Illegal webpage judgment method and device, electronic equipment and storage medium

Abstract

The invention provides a violation webpage judgment method, device and equipment and a computer program product. The method comprises the following steps: determining a potential pretending webpage corresponding to a target webpage; and based on the hyperlink record of the potential pretending webpage, determining a hyperlink domain name naming rule of the potential pretending webpage. Taking whether the hyperlink domain name of the target webpage conforms to the hyperlink domain name naming rule or not as a standard, and performing illegal webpage judgment on the target webpage to obtain an illegal webpage judgment result of the target webpage. According to the method and the device, on the premise of machine execution, effective violation webpage judgment can be carried out on the webpage of which the page content layout is scrambled on the premise of machine execution.

Description

Technical Field

[0001] The present application relates to the field of risk control, and in particular to a method, device, equipment and computer program product for judging illegal web pages. Background Art

[0002] With the popularization of the Internet, there are fake and illegal websites in the current network environment, which poses a security risk to people's assets.

[0003] At present, the relevant preventive measures are to find illegal websites through user reports and machine recognition, and mark the illegal websites as risks. When the browser opens the marked illegal website, it can prompt the user to the risk. Among them, the machine recognition method is to use crawler technology to crawl web page content and import the web page content into the deep learning model for illegal identification. It can be seen that the existing machine recognition method judges illegal web pages based on whether the web page content is illegal.

[0004] In actual applications, users cannot report all illegal websites, so machine recognition is indispensable. However, in order to evade machine recognition, most illegal websites scramble the layout of illegal content on the page. This measure will cause the machine recognition method to be unable to obtain accurate web page content, which in turn causes the deep learning model to fail.

[0005] Therefore, how to provide a more effective machine-executable illegal web page judgment solution is a technology that urgently needs to be solved. Summary of the invention The purpose of the present application is to provide a method, device, equipment and computer program product for judging illegal web pages, which can effectively judge illegal web pages with disordered page content layout under the premise of machine execution.

[0006] In order to achieve the above purpose, the embodiment of the present application is implemented as follows: In a first aspect, a method for determining illegal web pages is provided, comprising: Determine potential impersonation web pages corresponding to the target web pages; Determining a naming rule of a hyperlink domain name of the potential impersonating webpage based on the hyperlink record of the potential impersonating webpage; The target webpage is judged as a non-compliant webpage based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and a non-compliant webpage judgment result of the target webpage is obtained.

[0007] In a second aspect, a device for determining illegal web pages is provided, comprising: A fake webpage determination module, used to determine a potential fake webpage corresponding to a target webpage; A naming rule determination module, used to determine a naming rule of a hyperlink domain name of a potential impersonating web page based on a hyperlink record of the potential impersonating web page; The illegal webpage judging module is used to judge the target webpage against illegal webpages based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and obtain the illegal webpage judging result of the target webpage.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, cause the processor to execute the method described in the first aspect.

[0009] According to a fourth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the method described in the first aspect when executed by a processor.

[0010] The embodiment of the present application takes into account that the hyperlinks of illegal web pages are phishing links, and generally cannot obtain the hyperlink naming of regular websites. Therefore, when it is necessary to judge the target web page as an illegal web page, first determine the potential impersonating web page corresponding to the target web page, and determine the hyperlink domain name naming rules of the potential impersonating web page based on the hyperlink record of the potential impersonating web page; then, based on whether the hyperlink domain name of the target web page meets the hyperlink domain name naming rules as the standard, judge the target web page as an illegal web page, and obtain the illegal web page judgment result of the target web page. Since the entire scheme is judged by the hyperlink domain name naming rules instead of the web page content, even if the target web page scrambles the layout of the page content, effective illegal web page identification can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0012] Figure 1 This is a first flow chart of the method for determining illegal web pages according to an embodiment of the present application.

[0013] Figure 2 A schematic diagram of directly using ORC technology to extract content from scrambled pages.

[0014] Figure 3This is a schematic diagram of using the ORC technology to extract content from a scrambled page based on the page layout recovery mechanism of this embodiment.

[0015] Figure 4 This is a second flow chart of the method for determining illegal web pages according to an embodiment of the present application.

[0016] Figure 5 This is a third flow chart of the method for determining illegal web pages according to an embodiment of the present application.

[0017] Figure 6 Schematic diagram of the structure of the illegal web page judgment device according to an embodiment of the present application.

