a pre-stored counterfeit website detection model set, wherein the first counterfeit website detection model is trained based on semantic features of sample website data corresponding to the first industry category.

[0086] The phishing website detection model set includes phishing website detection models for various industry categories, or in other words, one phishing website detection model in the phishing website detection model set corresponds to detecting websites in one industry category. Each phishing website detection model in the phishing website detection model set is trained based on the semantic features of sample website data corresponding to its industry category.

[0087] The following takes the first counterfeit website detection model as an example, combined with Figure 3 A training method for a first counterfeit website detection model is shown, and a specific manner of training the first counterfeit website detection model in an embodiment of the present application is described.

[0088] S2031, generating a first rule set according to a pre-collected first sample website data set and a preset rule induction algorithm.

[0089] Among them, the first sample website data set includes sample counterfeit website data and sample normal website data of various industry categories. Each sample website data in the first sample website data set is marked with an industry category and a counterfeit label. The counterfeit label is used to indicate whether each first sample website data is a counterfeit website. Each first sample website data can be a sample counterfeit website data or a sample normal website data in the first sample website data set. Among them, the first sample website data set can be the same as or different from the second sample website data set, and the implementation of this application is not limited to this. The first rule set is a plurality of first rules obtained by expanding, classifying, and summarizing the semantic features in the first sample website data set through a rule induction algorithm. The rule induction algorithm is, for example, the CN2-SD algorithm. The specific explanation of the CN2-SD algorithm can refer to the content of the glossary section in the previous text.

[0090] Specifically, the execution device may generate a feature vector set for each first sample website data according to the occurrence frequency of each word in each first sample website data of the first sample website data set, the first threshold value, and the pre-stored word library. Among them, the word library may be a public word library pre-stored in the execution device, and the word library may include high-frequency reference words and modal particles obtained from statistics of websites such as counterfeit websites and phishing websites. The first threshold value is used to filter out high-frequency words from each first sample website data, and the first threshold value can be set according to actual needs, and the embodiment of the present application does not limit this.

[0091] Exemplarily, the execution device may determine the occurrence frequency of each word in each first sample website data, and according to the first threshold, determine from each first sample website data the words whose occurrence frequency exceeds the first threshold as high-frequency words.

[0092] Furthermore, the execution device matches the high-frequency words in each first sample website data with the high-frequency reference words in the word library to generate a feature vector set for each first sample website data.

[0093] For example, taking the high-frequency words "high return benefits", "high interest rate", "100% return rate", and "training" as examples, if "high return benefits", "high interest rate", and "100% return rate" are all successfully matched in the vocabulary, the feature values ​​corresponding to "high return benefits", "high interest rate", and "100% return rate" are determined to be 1. If "training" is not matched in the vocabulary, the feature value corresponding to "training" is determined to be 0. Then, the execution device generates a feature vector set according to the above high-frequency words and their corresponding feature values.

[0094] It should be noted that the high-frequency words, keywords, etc. described in the embodiments of the present application are all specific manifestations of semantic features.

[0095] The execution device generates a rule set for each first sample website data according to the feature vector set and the rule induction algorithm, and each rule in the rule set is associated with a confidence level.

[0096] Among them, each rule in the rule set may include a counterfeiting condition, an industry category, and a counterfeiting result. Specifically, the structure of each rule can be a counterfeiting condition + whether it is a counterfeiting website of a certain industry category. For example, a rule output can be: the eigenvalue of welfare is 1 + the eigenvalue of return is 1 + the eigenvalue of education is 0, and this website is a counterfeiting website in the financial industry.

[0097] Exemplarily, taking the rule induction algorithm as the CN2-SD algorithm, the execution device can input the feature vector set and the industry category of each pair of first sample website data in each industry category into the CN2-SD algorithm, and based on the rule mining, expansion, classification, and induction capabilities of the CN2-SD algorithm, output the rule set of each pair of first sample website data in each industry category.

