Privacy-protecting WEB page harmful content detection method and system

Abstract

The invention discloses a privacy-protecting WEB page harmful content detection method and system. The method comprises the following steps: configuring a harmful information set; sending an application request for accessing a network; constructing a learning type Bloom filter of at least one Hash function pair based on the application request for training, splitting each Hash function pair after training, storing the split deep Hash function and the verification array in a database, and feeding back the split surface Hash function in response to the application request; obtaining a response of the network webpage, generating and sending a surface layer hash value set to carry out harmful content detection; and performing corresponding processing in response to a detection result of the surface layer hash value set. According to the method, the bloom filter is constructed and the hash function is set to detect the surface hash value set of the keyword, plaintext data is not involved, irreversible detection results are transmitted, the plaintext data cannot be restored, and user privacy is protected; and the detection efficiency, effectiveness and accuracy are improved by reducing the length of the verification array.

Description

Technical Field

[0001] The present invention belongs to the technical field of detecting harmful contents of web page privacy data, and in particular relates to a method and system for detecting harmful contents of WEB pages for protecting privacy. Background Art

[0002] At present, there are often web pages with harmful content on the Internet, and the harmful content includes but is not limited to harmful information such as pornography, violence, gambling, and fraud. Some of the harmful content will use encryption protocols to encrypt access requests and return data, which makes it difficult to detect effectively and accurately. In addition, there are two basic requirements for harmful content detection to protect user privacy: one is to ensure the privacy of user access content, and the plaintext content accessed by users cannot be cracked by attackers or detection servers; the other is that the harmful information set of the detection server cannot be leaked. The current mainstream encrypted content detection mechanism uses federated learning, which has high computational overhead and cannot match the actual application scenarios in reality. In addition, the efficiency and accuracy of encrypted content detection are not high. However, with the improvement of the security of encryption protocols, it is impossible to effectively discover harmful content in web pages through traffic detection on the network side, and thus it is impossible to promptly remind users that the web pages they visit contain harmful content, which poses a great security risk.

[0003] The present invention provides a method, system, device and medium for detecting harmful content in a WEB page for protecting user privacy, which is used to solve the problems that the detection efficiency of encrypted content is low, the effectiveness and accuracy are poor, and the security of user privacy is difficult to be effectively guaranteed when accessing a WEB page. Summary of the invention

[0004] The present invention provides a method and system for detecting harmful content in a WEB page for protecting user privacy, which is used to solve the problems that the detection efficiency of encrypted content is low, the effectiveness and accuracy are poor, and the security of user privacy is difficult to be effectively guaranteed when accessing traditional WEB pages. The present invention converts the data of a web page into a keyword set through a keyword extraction algorithm, performs encryption calculation on the keyword set through a hash function group in a learning Bloom filter, and transmits the irreversible encryption calculation result to a server for detecting harmful content. The detection process of the server does not involve the plaintext data of the web page, and the plaintext data of the web page cannot be restored, thereby achieving the purpose of protecting user privacy. In addition, the hash function group of the Bloom filter is optimized through a machine learning algorithm and a local sensitive hash algorithm, and harmful information is set as a key and non-harmful information is set as a non-key through a hash function heuristic search algorithm in the learning Bloom filter. On the one hand, classification of multiple types of keys and keys, and non-keys and non-keys is achieved, and the search target of the search algorithm is effectively optimized by minimizing the conflict between keys and keys, and non-keys and non-keys in the Bloom filter, thereby effectively reducing the length of the verification array and improving the detection efficiency. At the same time, the difficulty of cracking the plaintext data in the web page visited by the user is increased through the verification array and the distance metric, and the time complexity of the detection algorithm is low, thereby improving the effectiveness and accuracy of harmful information detection.

[0005] The purpose of the present invention and the solution to the technical problem are achieved by adopting the following technical solutions.

[0006] The present invention provides a privacy-protecting WEB webpage harmful content detection method, the detection method at the server end comprises: obtaining an access application request for accessing an external network webpage, constructing a learning Bloom filter of at least one hash function pair based on the access application request; splitting each hash function pair trained based on a harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and feeding back the split surface hash function in response to the access application request; obtaining a surface hash value set of an external network webpage response; performing harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feeding back the harmful content detection result of the surface hash value set.

[0007] As another optional implementation of the present invention, the harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training includes: obtaining the corresponding deep hash value set based on the surface hash value set based on the split deep hash function; determining the data information of the quantity, category, and level of harmful information in the surface hash value set based on the deep hash value set based on the corresponding verification array after training; generating the harmful content detection result based on the data information of the quantity, category, and level of harmful information in the surface hash value set.

[0008] As another optional implementation of the present invention, the splitting is based on each hash function pair trained based on the harmful information set, and the split deep hash function and the corresponding verification array after training are stored in a database. Feedback of the split surface hash function in response to an access application request includes: training the deep hash function for the surface hash value corresponding to the deep hash function based on a bucketing model of local sensitive hashing according to the configured harmful information set; mapping the surface hash function value corresponding to the harmful information of the same category into a fixed position of the corresponding verification array.

[0009] As another optional implementation of the present invention, the splitting is based on each hash function pair after training of the harmful information set, and the split deep hash function and the corresponding verification array after training are stored in a database. Before responding to the access application request to feedback the split surface hash function, it includes: classifying the configured harmful information set, and setting the level of each type of harmful information according to the classification; generating the corresponding verification array after training based on the category and level of the harmful information set based on the training of the deep hash function.

[0010] As another optional implementation of the present invention, the mapping of surface hash function values ​​corresponding to harmful information of the same category into fixed positions of corresponding verification arrays includes: iteratively training the surface hash function based on the corresponding verification array after training, and establishing a distance metric between surface hash function values; setting harmful information as a key and setting non-harmful information as a non-key; in a domain corresponding to a surface hash function, obtaining a target hash function of a deep hash function based on a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition; and mapping different categories of harmful information to positions under the distance metric corresponding to the deep hash function based on the target hash function.

[0011] As another optional implementation of the present invention, in a domain corresponding to a surface hash function, obtaining a target hash function of a deep hash function based on a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition includes: generating a set of standard Bloom filters based on the key and heuristic search algorithm according to the deep hash function of the learning Bloom filter; verifying the existence of the non-key in the standard Bloom filter; if it is verified that the non-key does not exist and the conflict between non-keys is maximized, the training ends; otherwise, adjusting the deep hash function of the standard Bloom filter in sequence until the adjusted deep hash function is the target hash function.