[0018] Figure 7 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] As mentioned above, the current prevention of illegal websites is mainly through risk tagging through user reports. In the absence of user reports, we can only crawl web content and use deep learning models to perform machine recognition and tagging. In actual applications, most illegal websites are equipped with anti-crawling functions, and can evade machine recognition by appropriately disrupting the page layout of illegal content.

[0020] In view of this, the present application aims to propose a solution for determining illegal web pages, which can effectively identify illegal web pages that are configured with anti-crawling functions and / or have scrambled layouts of page contents.

[0021] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0022] An embodiment of the present application provides a method for determining illegal web pages. Figure 1 This is a flowchart of the method for judging illegal web pages, including the following steps: S102, determining a potential counterfeit web page corresponding to the target web page.

[0023] In the prior art, the webpage domain name of the illegal webpage is generally close to the webpage domain name of the counterfeit webpage, so as to achieve the purpose of misleading the real thing. To this end, this embodiment can determine the compliant webpage similar to the webpage domain name of the target webpage from multiple compliant webpages with recorded webpage domain names based on the domain name macro model, and use the determined compliant webpage as the potential counterfeit webpage corresponding to the target webpage.

[0024] In addition, this embodiment can also identify potential impersonating web pages through some keywords of the target web page. For example, the illegal web page impersonating the official website of XXX generally provides the information of "XXX official website". Therefore, "XXX official website" can be used as a keyword to find the real official website web page corresponding to the keyword as a potential impersonating web page.

[0025] S104, based on the hyperlink record of the potential counterfeit webpage, determine the hyperlink domain name naming rule of the potential counterfeit webpage.

[0026] Normally, a legitimate web page will add hyperlinks to its business activities, and these hyperlinks will have certain naming rules, namely the hyperlink domain name naming rules. However, the hyperlinks of illegal web pages are phishing links and cannot be named like the hyperlinks of legitimate websites.

[0027] To this end, this embodiment can obtain hyperlink records of potential impersonation web pages from historical network data of potential impersonation web pages, and semantically refine the hyperlink domain name format in the hyperlink records of potential impersonation web pages based on the language big model to obtain the hyperlink domain name naming rules of the potential impersonation web pages, and subsequently use the hyperlink domain name naming rules as the basis for judging illegal web pages.

[0028] In actual applications, the business activities of regular web pages are constantly updated. In order to ensure the timeliness of the hyperlink domain name naming rules, this embodiment obtains the most recent historical network data of the potential impersonating web page from a time window whose time difference with the current time is less than or equal to a preset time difference threshold. For example, hyperlink records are obtained from the historical network data of the potential impersonating web page in the past week to refine the hyperlink domain name naming rules through the language big model.

[0029] S106, judging the target web page as a non-compliant web page based on whether the hyperlink domain name of the target web page complies with the hyperlink domain name naming rule, and obtaining a judgment result of the non-compliant web page of the target web page.

[0030] In this embodiment, the hyperlink domain name naming rule can be used as a prompt word of the domain name macro model, and the domain name macro model is used to determine whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule.

[0031] If the hyperlink domain name of the target webpage does not conform to the hyperlink domain name naming rules of potential counterfeit webpages, the target webpage can be directly judged as an illegal webpage, or the target webpage can be judged as a suspected illegal webpage, so that the target webpage can be marked and tracked intensively.

[0032] If the hyperlink domain name of the target web page meets the naming rules of the hyperlink domain name of the potential impersonated web page, other methods can be used to determine whether the target web page is an illegal web page, such as: determining the registration agency of the jump web page corresponding to the hyperlink of the target web page; using whether the registration agency of the jump web page is a compliant agency as the judgment standard, and / or using whether the registration agency of the jump web page is an illegal agency as the judgment standard to determine whether the target web page is an illegal web page, and obtaining the illegal web page judgment result of the target web page.

[0033] In addition, based on the foregoing, it can be seen that illegal web pages can evade machine recognition by disrupting the page layout of the illegal content appropriately.

[0034] To solve this problem, if it is still necessary to judge illegal web pages based on web page content, this embodiment proposes a page layout recovery mechanism, which includes the following steps: S1, using an existing large image segmentation model (such as a SAM model) to segment the web page image of the target web page to obtain multiple sub-images.

[0035] S2, determining the association degree between each sub-image and grouping all sub-images based on the association degree between the sub-images.