[0098] In the CN2-SD algorithm described in the embodiments of the present application, taking the additive covering algorithm as an example, the weighted covering algorithm can still ensure that the obtained rules have a high importance during the rule induction process and can cover most of the samples in the target population. The covering algorithm in the classification algorithm removes the samples covered by the rules from the current sample set, while the weighted covering algorithm does not remove the samples covered by the rules from the current sample set. Instead, a variable count is used to record the number of times the current sample is covered during each process of the rule covering the sample, and the sample weight is calculated through count. Initially, for all samples e, the weight is 1, that is, w(e, 0) = 1, indicating that the sample is not covered by any rule. During the process of the algorithm extracting rules, the probability of the sample being covered by the rules is relatively large. If 0 < w < 1, it indicates that the sample is covered by at least one rule. As the number of times the sample is covered increases, the weight w of the sample becomes smaller and smaller, and the probability of the sample being covered by the rules also becomes smaller and smaller. For each of these rules, the CN2-SD algorithm starts from the most general form with a conditional part consisting of a key-value pair (key, value), and iteratively expands the conditional part by adding key-value pairs to the conditional part of the rule.

[0099] When the CN2-SD algorithm outputs the rule set of each first sample website data, it also outputs the confidence level of each rule.

[0100] The execution device forms the rules in the rule sets of each first sample website data in the first sample website data set whose confidence levels exceed the second threshold into a first rule set. Among them, the second threshold is pre-configured in the execution device, and the second threshold can be set according to actual needs. The embodiments of the present application do not limit this.

[0101] That is, the execution device screens the rule set in each first sample website data according to the second threshold value, and deletes the rules whose confidence is lower than the second threshold value to ensure the accuracy of the rules. Finally, the execution device combines the rules whose confidence is not lower than the second threshold value in all sample website data into the first rule set.

[0102] For example, in the CN2-SD algorithm, the heuristic function weighted relative accuracy (WRAcc) can be used as the second threshold to filter the rules. The specific interpretation of WRAcc can be referred to the content of the previous glossary, which will not be repeated here.

[0103] S2032: Process the rules in the first rule set and the predefined second rule set according to a preset rule processing operation to generate a third rule set.

[0104] The rules in the third rule set are obtained by merging the rules with inclusion relationship and the rules with conflict relationship in the first and second rule sets. The inclusion relationship can be understood as the condition part of one rule including the condition part of another rule, or the condition range indicated by one rule is larger than the condition range of another rule. The conflict relationship means that the rule conditions indicated by two rules in the same website data are the same, but the indicated industry categories are different.

[0105] The second rule set is a rule manually extracted from a sample website data set. Optionally, each rule in the second rule set may be pre-configured with a confidence level. Exemplarily, the confidence level may include a high confidence level, a medium confidence level, and a low confidence level.

[0106] Specifically, for rules with a containment relationship, the execution device may associate a confidence level with each rule in the first rule set and the second rule set according to the confidence of each rule in the first rule set and the second rule set and a preset confidence level. The confidence level may be obtained by dividing the values ​​according to different confidence intervals.

[0107] If it is determined that the condition range indicated by the first rule in the first rule set is greater than the condition range indicated by the second rule (there is an inclusion relationship), then it is determined whether the first rule and the second rule belong to the same confidence level, where the second rule can be any rule in the second rule set, or any rule in the first rule set except the first rule.

[0108] If it is determined that the first rule and the second rule belong to the same confidence level, the first rule is deleted. If it is determined that the first rule and the second rule do not belong to the same confidence level, the rule with a lower confidence level is deleted.

[0109] That is, in the process of merging rules with inclusion relationships, the rules with higher confidence levels are retained first, and if the confidence levels are the same, the more general rules are deleted.

[0110] Exemplarily, the execution device may utilize a post-pruning technique - reduced-error pruning (REP) algorithm to perform the above rule merging operation.