[0012] The present invention also provides a privacy-protecting method for detecting harmful content on WEB pages. The detection method on the client includes: generating and sending an access application request; obtaining a surface hash function that is split after training based on a configured set of harmful information; generating and sending a surface hash function value set to be detected based on the surface hash function according to a response from an external network web page; and responding to a detection result of the surface hash function value set to be detected.

[0013] As another optional implementation of the present invention, the method of generating and sending a surface hash function value set to be detected based on a surface hash function according to a response of an external network web page includes: extracting valid text information corresponding to the traffic according to the response of the external network web page; extracting words to be detected based on a word segmentation algorithm according to the valid text information to generate a vocabulary set to be detected; performing text preprocessing on the vocabulary set to be detected based on a keyword extraction algorithm; performing vocabulary classification processing on the vocabulary set to be detected after text preprocessing, and updating the vocabulary set after screening; and generating a surface hash function value set from the screened vocabulary set based on a surface hash function.

[0014] The present invention also provides a privacy-protecting WEB page harmful content detection system, which includes: a client, which is used to generate and send an access application request; obtain a surface hash function that is split after training based on a configured harmful information set; generate a surface hash function value set to be detected based on the surface hash function according to the response of the external network web page; and respond to the detection result of the surface hash function value set to be detected. A server, which is used to obtain an access application request for accessing an external network web page, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request; obtain the surface hash value set of the external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feedback the harmful content detection result of the surface hash value set.

[0015] As another optional implementation of the present invention, the server includes: a first initialization module, which is used to obtain an access application request for accessing an external network web page, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in the database, and feedback the split surface hash function in response to the access application request; a first detection module, which is used to obtain the surface hash value set of the external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feedback the harmful content detection result of the surface hash value set. The client includes: a second initialization module, which is used to generate and send an access application request; obtain the surface hash function split after training based on the configured harmful information set; a second detection module, which is used to generate and send the surface hash function value set to be detected based on the surface hash function according to the response of the external network web page; and respond to the detection result of the surface hash function value set to be detected.

[0016] Compared with the prior art, the present invention has obvious advantages and beneficial effects. Based on the above technical solution, the present invention has at least one of the following advantages and effects: 1. A privacy-protecting method for detecting harmful content on a WEB web page is provided by the present invention. The detection method on the server side includes: obtaining an access application request for accessing an external network web page, and constructing a learning Bloom filter of at least one hash function pair based on the access application request; splitting each hash function pair trained based on a harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and feeding back the split surface hash function in response to the access application request; obtaining a surface hash value set of an external network web page response; performing harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feeding back the harmful content detection result of the surface hash value set. The detection method of the present invention is applied to a server side, and a surface hash function is encrypted before and after training through a hash function group in a learning Bloom filter, and the encrypted surface hash function value is transmitted to the server side for detecting harmful content. The detection process of the server side does not involve plain text data of a WEB page, and the plain text data of the WEB cannot be restored, thereby achieving the purpose of protecting user privacy and increasing the difficulty of cracking plain text data in a WEB page visited by a user. By adopting a verification array for verification, the time complexity of the detection algorithm is low, and the effectiveness and accuracy of harmful information detection are improved.

[0017] 2. The present invention provides a privacy-protecting method for detecting harmful content on a WEB web page. The detection method on the client side includes: generating and sending an access application request; obtaining a surface hash function that is split after training based on a configured set of harmful information; generating and sending a set of surface hash function values ​​to be detected based on the surface hash function according to a response from an external network web page; and responding to a detection result of the set of surface hash function values ​​to be detected. The present invention generates an access application request for a user to access an external network web page on a client, and sends the generated access application request to a server to trigger the initialization of the server, obtains a surface hash function fed back after training and splitting according to a configured harmful information set on the server, and deploys the surface hash function; converts the response data of the WEB web page into a keyword set through a keyword extraction algorithm, performs hash calculation on the keyword set through the deployed surface hash function to generate a surface hash function value set and encrypts it, and transmits the encrypted and irreversible surface hash function value set to the server for harmful content detection. The detection method of the client makes the detection process of the server not involve the plaintext data of the WEB web page, and cannot restore the plaintext data of the WEB web page, thereby achieving the purpose of protecting user privacy; in addition, by generating a surface hash function value, the difficulty of cracking the plaintext data in the WEB web page visited by the user is increased, and the time complexity of the detection is reduced, thereby improving the effectiveness and accuracy of the harmful information detection method of the client.

[0018] 3. The present invention provides a privacy-protecting harmful content detection system for WEB pages, which includes: a client, which is used to generate and send an access application request; obtain a surface hash function that is split after training based on a configured harmful information set; generate a surface hash function value set to be detected based on the surface hash function according to the response of the external network web page; and respond to the detection result of the surface hash function value set to be detected. A server, which is used to obtain an access application request for accessing an external network web page, and build a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request; obtain the surface hash value set of the external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feedback the harmful content detection result of the surface hash value set.The detection system of the present invention converts the data of a WEB webpage into a keyword set based on a keyword extraction algorithm at a client, generates and sends a surface hash function value set to be detected to a server through a surface hash function split after training based on a configured harmful information set, and the server performs harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training; trains the deep hash function for the surface hash value corresponding to the deep hash function based on a bucketing model of local sensitive hashing through the configured harmful information set; iteratively trains the surface hash function based on the verification array corresponding to the training, and establishes a distance metric between surface hash function values; sets harmful information as a key and non-harmful information as a non-key; in a domain corresponding to a surface hash function, obtains a target hash function of the deep hash function based on a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition; maps different categories of harmful information to the distance metric corresponding to the deep hash function based on the target hash function The harmful content detection result of the surface hash value set is obtained and encrypted at the position below, and by feeding back the irreversible harmful content detection result to the client, it is difficult for the client to crack the detection process verified by the server, as well as the plaintext data of the configured harmful information set, and it is impossible to completely crack the plaintext data of the configured harmful information set, thereby achieving the purpose of protecting user privacy; in addition, the hash function group of the Bloom filter is optimized through machine learning iterative training and local sensitive hashing algorithm, and the harmful information is set as the key and the non-harmful information is set as the non-key by using a heuristic search algorithm through the hash function of the learning Bloom filter; on the one hand, it realizes the classification of multiple types of keys and keys, non-keys and non-keys, and effectively optimizes the search target of the search algorithm by minimizing the conflict between keys and keys in the Bloom filter, and between non-keys and non-keys, and effectively reduces the length of the verification array. The difficulty of cracking the plaintext data in the WEB pages accessed by users is increased through the verification array, and the time complexity of the detection method is low, which further improves the effectiveness and accuracy of harmful information detection.