[0036] It should be understood that after the webpage content is scrambled, the original page area of ​​a certain content may be dispersed into sub-images at different positions. By calculating the correlation degree of each sub-image, sub-images belonging to the same content can be found.

[0037] Specifically, this embodiment may determine the degree of association between the sub-images based on at least one of the degree of association of semantic information, the degree of association of graphic element information, and the degree of association of position information between the sub-images.

[0038] Among them, semantic information refers to the semantic content to be expressed by the sub-image; graphic element information refers to the image element features of the sub-image, such as font, background color, etc.; position information refers to the coordinates of the sub-image.

[0039] Generally, sub-images with the same content should have very similar semantic information, graphic element information and position information. In this embodiment, the degree of association is used to characterize the degree of similarity, and sub-images with a high degree of association are grouped together.

[0040] S3, for each group, the semantic information of all sub-images is summarized to obtain the summarized semantic information.

[0041] This step is to reassemble the semantic information of the originally disassembled sub-images and try to obtain the original content, that is, the summary semantic information. Subsequently, the target web page is judged as a violation web page based on whether the summary semantic information contains violation information, and the violation web page judgment result of the target web page is obtained. For example, if the summary semantic information contains violation information or the amount of violation information contained reaches a certain standard, the target web page is judged as a violation web page or a potential violation web page.

[0042] For ease of understanding, refer to Figure 2 and Figure 3 .

[0043] Figure 2 This is a schematic diagram of directly using ORC technology to extract content from a scrambled page. It can be seen that when the illegal content and regular content are separated and mixed together to a certain extent, ORC cannot effectively extract the content expressed by the page, and the illegal content cannot be identified by the deep learning model machine in the future.

[0044] Figure 3 FIG. 1 is a schematic diagram of extracting content from a scrambled page using the ORC technology based on the page layout recovery mechanism of this embodiment. It can be seen that this embodiment first performs image segmentation on the page to obtain different sub-images (dashed boxes), and then groups the sub-images based on the degree of association, thereby grouping the sub-images of the same content into one group to restore the original content of the page, which can then be subsequently identified as illegal content by the deep learning model machine.

[0045] In summary, the method of this embodiment takes into account that the hyperlinks of illegal web pages are phishing links, and generally cannot obtain the hyperlink naming of regular websites. Therefore, when it is necessary to judge the target web page as an illegal web page, first determine the potential impersonating web page corresponding to the target web page, and determine the hyperlink domain name naming rules of the potential impersonating web page based on the hyperlink record of the potential impersonating web page; then, based on whether the hyperlink domain name of the target web page meets the hyperlink domain name naming rules, the target web page is judged as an illegal web page, and the illegal web page judgment result of the target web page is obtained. Since the entire scheme is judged by the hyperlink domain name naming rules instead of the web page content, even if the target web page scrambles the layout of the page content, effective illegal web page identification can be achieved.

[0046] It should be noted that, in addition to using the hyperlink domain name naming rule as a criterion for determining illegal web pages, this embodiment can also combine the above-mentioned other methods to determine whether a target web page is an illegal web page.

[0047] For example: first verify whether the target page is an illegal page by checking whether the hyperlink domain name of the target page complies with the hyperlink domain name naming rules, and whether the registration agency of the hyperlink jump page corresponding to the target page is a formal agency. If the target page has a deep anti-crawling function enabled and cannot extract the hyperlink to determine the domain name, you can take a screenshot of the target page image, and then process the page image according to the page layout recovery mechanism described above, and then use ORC technology to extract the page content and input it into the deep learning model for illegal information identification. Once it is identified that the page content contains illegal information, the target page is determined to be an illegal page.

[0048] For example: when the anti-crawl function is not enabled on the target page, the target page is triple-verified to see whether it is an illegal web page by checking whether the hyperlink domain name of the target page complies with the hyperlink domain name naming rules, whether the registration agency of the hyperlink jump page corresponding to the target page is a formal agency, and using ORC technology to extract page content based on the page layout recovery mechanism to identify illegal information.

[0049] The following describes the method for determining illegal web pages in this embodiment in combination with actual applications.