[0111] For conflicting rules, the execution device may determine whether there are third and fourth rules in the first rule set, the third and fourth rules are associated with the same website data, and the third and fourth rules indicate different industry categories. If it is determined that such rules exist in the first rule set, it is determined whether the rule conditions included in the third and fourth rules overlap.

[0112] If it is determined that the rule conditions included in the third rule and the fourth rule overlap, the rule with a lower confidence level is deleted and the rule with a higher confidence level is retained. If it is determined that the rule conditions included in the third rule and the fourth rule do not overlap, the third rule and the fourth rule are merged into a fifth rule, and according to the second industry category input by the user based on the fifth rule, the fifth rule is associated with the second industry category and a first rule set exists.

[0113] That is to say, if the rule conditions of the third rule and the fourth rule do not overlap, the same website data is matched by the rules of two industry categories. This may be an error in the classification of industry categories. Therefore, it is necessary to introduce manual work to further determine the industry category of the merged fifth rule.

[0114] Exemplarily, the sample website data Y is associated with both the third rule and the fourth rule, but the third rule indicates that Y is a website in the financial industry category, and the fourth rule indicates that Y is a website in the education industry category. In this case, the execution device determines whether the rule conditions indicated by the third rule and the fourth rule overlap, and if so, determines to delete the rule with lower confidence. If not, there is a conflict between the third rule and the fourth rule. Further, the execution device merges the third rule and the fourth rule to obtain the fifth rule, and obtains the second industry category of the fifth rule input by the user through manual confirmation, and associates the second industry category with the fifth rule and stores it. The second industry category is, for example, an education and training industry related to financial positions, such as accountant training websites, etc.

[0115] Based on the above rule merging operation, the execution device may combine the remaining rules after the rule merging into a third rule set.

[0116] S2033, according to the semantic features of the first industry category and the common features of the first industry category in the third rule set, combined with cross-validation and grid search algorithms, the initial first counterfeit website detection model is trained to obtain a trained first counterfeit website detection model.

[0117] The specific explanation of the cross validation and grid search algorithms can be referred to the content described above, and will not be repeated here. The first counterfeit website detection model can be implemented by using the K nearest neighbor algorithm, and the specific explanation of the K nearest neighbor algorithm can be referred to the content of the glossary processing in the previous text. Common features may include domain name survival time, icp information, url features, html content features, header features, etc.

[0118] The execution device trains the initial first counterfeit website detection model according to the semantic features of the first industry category and the common features of the first industry category in the third rule set, combined with the cross-validation grid search algorithm, to obtain the trained first counterfeit website detection model. During the training process, the performance of the trained first counterfeit website detection model can be evaluated by the F1 score, and the specific interpretation of the F1 score can correspond to the content of the glossary in the previous text. The model training process in the embodiment of the present application is consistent with other model training processes, and the embodiment of the present application will not be described in detail.

[0119] Among them, the above steps S2031-S2033 are the training process of the first counterfeit website detection model. The training methods of other counterfeit website detection models in the counterfeit website detection model set can all correspond to the process described in the above steps S2031-S2033, which will not be repeated here.

[0120] S204: Input the first industry category and website data into a first counterfeit website detection model to obtain a detection result, where the detection result is used to indicate whether the first website is a counterfeit website.

[0121] The execution device inputs the first industry category and the website data into the first counterfeit website detection model, obtains the detection result output by the first counterfeit website detection model, and further determines whether the first website is a counterfeit website based on the detection result.

[0122] Since the first counterfeit website detection model is trained based on the semantic features of sample website data of the first industry category, the first counterfeit website detection model can perform counterfeit detection on the first website based on the semantic features of the website data. Even if the website data of the first website is different from that of a normal website, identification and detection can be performed based on the semantic features, thereby improving the accuracy of counterfeit website detection.