[0019] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above-mentioned structure and other purposes, features and advantages of the present invention more obvious and easy to understand, the following specifically cites a preferred embodiment and describes it in detail with the accompanying drawings as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The figure is a schematic diagram of the detection process of a method for detecting harmful content on a web page for protecting privacy according to the present embodiment, applied to a server.

[0021] Figure 2 The following is a schematic diagram of a detection process of a method for detecting harmful content on a WEB page for protecting privacy according to the present embodiment, applied to a client.

[0022] Figure 3 A schematic diagram of the structure of a method for detecting harmful content on a WEB page for protecting privacy according to the present embodiment.

[0023] Figure 4 The figure is a flowchart of the initialization phase of a method for detecting harmful content on a WEB page for protecting privacy according to the present embodiment.

[0024] Figure 5 The figure is a flow chart of the detection phase of a method for detecting harmful content on a web page for protecting privacy in this embodiment.

[0025] Figure 6 Schematic diagram of the structure of a privacy-protecting WEB page harmful content detection system of this embodiment.

[0026] Figure 7 The figure is a schematic diagram of the structure of a privacy-protecting WEB page harmful content detection server in this embodiment.

[0027] Figure 8 It is a structural diagram of a privacy-protecting WEB page harmful content detection client in this embodiment.

[0028] Fig. 9 FIG. 4 is a schematic diagram of the structure of an electronic device according to the present embodiment.

[0029] Description of Figure Numbers: 200: Server 210: First initialization module 220: First detection module 300: Client 310: Second initialization module 320: Second detection module 400: Web page harmful content detection system 500: Electronic equipment 510: Memory 520: Processor 530: Computer readable instructions DETAILED DESCRIPTION

[0030] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects proposed according to the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments: The present invention provides a method for detecting harmful content in a WEB page for protecting privacy. Figures 1 to 9 As shown, the detection method runs on the server and interacts with the corresponding client. The WEB page harmful content detection method includes the following process: S1: Obtain an access application request for accessing an external network web page, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on a harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request.

[0031] It should be noted that the service end includes at least one detection server, and each detection server may include at least one learning Bloom filter generation module and at least one learning Bloom filter detection module. In the present invention, after receiving a request from a client to access an external network, the detection server begins the initialization operation process. The detection server constructs a standard learning Bloom filter through the learning Bloom filter generation module. The learning Bloom filter as a whole is composed of two parts, one part is a hash function group composed of at least one hash function pair; the other part is a verification array corresponding to the hash function pair. Figure 4As shown, the learning Bloom filter constructed by the detection server includes a hash function group pair of n (n represents an integer not less than 1) hash function pairs, and a corresponding verification array. Each hash function pair includes a surface hash function and a deep hash function, and the surface hash function and the deep hash function of each hash function pair are related to each other. Before initialization, the detection server needs to configure the data of the harmful information set in the database, and train the deep hash function group composed of n hash functions based on the harmful information set. The surface hash function can be transformed by the initial deep hash function from the preset training relationship (such as the deep hash function value of the deep hash function group corresponding to the harmful information set) to generate another corresponding surface hash function. For example, the deep hash function group composed of n hash functions corresponds to the surface hash function group composed of n hash functions. The learning Bloom filter contains untrained deep hash functions and transformed surface hash functions. For example, the surface hash function can convert a keyword into a 512-bit fixed-length binary number, which is represented as a surface hash function value; the deep hash function can convert a 512-bit surface hash function value into a 64-bit binary number, which is represented as a deep hash function value. On the whole, the combination of the surface hash function and the deep hash function can be regarded as a hash function that can convert a string of any length into 64-bit binary data, which is consistent with the hash function in the conventional Bloom filter in the function of finding the hash value. The detection server can configure a harmful information set, and train a learning Bloom filter constructed based on the configured harmful information set. After training, a learning Bloom filter that meets the filtering function of the configured harmful information set and a corresponding verification array after training are generated, and stored in the database of the detection server. The learning Bloom filter is composed of the hash function group of the above-mentioned n hash function pairs. Among them, in response to the access application request of the client to access the external network web page, the split surface hash function is fed back to the client to perform the initialization operation of the client detection.

[0032] During the initialization process of the detection server, the construction process of the learning Bloom filter includes three parts: constructing a verification array, training a surface hash function group, and training a deep hash function group. First, when constructing a verification array based on the configured harmful information set, the total number of harmful information in the harmful information set in the detection server and the total length of the verification array need to be considered. The total length λ of the verification array is pre-set based on the total number of harmful information, and the detection personnel input the total length λ of the verification array into the parameter of the total length of the configuration verification array in the detection server. Secondly, in the training process of the surface hash function group, a hash function method that uses a hash function to construct a message authentication code (HMAC) can be used to distinguish different surface hash functions by their keys. Finally, until the training of the deep hash function group is completed. The surface hash function trained by the learning Bloom filter of the present invention has the property of being irreversible, and the detection server cannot reverse the plaintext corresponding to the keyword hash value provided by the client through the surface hash function group. Generally, since the collision between non-harmful information of the surface hash function of the learning Bloom filter is very high, on the basis that the detection server does not affect the execution of the operation process, there is no malicious training of the surface hash function to reduce the collision of non-harmful information of the client. Therefore, the number of plaintexts corresponding to the single non-keyword hash value found by the detection server through the collision method is large and there is no semantic consistency, so brute force cracking cannot accurately crack the client's keyword plaintext information. The present invention can ensure that the user's keywords on the client are not leaked, thereby protecting the user's privacy. The present invention can effectively prevent the client from attacking the deep hash function constructed by the harmful information set by deploying the deep hash function split after training on the detection server.

[0033] In the present invention, before obtaining an access application request for accessing an external network webpage, a harmful information set to be detected can be configured in the database of the detection server by a staff. The present invention realizes different harmful information detection requirements by using different learning Bloom filters based on the verification array to set harmful information. For example, a training learning Bloom filter can be configured to detect the amount of harmful information in a keyword; or a training learning Bloom filter can be configured to detect harmful information in a keyword, and harmful information of different categories such as "pornography" and "violence" can be classified, and then the amount of harmful information of each category can be counted; or a training learning Bloom filter can be configured to detect harmful information in a keyword, and harmful information of different categories such as "pornography" and "violence" can be classified according to different harmful levels, and finally harmful information of different harmful levels under each category can be counted respectively. Based on the triggering of a rapid application request for accessing an external network in the detection server, the initialization operation flow of the detection server is completed in response to the surface hash function of the access application request feedback split.