[0050] refer to Figure 4 As shown, the main process of the illegal web page judgment method of this embodiment includes: Step 1: Web page information extraction; This step captures the user's web page switching operation through a browser plug-in or dedicated client software, so as to extract web page information after determining that the user has entered a new web page. The information to be extracted includes the website domain name, the hyperlink domain name used in the web page, and web page screenshots, etc. Among them, the website domain name and the hyperlink domain name used in the web page are obtained through crawlers, and the web page screenshots are achieved through browser plug-ins or dedicated client software.

[0051] Step 2: Link security judgment; The links referred to in this step include the hyperlinks in the web pages extracted in step one.

[0052] The security judgment of hyperlinks is implemented by the intelligent agent of the language big model, including the domain name big model, domain name search API and search API.

[0053] Domain name big model: By collecting the official website and activity link data of each enterprise and unit, as well as common link imitation formats and sample data to build a link data set, the domain name big model has the ability to refine the hyperlink domain name naming rules through fine-tuning training and data knowledge base plug-in.

[0054] Domain Name Search API: Use the interface to query the registration agency of the jump page related to the hyperlink.

[0055] Retrieval API: Dynamically retrieve historical network data related to hyperlinks in the form of an interface, including changes in the official website, hyperlinks of new and old activities, etc.

[0056] The corresponding process is as follows Figure 5 As shown, including: Process ①: Obtain the target website’s link information, including its own domain name and hyperlinks in the web page, through the browser plug-in, and send it to the domain name model.

[0057] Process ②: The domain name model pre-processes and pre-screens all input links and sends them to the domain name search API.

[0058] Process ③: The domain name search API searches for the hyperlinks of the target web page to determine the registration agency to which the hyperlink corresponds to the jump page; if the registration agency is a regular official website, the link security judgment is completed; if the registration agency is an irregular official website, the registration agency information is recorded.

[0059] Process ④: Summarize the registration agency’s information (such as registration address, registration time).

[0060] Process ⑤: Domain name model, pre-processing the target web page domain name and all hyperlink domain names to find out the close official website domain names and official website links to judge potential counterfeit web pages, generate a potential counterfeit web page candidate list, and send it to the search API.

[0061] Process ⑥: Search API retrieves historical network data of the recent time window of potential counterfeit web pages, and uses semantic analysis models such as BERT or GPT-like language models to extract the hyperlink domain name format of hyperlinks commonly used in regular active links, and generate hyperlink domain name naming rules.

[0062] It should be understood that if the hyperlink domain name of the target web page does not comply with the hyperlink domain name naming rules, it is more likely to be an illegal web page.

[0063] Process ⑦: Summarize all the hyperlink domain name naming rules extracted from process ⑥.

[0064] Process ⑧: The domain name model comprehensively determines whether the target web page is an illegal web page based on the summarized and sorted information of the registration agency and the naming rules of the linked domain name.

[0065] Process ⑨: Output the judgment results of illegal web pages and display them.

[0066] Step 3: Determine the security of web page content; Process ①: For web pages that cannot directly read text or image hyperlinks in the background, a method of extracting and judging information based on web page images is adopted. First, the browser plug-in or dedicated client software takes a screenshot of the web page.

[0067] Process ②: Use large image segmentation models such as SAM to segment the web page image and obtain multiple sub-images.

[0068] Process ③: Based on the position coordinate information of the segmented sub-images, use the Layout class image association calculation network to calculate the association between the sub-images based on the text font, content, and position coordinates in the sub-images, and regroup the segmented sub-images according to the association calculation results.

[0069] Process ④: The regrouped images and text information are subjected to text information recognition through OCR technology or models with image information recognition capabilities such as visual big models. The extracted content is extracted and judged by models with semantic understanding capabilities such as BERT models and language big models, and the fraudulent web page identification results based on the web page content are output and combined with the fraudulent web page identification results based on the domain name involved in step 3.

[0070] In addition, corresponding to Figure 1 In addition to the method shown, another embodiment of this embodiment further provides a device for determining illegal web pages. Figure 6 : is a schematic diagram of the structure of the illegal webpage judging device 600, comprising: The counterfeit webpage determination module 610 is used to determine a potential counterfeit webpage corresponding to the target webpage.

[0071] The naming rule determination module 620 is used to determine the hyperlink domain name naming rule of the potential impersonating web page based on the hyperlink record of the potential impersonating web page.

[0072] Normally, a legitimate web page will add hyperlinks to its business activities, and these hyperlinks will have certain naming rules, namely the hyperlink domain name naming rules. However, the hyperlinks of illegal web pages are phishing links and cannot be named like the hyperlinks of legitimate websites.