[0123] The data processing method provided in the embodiment of the present application is specifically a counterfeit website detection method, which can be applied to brand protection, anti-fraud detection network behavior analysis, network security protection and other scenarios. The following examples illustrate the actual application of the data processing method described in the embodiment of the present application in the above three scenarios.

[0124] 1. Brand protection

[0125] Brand protection products can monitor and identify possible counterfeit websites, so as to take timely actions to protect brand reputation and consumer rights. Specifically, a web crawler system can be established to regularly scan various websites on the Internet, including search engine results, social media platforms, e-commerce websites, etc., to collect brand-related information, and then use the data processing method described in the embodiment of this application to identify possible counterfeit websites, and use a verification mechanism to confirm whether they are really infringing. Once a counterfeit website is found, an alarm can be triggered immediately and corresponding countermeasures can be taken.

[0126] 2. Anti-fraud detection network behavior analysis

[0127] The anti-fraud measures for counterfeit websites can help financial institutions, online payment platforms and other institutions to promptly identify and prevent fraudulent activities and protect the safety and rights of users' funds. Specifically, big data analysis and machine learning technology can be used to establish user behavior models, monitor and analyze users' transaction behaviors on the platform, and identify possible fraud patterns and risk signals. Then, combined with the counterfeit website detection method proposed in this application, the user's access behavior and transaction process can be monitored to promptly detect whether there are fraudulent activities related to counterfeit websites.

[0128] 3. Network security

[0129] As cyber threats continue to increase and evolve, ensuring network security has become one of the top priorities for businesses and individuals. Within an enterprise, deploying phishing detection tools can help protect employees from cyber attacks and fraud, and maintain the organization's information security and business continuity. The phishing detection method proposed in this application can be combined with malicious website filtering and blocking technology to identify and prevent employees from accessing known phishing websites and malicious links, protecting them from the threat of cyber attacks and fraud.

[0130] Based on the same inventive concept, an embodiment of the present application provides a data processing device, which is used to implement any of the above data processing methods, for example Figure 2 The data processing method shown, and the device can also realize the functions of the execution device mentioned above.

[0131] Please refer to Figure 4 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. Figure 4As shown, the data processing device 400 includes an acquisition module 401 , a determination module 402 and a detection module 403 .

[0132] Exemplarily, the acquisition module 401 is used to acquire website data of the first website according to the first website to be detected; the determination module 402 is used to input the website data into the trained industry classification model to obtain the first industry category of the first website; the determination module 402 is also used to determine, according to the first industry category, a first counterfeit website detection model that matches the first industry category from a pre-stored counterfeit website detection model set, the first counterfeit website detection model being trained based on the semantic features of the sample website data corresponding to the first industry category; the detection module 403 is used to input the first industry category and the website data into the first counterfeit website detection model to obtain a detection result, and the detection result is used to indicate whether the first website is a counterfeit website.

[0133] In a possible implementation, the detection module 403 is further used to: generate a first rule set based on a pre-collected first sample website data set and a preset rule induction algorithm, the first rule set being a plurality of first rules obtained by expanding, classifying and summarizing the semantic features in the first sample website data set through the rule induction algorithm; process the first rule set and the rules in the predefined second rule set according to a preset rule processing operation to generate a third rule set, the rules in the third rule set being obtained by merging the rules that have an inclusion relationship and the rules that have a conflict relationship in the first rule set and the second rule set; train the initial first counterfeit website detection model based on the semantic features of the first industry category in the third rule set and the common features of the first industry category, in combination with cross-validation and grid search algorithms, to obtain a trained first counterfeit website detection model.

[0134] In a possible implementation, the detection module 403 is specifically used to: generate a feature vector set for each first sample website data according to the occurrence frequency of each word in each first sample website data of the first sample website data set, a first threshold and a pre-stored vocabulary; generate a rule set for each first sample website data according to the feature vector set and a rule induction algorithm, wherein each rule in the rule set is associated with a confidence level; and group the rules in the rule set of each first sample website data of the first sample website data whose confidence level exceeds the second threshold into a first rule set.