[0034] S2: Obtain a surface hash value set of the external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feed back the harmful content detection result of the surface hash value set.

[0035] It should be noted that the detection server uses the deep hash function group stored in the database to convert each keyword in the surface hash value set into a corresponding local sensitive hash algorithm. ( ≤n) deep hash functions The surface hash value is converted into a deep hash value. A deep hash function with The surface hash values ​​correspond one to one.

[0036] In the present invention, after the surface hash value set generates the deep hash value set, each keyword is tested based on the mapping position and the distance measurement range through the stored verification array, and the deep hash value set is generated by extracting the deep hash value set of each keyword. The harmfulness detection result of the keyword in the surface hash value set is obtained by using the Boolean value (such as 0 or 1) of the deep hash value in the indexed verification array position. For example, if the Boolean value in the result is 1, it means that the word is harmful information. After detecting the harmfulness of the harmful information in the keyword, it is further checked that the range of the distance measurement to which the local deep hash value set is mapped is located in the fixed position of the verification array. Further, the above-mentioned fixed position can be preset as a "bucket" of a fixed position, and it is checked whether the range to which the local deep hash value set is mapped is located in the bucket. If a certain local deep hash value set is mapped to the "bucket" within the distance measurement range (the fixed position range of the verification array), it can be determined that the harmful information set of the category or classification level to which the harmful information belongs. The harmful information in all keywords is detected, and the detection results are counted to obtain the request currently sent by the client to the WEB web page server, and the response sent back by the WEB web page server to extract the information on the number, category, and harmfulness level of harmful information contained in the response data packet. The detection server responds and processes the access application request to access the external network web page according to the detection results.

[0037] As an optional implementation, performing harmful content detection on a surface hash value set based on a split deep hash function and a corresponding verification array after training includes: obtaining a corresponding deep hash value set based on the surface hash value set based on the split deep hash function; determining data information on the quantity, category, and level of harmful information in the surface hash value set based on the deep hash value set based on the corresponding verification array after training; and generating a harmful content detection result based on the data information on the quantity, category, and level of harmful information in the surface hash value set.

[0038] It should be noted that in the detection server, after detecting whether the keyword is harmful information, the data information of the quantity, category, and level of the harmful information in the keyword can be calculated through the deep hash value set. For example, the harmful information in the determined keyword can be distinguished into different categories and different harmful levels, and the number of harmful information can be statistically operated. After completing the harmful information detection of the surface hash value submitted by the client, the classification, harmful level and quantity of the detected harmful information are calculated, analyzed and statistically analyzed, and the category to which the detected harmful information belongs, the harmful level and quantity of the harmful information are recorded. Further, the detection result of detecting harmful information can be generated by the data information of the quantity, category and level of harmful information in the keyword represented by the surface hash value set. Specifically, the verification array can be pre-divided into multiple segments during training to correspond to harmful information of different categories, levels and quantities. The present invention can verify the value of the fixed position indexed by the deep hash value in the array by checking, if the value all corresponds to 1, then the word is confirmed to be harmful information, otherwise the word is confirmed to be non-harmful information. For the confirmed harmful information, the category and level corresponding to the corresponding harmful information can also be determined by checking the position of the interval where the deep hash value is located. The corresponding relationship can refer to the bucket calculation method of local sensitive hashing, which will not be repeated here. The present invention trains the hash function team in the learning Bloom filter, and combines the local sensitive hashing (LSH) with the bucket concept to accurately verify the harmful information of the deep hash value converted from the surface hash value, so that the calculation process of harmful information filtering and verification is more efficient. When facing a large number of clients and a large amount of access data for each client, it is very necessary to efficiently filter harmful information through the learning Bloom filter trained by learning, and analyze and process the classification, harmful level and quantity of harmful information.

[0039] As an optional implementation, each hash function pair trained based on a harmful information set is split, the split deep hash function and the corresponding verification array after training are stored in a database, and the split surface hash function is fed back in response to an access application request, including: training the deep hash function for the surface hash value corresponding to the deep hash function based on a bucketing model of locally sensitive hashing according to the configured harmful information set; mapping the surface hash function value corresponding to harmful information of the same category into a fixed position of the corresponding verification array.

[0040] It should be noted that the deep hash function group constructed by training is not limited to a hash function group including a set of standard Bloom filters, and is not limited to a group constructed based on local sensitive hashing (LSH) with a distance metric d(p, q). ( ≤n) locality sensitive hash functions. The detection server determines it according to the configured harmful information. Specifically, the hash function in the hash function group is actually composed of a hash function pair consisting of a surface hash function and a deep hash function. The deep hash function composed of each local sensitive hash function can be trained based on the surface hash value set, and after training, the corresponding deep hash value set can be obtained based on the input surface hash value set. The surface hash function converts the keyword into a 512-bit fixed-length binary number, called the surface hash function value; the deep hash function converts the 512-bit surface hash function value into a 64-bit binary number, called the deep hash function value. Overall, the combination of the surface hash function and the deep hash function can be regarded as a hash function that can convert a string of any length into 64-bit binary data, which is consistent with the hash function in the conventional Bloom filter in the function of obtaining the hash value. The constructed deep hash function group and the verification array are stored in the database of the detection server, and the constructed surface hash function group is transmitted back to the client. The client deploys the received surface hash function group to the detection tool to complete the initialization. The algorithm based on fixed position based on local sensitive hashing (LSH) of the present invention can make the operation efficiency of the learning Bloom filter much higher than the point indexing method of the tree structure. The learning Bloom filter of the present invention does not need to know the plain text information of the harmful information exactly, but only needs to map the hash value submitted by the client through the deep hash function accordingly, so as to map the value of the keyword plain text vocabulary of the harmful information in the harmful information set corresponding to the surface hash value to the fixed position of the verification array in the learning Bloom filter.

[0041] As an optional implementation, each hash function pair trained based on a harmful information set is split, and the split deep hash function and the corresponding verification array after training are stored in a database. Before responding to an access application request to feedback the split surface hash function, the method includes: classifying the configured harmful information set, and setting the level of each type of harmful information according to the classification; generating the corresponding verification array after training based on the category and level of the harmful information set based on the training of the deep hash function.