[0073] The illegal webpage judging module 630 is used to judge the target webpage as an illegal webpage based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and obtain the illegal webpage judgment result of the target webpage.

[0074] Based on the device of this embodiment, considering that the hyperlinks of illegal web pages are phishing links, they generally cannot get the hyperlink naming of regular websites. Therefore, when it is necessary to judge the target web page as an illegal web page, first determine the potential impersonating web page corresponding to the target web page, and determine the hyperlink domain name naming rules of the potential impersonating web page based on the hyperlink record of the potential impersonating web page; then, based on whether the hyperlink domain name of the target web page meets the hyperlink domain name naming rules, judge the target web page as an illegal web page, and obtain the illegal web page judgment result of the target web page. Since the entire scheme does not depend on the web page content of the target web page, it can also effectively identify illegal web pages for web pages that are configured with anti-crawling functions and / or have scrambled layouts of page content.

[0075] Optionally, the counterfeit web page determination module 610 determines a potential counterfeit web page corresponding to a target web page, including: based on a domain name macro model, determining a compliant web page that is similar to the web page domain name of the target web page from a plurality of compliant web pages with recorded web page domain names, and using the determined compliant web page as a potential counterfeit web page corresponding to the target web page.

[0076] Optionally, the naming rule determination module 620 determines the hyperlink domain name naming rule of the potential impersonation web page based on the hyperlink record of the potential impersonation web page, including: obtaining the hyperlink record of the potential impersonation web page from the historical network data of the potential impersonation web page; based on the language big model, semantically refining the hyperlink domain name format in the hyperlink record of the potential impersonation web page to obtain the hyperlink domain name naming rule of the potential impersonation web page.

[0077] Optionally, the time difference between the time window to which the historical network data of the potential counterfeit webpage belongs and the current time is less than or equal to a preset time difference threshold.

[0078] Optionally, the device of this embodiment further includes: The content judgment module is used to perform image segmentation on the web page image after the target web page is screenshotted to obtain multiple sub-images when the anti-crawl function is enabled on the target web page; group all the sub-images based on the correlation between the sub-images; wherein the correlation between the sub-images in each group meets a preset standard; for each group, summarize the semantic information of all the sub-images to obtain summarized semantic information; and perform illegal web page judgment on the target web page based on whether the summarized semantic information contains illegal information to obtain an illegal web page judgment result of the target web page.

[0079] Optionally, the degree of association between the sub-images is determined based on at least one of a degree of association among semantic information, a degree of association among graphic element information, and a degree of association among position information of the sub-images.

[0080] Optionally, the device of this embodiment further includes: The registration agency determination module is used to determine the registration agency of the jump webpage corresponding to the hyperlink of the target webpage; whether the registration agency of the jump webpage is a compliant agency is used as a judgment standard, and / or whether the registration agency of the jump webpage is an illegal agency is used as a judgment standard to judge whether the target webpage is an illegal webpage, and obtain the illegal webpage judgment result of the target webpage.

[0081] It should be noted that the illegal web page determination device of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions in the method shown.

[0082] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0083] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0084] The memory is used to store the computer program. Specifically, the computer program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides the computer program to the processor.

[0085] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming the above-mentioned Figure 6Correspondingly, the processor executes the program stored in the memory and is specifically used to perform the following operations: Identify potential impersonation pages for the target page.

[0086] Based on the hyperlink record of the potential counterfeit webpage, a hyperlink domain name naming rule of the potential counterfeit webpage is determined.

[0087] The target webpage is judged as a non-compliant webpage based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and a non-compliant webpage judgment result of the target webpage is obtained.

[0088] The electronic device of this embodiment takes into account that the hyperlinks of illegal web pages are phishing links, and generally cannot obtain the hyperlink naming of regular websites. Therefore, when it is necessary to judge the target web page as an illegal web page, first determine the potential impersonating web page corresponding to the target web page, and determine the hyperlink domain name naming rules of the potential impersonating web page based on the hyperlink record of the potential impersonating web page; then, based on whether the hyperlink domain name of the target web page meets the hyperlink domain name naming rules as the standard, the target web page is judged as an illegal web page, and the illegal web page judgment result of the target web page is obtained. Since the entire scheme is judged by the hyperlink domain name naming rules instead of the web page content, even if the target web page scrambles the layout of the page content, effective illegal web page identification can be achieved.