[0135] In one possible implementation, the detection module 403 is specifically used to: associate a confidence level with each rule in the first rule set and the second rule set according to the confidence level and preset confidence level of each rule in the first rule set and the second rule set; if it is determined that there is a first rule in the first rule set whose condition range is greater than the condition range indicated by the second rule, determine whether the first rule and the second rule belong to the same confidence level, and the second rule is any rule in the second rule set or any rule in the first rule set except the first rule; if the first rule and the second rule do not belong to the same confidence level, delete the rule with a lower confidence level; if the first rule and the second rule belong to the same confidence level, delete the first rule; and generate a third rule set based on the merged first rule set and the second rule set.

[0136] In a possible implementation, the detection module 403 is specifically used to: determine whether there are third and fourth rules in the first rule set, the third and fourth rules are associated with the same website data, and the industry categories indicated by the third and fourth rules are different; if so, determine whether the rule conditions included in the third and fourth rules overlap; if so, delete the rule with a lower confidence level; if not, merge the third and fourth rules into the fifth rule, and according to the second industry category input by the user based on the fifth rule, associate the fifth rule with the second industry category and store it in the first rule set; determine the second rule set and the merged first rule set as the third rule set.

[0137] In a possible implementation, the determination module 402 is further used to: extract a keyword set of each industry category from the second sample website data set; count the number of occurrences and frequency of each keyword in the keyword set in each industry category to determine the information gain of each keyword, where the information gain is used to indicate the degree of association between each keyword and each industry category; determine sample keywords of each industry category based on the information gain of each keyword in the keyword set and a third threshold. Based on the sample keywords of each industry category, the initial industry classification model is trained in combination with cross-validation and grid search algorithms to obtain a trained industry classification model.

[0138] Based on the same inventive concept, an embodiment of the present application provides a data processing device, which is used to implement any of the above data processing methods, for example Figure 2 The data processing method shown, and the device can also realize the functions of the execution device mentioned above.

[0139] Please refer to Figure 5 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. Figure 5As shown, the data processing device 500 includes at least one processor 501 and a memory 502 communicatively connected to the at least one processor 501 .

[0140] The processor 501 may be a general-purpose processor or a dedicated processor. The processor 501 may include, for example, a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data. The central processing unit may be used to control the data processing device 500, execute software programs and / or process data. Different processors may be independent devices or may be arranged in one or more processing circuits, for example, integrated in one or more dedicated integrated circuits.

[0141] In one embodiment, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 implements the functions of the execution device as described above by executing the instructions stored in the memory 502, and accordingly, can also implement the steps performed by the execution device as described above.

[0142] In this embodiment, the data processing device 500 can also implement the functions of the previous text data processing device 400, and at least one processor 501 in the data processing device 500 can also implement the functions of the previous text acquisition module 401, the determination module 402 and the detection module 403.

[0143] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any of the data processing methods described above, for example, Figure 2 The data processing method shown.

[0144] Based on the same inventive concept, an embodiment of the present application provides a computer program product, which includes computer instructions. When the computer program product is executed on a computer, any of the above-mentioned data processing methods is implemented, for example, Figure 2 The data processing method shown is implemented.

[0145] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0146] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data processing method, characterized in that: include: According to the first website to be detected, obtaining website data of the first website; Inputting the website data into the trained industry classification model to obtain the first industry category of the first website; According to the first industry category, determining a first counterfeit website detection model that matches the first industry category from a pre-stored counterfeit website detection model set, wherein the first counterfeit website detection model is trained based on semantic features of sample website data corresponding to the first industry category; The first industry category and the website data are input into the first counterfeit website detection model to obtain a detection result, where the detection result is used to indicate whether the first website is a counterfeit website.