[0042] It should be noted that when the configured harmful information set is classified, it is not limited to classifying the harmful information according to different categories such as "pornography" and "violence", and the level of the harmful information in each category is set based on the harmful level. For example, the harmful information of the "violence" category is set to four harmful levels of "weakly harmful", "relatively harmful", "harmful", and "strongly harmful" according to the harmful level. Based on the category and level of the set of configured harmful information, a verification array of the corresponding harmful information set is generated based on the training of the deep hash function. Since the harmful information set in the detection server is divided into different multiple categories and different multiple levels, a total of M harmful information sets of different categories and different levels are preset. For each category and level of harmful information, a fixed position (fixed length range) is divided in the verification array as a "bucket" corresponding to each harmful information level in the category. The present invention allocates the position (number of bits) of the bucket corresponding to the set in the verification array according to the number of elements mj (j=1, 2, 3, ..., M) in the jth set of harmful information sets of different categories. The corresponding surface hash value set obtained can map 512-bit data within the same range to the same bucket at a preset fixed position in the verification array, so as to map the surface hash function value of a set of harmful information belonging to the same category or the same harmful level in different categories to the range of the same verification array in the database, and detect whether it is located in the "bucket" representing a certain harmful information, thereby realizing the verification and detection of harmful information in the surface hash value set composed of keywords through the verification array.

[0043] As an optional implementation, mapping the surface hash function values ​​corresponding to harmful information of the same category into the fixed positions of the corresponding verification array includes: iteratively training the surface hash function based on the corresponding verification array after training, and establishing a distance metric between the surface hash function values; setting the harmful information as the key and the non-harmful information as the non-key; in a domain corresponding to a surface hash function, according to a heuristic search algorithm, based on minimizing conflicts between keys and between non-keys as the optimization target condition, obtaining a target hash function of the deep hash function; based on the target hash function, mapping different categories of harmful information to the positions under the distance metric corresponding to the deep hash function.

[0044] It should be noted that before the training starts, it is first necessary to generate a distance metric d(p, q) based on the definition of the distance metric (not limited to the Euclidean distance), where p and q can be understood as data points consisting of different keywords in two two-dimensional spaces mapped to the verification array. The distance metric d can be specified or randomly generated. The detection server needs to store the distance metric d securely. If the distance metric is leaked to the client, the cost of brute-forcing the harmful information set in the detection server through the client will be reduced. The present invention sets harmful information as a key and non-harmful information as a non-key; and in the domain corresponding to the surface hash function, according to the heuristic search algorithm, based on minimizing the conflicts between keys and keys, and between non-keys and non-keys as the optimization target condition, obtains the target hash function of the deep hash function, and uses it as the deep hash function based on the optimal target of the shallow hash function corresponding to the conversion relationship.

[0045] In the present invention, for example, after generating the distance metric d, the optimal hash function group is searched through a combinatorial optimization algorithm, and the branch and bound method is used to find the optimal hash function in the entire set of surface hash functions within a limited time cost for each surface hash function value in the hash function group. Here, the preset surface hash function group is h_ i (x), (i=1, 2, 3, ..., n), where the objective function Maximize Z corresponding to the optimization of the optimal hash function group of the i-th surface hash function combination optimization algorithm is as follows (1): (1) in, , i, j represent positive integer sequences configured based on the harmful information set, M represents the total number of harmful information of different categories in the configured harmful information set, represents the number of harmful information sets of different categories, k represents the search depth of harmful information, l represents the search depth of harmful information in keywords, and m j represents the number of elements in the jth set of different categories of harmful information, Indicates the set of harmful information currently mapped into the bucket. Represents the keyword set in the current bucket to be mapped. The constraints of the combinatorial optimization algorithm for searching the optimal hash function group are integer constraints, and the hash function set of the message authentication code (HMAC) constructed in the feasible domain hash function is run. After learning iterations, the hash function set generated after training is the surface hash function group, so that the surface hash function group can distinguish different keywords (data points) in the two-dimensional space mapped to the verification array for different categories of keywords on the distance metric d(p, q).

[0047] In the present invention, when the corresponding deep hash value set is obtained based on the deep hash function of the trained learning Bloom filter according to the surface hash value set, the non-harmful information in the surface hash value set may be mistakenly delivered to the position (number of bits) of the bucket used for verification of the harmful information set, resulting in an example of "false positive" in the local sensitive hash algorithm. A large number of false positives will cause the risk of misjudgment to the client, and the higher the level of harmful information, the more unacceptable the cost of misjudgment. In the present invention, the length of the verification array can be increased, and the distance between the buckets corresponding to each set in the verification array (the range corresponding to the fixed position) can be increased, so that the probability of non-harmful information in the keyword being judged as harmful information and a false positive is extremely low. As an optional implementation, for a harmful information set with a high harmful level, the corresponding fixed position in the verification array (the range of the number of bits of the corresponding bucket) is appropriately enlarged according to the distance, so that the probability of non-harmful information in the keyword being judged as harmful information and a false positive is extremely low, or even negligible.

[0048] As an optional implementation, in a domain corresponding to a surface hash function, a target hash function of a deep hash function is obtained based on a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition, including: generating a set of standard Bloom filters based on the key and heuristic search algorithm according to the deep hash function of the learning Bloom filter; verifying the existence of the non-key in the standard Bloom filter; if it is verified that the non-key does not exist and the conflict between non-key and non-key is maximized, the training ends; otherwise, the deep hash function of the standard Bloom filter is adjusted in sequence until the adjusted deep hash function is the target hash function.

[0049] It should be noted that the split deep hash function is used to obtain the corresponding deep hash value set according to the surface hash value set, and the corresponding verification array after training is used to verify whether the detected surface hash value set contains corresponding harmful content. For example, it is not limited to the method of sequentially adjusting the deep hash function of the standard Bloom filter until the adjusted deep hash function is the target hash function, until all the harmful information represented by the key and the non-harmful keywords represented by the non-key can maintain the minimum conflict degree, and then the output result of the deep hash function after adjustment and training is stored as the surface hash function. That is, the target hash function output after training is the deep hash function.

[0050] As an optional implementation, the learning Bloom filter trains the surface hash function through learning iterative training, including: during the iterative training of the surface hash function, encrypting the split surface hash function based on a hash message authentication code, and distinguishing different surface hash functions based on the encrypted key.