[0089] The above is as in this manual Figure 1The illegal webpage judgment method disclosed in the illustrated embodiment can be applied to a processor and implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0090] Of course, in addition to software implementation, the electronic device of this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0091] In addition, an embodiment of the present application also proposes a computer-readable storage medium, which stores one or more computer programs, and the one or more computer programs include instructions.

[0092] When the above instructions are executed by a portable electronic device including multiple application programs, the portable electronic device can execute Figure 1 The steps in the method shown include: Identify potential impersonation pages for the target page.

[0093] Based on the hyperlink record of the potential counterfeit webpage, a hyperlink domain name naming rule of the potential counterfeit webpage is determined.

[0094] The target webpage is judged as a non-compliant webpage based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and a non-compliant webpage judgment result of the target webpage is obtained.

[0095] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0097] The above are only embodiments of this specification and are not intended to limit this specification. For those skilled in the art, this specification may be subject to various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification. In addition, all other embodiments obtained by ordinary technicians in this field without creative work shall fall within the scope of protection of this document.

Claims

1. A method for determining illegal web pages, characterized in that: include: Identify potential impersonating web pages corresponding to the target web page; Determining a naming rule of a hyperlink domain name of the potential impersonating webpage based on the hyperlink record of the potential impersonating webpage; The target webpage is judged as a non-compliant webpage based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and a non-compliant webpage judgment result of the target webpage is obtained.

2. The method according to claim 1, characterized in that Identify potential impersonation pages corresponding to the target page, including: Based on the domain name macro model, a compliant web page similar to the web page domain name of the target web page is determined from a plurality of compliant web pages with recorded web page domain names, and the determined compliant web page is used as a potential counterfeit web page corresponding to the target web page.

3. The method according to claim 1, characterized in that Determining a naming rule of a hyperlink domain name of the potential impersonating webpage based on the hyperlink record of the potential impersonating webpage includes: Acquire a hyperlink record of the potential impersonated web page from the historical network data of the potential impersonated web page; wherein the time difference between the time window to which the historical network data of the potential impersonated web page belongs and the current time is less than or equal to a preset time difference threshold; Based on the language macro model, the hyperlink domain name format in the hyperlink record of the potential counterfeit web page is semantically refined to obtain the hyperlink domain name naming rule of the potential counterfeit web page.

4. The method according to claim 3, characterized in that: The time difference between the time window to which the historical network data of the potential counterfeit webpage belongs and the current time is less than or equal to a preset time difference threshold.

5. The method according to claim 1, characterized in that In the case where the target webpage enables an anti-crawling function, the method further includes: Performing image segmentation on the webpage image obtained by taking a screenshot of the target webpage to obtain a plurality of sub-images; Based on the correlation between the sub-images, all the sub-images are grouped; wherein the correlation between the sub-images in each group reaches a preset correlation threshold; Summarize the semantic information of all sub-images in each group to obtain summarized semantic information; Based on whether the summarized semantic information contains illegal information, the target webpage is judged as an illegal webpage to obtain an illegal webpage judgment result of the target webpage.

6. The method according to claim 5, characterized in that The degree of association between the sub-images is determined based on at least one of a degree of association among semantic information, a degree of association among graphic element information, and a degree of association among position information of the sub-images.

7. The method according to claim 1, characterized in that Also includes: Determine a registration agency of a redirected web page corresponding to the hyperlink of the target web page; Whether the registration agency of the jump webpage is a compliant agency is used as a judgment standard, and / or whether the registration agency of the jump webpage is an illegal agency is used as a judgment standard to judge whether the target webpage is an illegal webpage, and a judgment result of the illegal webpage of the target webpage is obtained.

8. A device for determining illegal web pages, characterized in that: include: A fake webpage determination module, used to determine a potential fake webpage corresponding to a target webpage; A naming rule determination module, used to determine a naming rule of a hyperlink domain name of a potential impersonating web page based on a hyperlink record of the potential impersonating web page; The illegal webpage judging module is used to judge the target webpage against illegal webpages based on whether the hyperlink domain name of the target webpage complies with the hyperlink domain name naming rule, and obtain the illegal webpage judging result of the target webpage.

9. An electronic device, comprising: processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer-readable storage medium storing a computer program, characterized in that: The computer program is operable to cause a computer to perform the method according to any one of claims 1 to 7.

Images