2. The method according to claim 1, characterized in that The method further comprises: Generate a first rule set according to the pre-collected first sample website data set and a preset rule induction algorithm, wherein the first rule set is a plurality of first rules obtained by expanding, classifying, and summarizing the semantic features in the first sample website data set through the rule induction algorithm; According to a preset rule processing operation, the first rule set and the rules in the predefined second rule set are processed to generate a third rule set, wherein the rules in the third rule set are obtained by merging the rules in the first rule set and the second rule set that have an inclusion relationship and the rules in a conflict relationship; According to the semantic features of the first industry category and the common features of the first industry category in the third rule set, combined with cross-validation and grid search algorithms, the initial first counterfeit website detection model is trained to obtain the trained first counterfeit website detection model.

3. The method according to claim 2, characterized in that According to the pre-collected first sample website data set and the preset rule induction algorithm, a first rule set is generated, including: Generate a feature vector set for each first sample website data according to the occurrence frequency of each word in each first sample website data of the first sample website data set, a first threshold and a pre-stored word library; Generate a rule set for each first sample website data according to the feature vector set and the rule induction algorithm, wherein each rule in the rule set is associated with a confidence level; The rules whose confidence level in the rule set of each first sample website data exceeds the second threshold are combined into the first rule set.

4. The method according to claim 2, characterized in that: According to a preset rule processing operation, the rules in the first rule set and the predefined second rule set are merged to generate a third rule set, including: Associating a confidence level for each rule in the first rule set and the second rule set according to the confidence of each rule in the first rule set and the second rule set and a preset confidence level; If it is determined that there is a first rule in the first rule set whose condition range is greater than the condition range indicated by the second rule, determining whether the first rule and the second rule belong to the same confidence level, the second rule being any rule in the second rule set or any rule in the first rule set other than the first rule; If the first rule and the second rule do not belong to the same confidence level, deleting the rule with a lower confidence level; If the first rule and the second rule belong to the same confidence level, deleting the first rule; The third rule set is generated according to the merged first rule set and second rule set.

5. The method according to claim 2, characterized in that: According to a preset rule processing operation, the rules in the first rule set and the predefined second rule set are merged to generate a third rule set, including: Determine whether there is a third rule and a fourth rule in the first rule set, the third rule and the fourth rule are associated with the same website data, and the third rule and the fourth rule indicate different industry categories; If so, determining whether the rule conditions included in the third rule and the fourth rule overlap; If there is overlap, the rule with the lower confidence level is deleted; If there is no overlap, the third rule and the fourth rule are combined into a fifth rule, and according to the second industry category input by the user based on the fifth rule, the fifth rule is associated with the second industry category and stored in the first rule set; The second rule set and the combined first rule set are determined as the third rule set.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Extract keyword sets of various industry categories from the second sample website data set; Counting the number of occurrences and the frequency of occurrence of each keyword in the keyword set in each industry category, and determining the information gain of each keyword, wherein the information gain is used to indicate the degree of association between each keyword and each industry category; Determining sample keywords of each industry category according to the information gain of each keyword in the keyword set and a third threshold; According to the sample keywords of each industry category, the initial industry classification model is trained in combination with cross-validation and grid search algorithms to obtain the trained industry classification model.

7. A data processing device, characterized in that: include: An acquisition module, used for acquiring website data of the first website according to the first website to be detected; A determination module, configured to input the website data into a trained industry classification model to obtain a first industry category of the first website; The determination module is further configured to determine, according to the first industry category, a first counterfeit website detection model that matches the first industry category from a pre-stored counterfeit website detection model set, wherein the first counterfeit website detection model is trained based on semantic features of sample website data corresponding to the first industry category; The detection module is used to input the first industry category and the website data into the first counterfeit website detection model to obtain a detection result, wherein the detection result is used to indicate whether the first website is a counterfeit website.

8. A data processing device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the method according to any one of claims 1 to 6 by executing the instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed on a computer, enable the method according to any one of claims 1 to 6 to be implemented.

Images