[0051] It should be noted that the constraints of the searched optimal hash function group combinatorial optimization algorithm are integer constraints, and it runs on the complete set of hash functions of the feasible domain hash function construction message authentication code (HMAC). As an optional implementation, the distance metric can be used as the key for encrypting the surface hash function with the hash message authentication code, and different surface hash functions can be distinguished based on the encrypted key. After learning and iterative training, the set of hash functions generated after training is the surface hash function group and can be encrypted based on the hash message authentication code. On the one hand, the confidentiality and security of the split surface hash function in the encrypted state are guaranteed; on the other hand, different keywords (data points) in the two two-dimensional spaces mapped to the verification array can be better distinguished based on the distance metric d(p, q) for different categories of keywords. As a secure and confidential encryption, the transformation relationship between the hash function pair composed of the deep hash function and the surface hash function can also be set as a key, and the trained surface hash function can be encrypted by the key and transmitted to the client for decryption. The above transformation relationship is not limited to various obfuscation transformations, and the trained surface hash function is encrypted based on the transformation relationship to ensure the confidentiality of the split surface hash function.

[0052] The present invention also provides a privacy-protecting WEB page harmful content detection method, which runs on a client and interacts with a corresponding server, such as Figure 2 As shown, the method for detecting harmful content on a web page includes the following process: St1: Generate and send access application request; obtain the surface hash function after training and splitting based on the configured harmful information set.

[0053] It should be noted that the server may include at least one detected client, and the detected client may be a minimum detection unit of movable detection. The detected client generates and sends an access application request, and the access application request is not limited to an access application request for applying for access to an external network generated on the minimum detection unit of movable detection and sent to the server (such as Figure 3 ). The client of the present invention triggers the initialization operation of the service-side detection server by generating and sending an access application request, and completes the initialization operation process of the client detection method by obtaining the surface hash function split after training based on the configured harmful information set and deploying it in the detection tool. The present invention improves the efficiency of client detection deployment by directly performing detection deployment on the surface hash function split after training based on the configured harmful information set, and the deployed surface hash function can quickly and efficiently convert the extracted keyword set into the surface hash function value set, thereby improving the speed and efficiency of client detection.

[0054] St2: Generate and send a surface hash function value set to be detected based on the surface hash function according to the response of the external network web page; respond to the detection result of the surface hash function value set to be detected.

[0055] It should be noted that installing a browser plug-in on each minimized client can extract access traffic from the WEB webpage accessed by the client, as well as capture traffic from the WEB webpage response, extract a keyword set from the response traffic, and generate a surface hash function value set to be detected corresponding to the keyword set based on the surface hash function deployed in the initialization phase on the client. As an optional implementation, the transformation relationship between the surface hash function and the deep hash function after training and splitting the configured harmful information set is used as a key to encrypt the surface hash function value set to be detected and send it to the detection server of the server to ensure the confidentiality of the transmitted surface hash function value set to be detected. After the detection server generates the detection result, the detection result of the surface hash function value set to be detected responded by the server is obtained, and the client performs a preset access operation in response to the detection result of the surface hash function value set to be detected, such as allowing access or prohibiting access, to complete the detection of harmful content of the WEB webpage accessed by the client. For example, the client detection method can access the WEB webpage server. The client sends a web page access request to an external web page server. The request and response data packet capture module in the client detection tool captures and records the request sent by the client to the WEB web page server and the response traffic sent back by the WEB web page server. The captured traffic data packet is analyzed by the keyword extraction module, and the valid words involved in the traffic data packet are extracted using the word segmentation algorithm. The extracted valid word set is screened and optimized by the keyword extraction algorithm to improve the efficiency of detection. The set list formed by the above-mentioned screening and optimization of keywords is stored as a dictionary, which is called the surface hash value set of keywords. The surface hash value set is transmitted to the detection server. After the detection server performs harmful information detection and verification, the detection result of the surface hash function value set to be detected is fed back to the client. The client performs corresponding processing in response to the detection result of the surface hash function value set to be detected.

[0056] In the present invention, the surface hash function trained by the learning Bloom filter maps the surface hash function value set corresponding to the same category of harmful information to the approximate position of the distance metric d defined by the local sensitive hash function of the deep hash function. Since the client cannot know the parameter setting of the distance metric d in the local sensitive hash value adopted by the detection server, if the client brute-forces the harmful information library in the database of the detection server through the surface hash function, it is first necessary to crack the metric selected in its deep hash function. When it is impossible to verify whether the result is in the position of the corresponding "bucket", the client cannot brute-force the specific parameter value of the distance metric d mentioned above, and when the accurate distance metric value cannot be determined, the harmful information set cannot be directly brute-forced. The harmful information set is more accurately verified due to the distance metric d and the result based on the fixed position, which increases the complexity of the cracking due to the interrelated distance metric d and the fixed position, and increases the computational amount of the cracking at an exponential level. The client cannot crack the harmful information set by traversing the cracking method, which can better protect the security of the harmful information set.

[0057] As an optional implementation, generating and sending a set of surface hash function values ​​to be detected based on a surface hash function according to a response from an external network web page includes: extracting valid text information corresponding to the traffic based on the response from the external network web page; extracting words to be detected based on a word segmentation algorithm based on the valid text information to generate a set of words to be detected; performing text preprocessing on the set of words to be detected based on a keyword extraction algorithm; performing vocabulary classification processing on the set of words to be detected after text preprocessing, and updating the vocabulary set after screening; and generating a set of surface hash function values ​​from the screened vocabulary set based on a surface hash function.

[0058] It should be noted that, for example, the screening of effective words can be based on the number of effective words, the category of effective words, and the level of effective words. As another optional implementation method, for a single document, the keywords in the single document can be viewed as keywords of a category, and the categories of harmful information in the keywords, the levels of harmful information in each category, the number, etc. are statistically analyzed, and the detection results are fed back. For multiple documents such as a certain news, the title vocabulary can be used as hot words to find the focus of public opinion. Collect the corpus from which keywords need to be extracted, which is related to the hot words of the focus of news and public opinion, and perform text preprocessing such as text cleaning, spelling and error correction, unification of Chinese traditional and simplified characters, and unification of character encoding standards. The preprocessed text is divided into words and valid text is extracted. According to the valid text information, the vocabulary to be detected is extracted based on the word segmentation algorithm to generate a vocabulary set to be detected. Commonly used word segmentation tools can use "jieba" word segmentation, Chinese natural language processing library (SnowNLP), and Chinese lexical analysis toolkit (THULAC). Finally, remove repeated and disabled valid words to complete the screening and optimization of keywords to form a set list. In the present invention, the keyword set formed by the vocabulary set is not limited to being formed by a list using variable-length character encoding (utf-8).

[0059] The present invention also provides a privacy-protecting WEB page harmful content detection system, such as Figure 3 , Figure 4 and Figure 6 As shown, the WEB webpage harmful content detection system 400 includes at least one client 300 and at least one server 200. At least one client 300 is used to generate and send an access application request; obtain a surface hash function split after training based on a configured harmful information set; generate a surface hash function value set to be detected based on the surface hash function according to the response of the external network webpage; respond to the detection result of the surface hash function value set to be detected. At least one server 200 is used to obtain an access application request for accessing an external network webpage, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request; obtain the surface hash value set of the external network webpage response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feedback the harmful content detection result of the surface hash value set.

[0060] It should be noted that the server 200 includes at least one detection server. The client 300 and the server 200 of the WEB webpage harmful content detection system 400 of the present invention convert the data of the WEB webpage into a keyword set through a keyword extraction algorithm during operation. The keyword set can be encrypted and calculated through a hash function group in a learning Bloom filter, and the irreversible encryption calculation result can be transmitted to the detection server for harmful content detection. The detection process of the detection server does not involve the plaintext data of the WEB webpage, and the plaintext data of the WEB webpage cannot be restored, thereby achieving the purpose of protecting user privacy. The hash function group of the Bloom filter is optimized through machine learning and local sensitive hashing algorithm, and harmful information is set as key and non-harmful information is set as non-key in the hash function heuristic search algorithm in the learning Bloom filter. On the one hand, the classification of multiple types of keys and keys, non-keys and non-keys is realized. By increasing the conflict degree between keys and keys, and non-keys and non-keys in the Bloom filter, the search target of the search algorithm is effectively optimized, the length of the verification array is effectively reduced, and the difficulty of cracking the plaintext data in the WEB pages visited by users is increased. The time complexity of the detection algorithm is low, which improves the effectiveness and accuracy of harmful information detection.

[0061] As an optional implementation, Figure 7 As shown, the server 200 includes: a first initialization module 210, which is used for initialization before the server detection, obtaining an access application request for accessing an external network web page, and constructing a learning Bloom filter of at least one hash function pair based on the access application request; splitting each hash function pair trained based on a harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and feeding back the split surface hash function in response to the access application request; a first detection module 220, which is used to obtain a surface hash value set of an external network web page response during server detection; performing harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feeding back the harmful content detection result of the surface hash value set. Figure 8 As shown, the client 300 includes: a second initialization module 310, which is used for initialization before client detection, generating and sending an access application request; obtaining a surface hash function that is split after training based on a configured harmful information set; a second detection module 320, which is used to generate and send a surface hash function value set to be detected based on the surface hash function according to the response of the external network web page during client detection; and responding to the detection result of the surface hash function value set to be detected.

[0062] The present invention also provides an electronic device, which is applied to a server and a client. Fig. 9As shown, the electronic device 500 includes: a memory 510 for storing non-temporary computer-readable instructions 530; a processor 520 for running the computer-readable instructions 530, so that when the computer-readable instructions 530 are executed by the processor 520, the above-mentioned WEB webpage harmful content detection method is implemented.

[0063] The above technical solution of the present invention includes at least the following beneficial effects: (I) The present invention realizes accurate and efficient harmful content detection through a learning Bloom filter. Compared with traditional homomorphic encryption and other methods, the present invention has the same computational time cost and ensures that the harmful information detection indicators of the category, level and quantity of harmful information are accurate, and the time efficiency of each detection is improved by more than 1,000 times, which can achieve a harmful information detection delay of milliseconds, greatly improving the harmful information detection efficiency of keywords. Among them, the detection tool realizes the client's parsing of the plain text of the browser web page content, and combines the word segmentation algorithm, keyword analysis algorithm and surface hash function algorithm to realize the client's functional requirements for keyword extraction, encryption and confidential transmission. The learning Bloom filter constructed and trained by the present invention trains and optimizes its corresponding hash function through a machine learning algorithm, constructs and trains a deep hash function through local sensitive hashing, and constructs a surface function through a combinatorial optimization algorithm. The hash function of the hash function pair in the learning Bloom filter is constructed by a two-layer hash function group consisting of a deep hash function and a shallow hash function.

[0064] (ii) The present invention classifies harmful information (keys) by setting harmful information as keys, non-harmful information as non-keys, and different types of harmful information as different types of words (such as harmful information and non-harmful information) in the above-mentioned improved learning Bloom filter, so that the conflict between harmful information of the same type of keywords is high, and the conflict between harmful information of different types of keywords is low. It is precisely based on the high conflict between harmful information that it can be applied to harmful information detection and analysis, so that the Bloom filter can be detected and verified with a probability of 100%, thereby identifying harmful information in keywords. For example, in the detection and verification stage, the deep hash function realizes the verification of position and structure values ​​under the distance metric, improves the conflict between keys, and at the same time, by mapping the non-harmful information (non-key) of keywords in the deep hash function with a high probability to the complement of the mapping position of all harmful information sets under the distance metric, so as to enhance the high conflict between the non-harmful information (non-key) of keywords, so that the hash function can simultaneously realize the high conflict between the non-harmful information (non-key) of keywords and the high conflict between the harmful information (key) of keywords within a better time and space complexity. The present invention further ensures the privacy security of the client by making it impossible for the detection server to decipher the keyword set submitted by the client by brute force cracking under the conditions of high conflict between non-harmful information of the keywords and high conflict between harmful information of the keywords.

[0065] (III) In the present invention, a long verification array is used, so that the verification array of the improved learning Bloom filter can be more accurate in the verification of position and structure values, avoiding the non-harmful information in the keyword set from being mistakenly determined as harmful information in the harmful information set after detection and verification, and realizing the above-mentioned accurate detection (ensuring that harmful information in the keyword set is determined as harmful information in the harmful information set after detection and verification), and distinguishing different categories of harmful information with a higher probability, greatly reducing the occurrence of "false positive" conditions with a probability of less than 1% of misclassification in detection and verification, so that non-harmful information in the keyword set is mistakenly identified as harmful information in the harmful information set with an acceptable probability. In addition, the computational time cost of constructing the improved and trained learning Bloom filter in the present invention is highly acceptable, and there is no need to consider the problem of verification array transmission, so a long verification array can be used, and the distinction range of different categories of harmful information is made larger, which improves the accuracy of detection and verification.

[0066] (IV) The present invention protects the privacy of the client and the privacy of the detection server against the harmful information set through the learning Bloom filter hash function group constructed by two layers of hash functions. The communication data between the client and the detection server are all encrypted data and cannot be used by attackers. In the initialization phase, the data transmission of the surface hash function group can be in the form of a key array corresponding to HMAC, so that the attacker cannot analyze any transmission information between the detection server and the client from the key array; in the detection phase, the message sent by the client to the detection server is only a dictionary of surface hash values. Without involving the distance measurement, deep hash function group, verification array and their related relationships of the detection server, the attacker cannot obtain any useful information about the harmful information set from the dictionary of surface hash values. Even if the attacker obtains the above-mentioned distance measurement, deep hash function group, verification array, and the detection server with its related relationship, the security of the surface hash function is guaranteed due to the irreversibility of the generated surface hash function, and the keyword data information of the client cannot be cracked. Therefore, the WEB network harmful content detection method and system of the present invention can be used to test whether the elements of the keyword set are members of the harmful information set, realizing safe confidential harmful information detection, and can efficiently complete the detection task of the configured harmful information set, saving time and space for filtering calculations with high accuracy.

[0067] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as a preferred embodiment as above, it is not intended to limit the present application. Any technician familiar with the profession can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A privacy-protecting WEB page harmful content detection method, characterized in that: The server-side detection methods include: Obtain an access application request for accessing an external network web page, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request; Obtain a surface hash value set of an external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feed back the harmful content detection result of the surface hash value set.

2. The method for detecting harmful content of a web page according to claim 1, characterized in that: The detecting harmful content on the surface hash value set based on the split deep hash function and the corresponding verification array after training includes: Obtain a corresponding deep hash value set based on the split deep hash function according to the surface hash value set; Determine the data information of the quantity, category and level of harmful information in the surface hash value set based on the deep hash value set and the corresponding verification array after training; Generate harmful content detection results based on data information on the quantity, category, and level of harmful information in the surface hash value set.

3. The method for detecting harmful content of a web page according to claim 1, characterized in that: The splitting is based on each hash function pair trained on the harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and responding to the access application request to feedback the split surface hash function includes: The deep hash function is trained based on the bucketing model of local sensitive hashing according to the configured harmful information set for the surface hash value corresponding to the deep hash function; Map the surface hash function value corresponding to the harmful information of the same category into the fixed position of the corresponding verification array.

4. The method for detecting harmful content of a web page according to claim 3, characterized in that: The splitting is based on each hash function pair trained based on the harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and responding to the access application request to feedback the split surface hash function before comprising: Classify the configured harmful information set, and set the level of each type of harmful information according to the classification; According to the category and level of the harmful information set, a corresponding verification array is generated based on the training of the deep hash function.

5. The method for detecting harmful content of a web page according to claim 3, characterized in that: The mapping of the surface hash function value corresponding to the harmful information of the same category into the fixed position of the corresponding verification array includes: Iteratively train the surface hash function based on the corresponding validation array after training, and establish a distance metric between the surface hash function values; Set harmful information as key and non-harmful information as non-key; In a domain corresponding to a surface hash function, a target hash function of a deep hash function is obtained based on a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition; Based on the target hash function, different categories of harmful information are mapped to the positions under the corresponding distance metric of the deep hash function.

6. The method for detecting harmful content of a web page according to claim 5, characterized in that: The target hash function of the deep hash function is obtained in a domain corresponding to a surface hash function according to a heuristic search algorithm based on minimizing conflicts between keys and between non-keys as an optimization target condition, including: Generate a set of standard Bloom filters based on the key and heuristic search algorithm according to the deep hash function of the learned Bloom filter; Verify the existence of non-keys in the standard Bloom filter; if it is verified that the non-key does not exist and the non-key-non-key conflict is maximized, the training ends; Otherwise, the deep hash function of the standard Bloom filter is adjusted in sequence until the adjusted deep hash function becomes the target hash function.

7. A privacy-protecting method for detecting harmful content on a web page, characterized in that: Client detection methods include: Generate and send access application requests; Get the surface hash function after training and splitting based on the configured harmful information set; Generate and send a set of surface hash function values ​​to be detected based on the surface hash function according to the response of the external network webpage; In response to the detection result of the surface hash function value set to be detected.

8. The method for detecting harmful content of a web page according to claim 7, characterized in that: The step of generating and sending a surface hash function value set to be detected based on a surface hash function according to a response of an external network webpage includes: Extract valid text information corresponding to the traffic according to the response of the external network web page; extract the words to be tested based on the word segmentation algorithm according to the valid text information to generate a word set to be tested; Perform text preprocessing on the vocabulary set to be detected based on the keyword extraction algorithm; Classify the vocabulary set to be detected after text preprocessing, and update the vocabulary set after screening; The filtered vocabulary set is used to generate a surface hash function value set based on the surface hash function.

9. A privacy-protecting web page harmful content detection system, characterized in that: include: The client is used to generate and send access application requests; Get the surface hash function after training and splitting based on the configured harmful information set; Generate a set of surface hash function values ​​to be detected based on the surface hash function according to the response of the external network webpage; In response to a detection result of the surface hash function value set to be detected; The server is used to obtain an access application request for accessing an external network web page, and to construct a learning Bloom filter of at least one hash function pair based on the access application request; Splitting each hash function pair trained based on the harmful information set, storing the split deep hash function and the corresponding verification array after training in a database, and feeding back the split surface hash function in response to an access application request; Obtain a surface hash value set of an external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feed back the harmful content detection result of the surface hash value set.

10. The web page harmful content detection system according to claim 9, characterized in that: The server side includes: The first initialization module is used to obtain an access application request for accessing an external network web page, and construct a learning Bloom filter of at least one hash function pair based on the access application request; split each hash function pair trained based on the harmful information set, store the split deep hash function and the corresponding verification array after training in a database, and feedback the split surface hash function in response to the access application request; The first detection module is used to obtain a surface hash value set of an external network web page response; perform harmful content detection on the surface hash value set based on the split deep hash function and the corresponding verification array after training, and feed back the harmful content detection result of the surface hash value set; The client includes: The second initialization module is used to generate and send an access application request; Get the surface hash function after training and splitting based on the configured harmful information set; A second detection module, configured to generate and send a surface hash function value set to be detected based on a surface hash function according to a response of an external network webpage; In response to the detection result of the surface hash function value set to be detected.

Images