PDF (Portable Document Format) document detection method and device

Abstract

The embodiment of the invention discloses a PDF (Portable Document Format) document detection method and device. In the embodiment of the invention, a cross reference table of a PDF (Portable Document Format) document is obtained, and the cross reference table comprises positions of a plurality of crotch objects in the PDF document; determining a plurality of document objects according to the cross reference table; determining a graph structure of the PDF document and a node feature of each document object according to the plurality of document objects; and inputting the graph structure and the plurality of node features into a pre-trained graph neural network, and determining a detection result of the PDF document. According to the method, the graph structure and the node features are input into the graph neural network, so that the PDF document can be accurately detected, and whether the PDF document is tampered or not is judged.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to a method and device for PDF document detection. Background Art

[0002] Portable Document Format (PDF) is widely used in finance, law, medicine, education, scientific publishing and other fields. Many reports, contracts, invoices, publications, etc. in the above fields are recorded as PDF documents. Therefore, it is very important to identify whether the content in the PDF document is authentic and whether it has been tampered with.

[0003] In the prior art, digital signature technology is used to encrypt PDF documents. The signer first embeds a digital signature in the PDF document. After the recipient receives the encrypted PDF document, he can verify through the digital signature whether the PDF document is created or permitted by a specific subject and has not been tampered with. Ideally, any modification to the PDF document will invalidate the digital signature; however, there are security vulnerabilities in digital signatures in PDF software, which can change the content in the PDF document without causing an exception or error prompt of the digital signature. In addition, there are a large number of PDF documents that do not have a digital signature embedded, and it is impossible to inform the user that the content in the PDF has been modified through an exception or error prompt of the digital signature.

[0004] To sum up, how to accurately detect PDF documents and determine whether PDF documents have been tampered with is a problem that needs to be solved at present. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for detecting a PDF document, which can accurately detect a PDF document and determine whether the PDF document has been tampered with.

[0006] In a first aspect, an embodiment of the present invention provides a method for detecting a PDF document, the method comprising:

[0007] Obtain a cross-reference table of a PDF document, wherein the cross-reference table includes positions of a plurality of document objects in the PDF document;

[0008] determining a plurality of document objects according to the cross-reference table;

[0009] Determine a graph structure of the PDF document and a node feature of each of the document objects according to the plurality of document objects;

[0010] The graph structure and the plurality of node features are input into a pre-trained graph neural network to determine a detection result of the PDF document.

[0011] Optionally, determining the graph structure of the PDF document according to the multiple document objects specifically includes:

[0012] Obtain an indirect reference object of each document object;

[0013] Determining an indirect reference relationship according to the indirect reference object;

[0014] A graph structure of the PDF document is generated according to the indirect reference relationship and the plurality of document objects.

[0015] Optionally, generating the graph structure of the PDF document according to the indirect reference relationship and the multiple document objects specifically includes:

[0016] Determining the indirect reference relationship as an edge of the graph structure, and determining the plurality of document objects as nodes in the graph structure;

[0017] The graph structure is generated according to the edges and the nodes.

[0018] Optionally, determining the node feature of each document object according to the multiple document objects specifically includes:

[0019] The document object is input into a natural language model to generate node features of the document object.

[0020] Optionally, inputting the graph structure and the plurality of node features into a pre-trained graph neural network to determine the detection result of the PDF document specifically includes:

[0021] Inputting the graph structure and the plurality of node features into a pre-trained graph neural network, classifying the graph structure and each of the node features, and determining a first classification result of the graph structure and a second classification result of each of the node features;

[0022] A detection result of the PDF document is determined according to the first classification result and / or the second classification result.

[0023] Optionally, determining the detection result of the PDF document according to the first classification result specifically includes:

[0024] In response to the first classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0025] In response to the first classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0026] Optionally, determining the detection result of the PDF document according to the second classification result specifically includes:

[0027] In response to the second classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0028] In response to the second classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0029] Optionally, determining the detection result of the PDF document according to the first classification result and the second classification result specifically includes:

[0030] In response to the first classification result being tampered, determining the detection result of the PDF document as tampered; and determining the tampered area in the PDF document according to the document object corresponding to the node feature whose second classification result is tampered.

[0031] Optionally, the processing of the pre-trained graph neural network includes:

[0032] Obtain a PDF document dataset, wherein the PDF document dataset includes historical PDF documents and corresponding historical detection results;

[0033] Training parameters in the graph neural network according to the PDF document dataset;

[0034] The pre-trained graph neural network is determined according to the parameters.

[0035] In a second aspect, an embodiment of the present invention provides a device for detecting a PDF document, the device comprising:

[0036] An acquisition unit, configured to acquire a cross-reference table of a PDF document, wherein the cross-reference table includes positions of a plurality of document objects in the PDF document;

[0037] A first determining unit, configured to determine a plurality of document objects according to the cross-reference table;

[0038] A second determining unit, configured to determine a graph structure of the PDF document and a node feature of each of the document objects according to the plurality of document objects;

[0039] The third determination unit is used to input the graph structure and the multiple node features into a pre-trained graph neural network to determine the detection result of the PDF document.

[0040] Optionally, the second determining unit is specifically configured to:

[0041] Obtain an indirect reference object of each document object;

[0042] Determining an indirect reference relationship according to the indirect reference object;

[0043] A graph structure of the PDF document is generated according to the indirect reference relationship and the plurality of document objects.

[0044] Optionally, the second determining unit is specifically configured to:

[0045] Determining the indirect reference relationship as an edge of the graph structure, and determining the plurality of document objects as nodes in the graph structure;

[0046] The graph structure is generated according to the edges and the nodes.

[0047] Optionally, the second determining unit is specifically configured to:

[0048] The document object is input into a natural language model to generate node features of the document object.

[0049] Optionally, the third determining unit is specifically configured to:

[0050] Inputting the graph structure and the plurality of node features into a pre-trained graph neural network, classifying the graph structure and each of the node features, and determining a first classification result of the graph structure and a second classification result of each of the node features;

[0051] A detection result of the PDF document is determined according to the first classification result and / or the second classification result.

[0052] Optionally, the third determining unit is further configured to:

[0053] In response to the first classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0054] In response to the first classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0055] Optionally, the third determining unit is further configured to:

[0056] In response to the second classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0057] In response to the second classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0058] Optionally, the third determining unit is further configured to:

[0059] In response to the first classification result being tampered, determining the detection result of the PDF document as tampered; and determining the tampered area in the PDF document according to the document object corresponding to the node feature whose second classification result is tampered.

[0060] Optionally, during the processing of the pre-trained graph neural network, the acquisition unit is further used to:

[0061] Obtain a PDF document dataset, wherein the PDF document dataset includes historical PDF documents and corresponding historical detection results;

[0062] The device also includes: a training unit, used to train parameters in the graph neural network according to the PDF document data set; and a fourth determination unit, used to determine the pre-trained graph neural network according to the parameters.

[0063] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, the memory being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement a method as described in the first aspect or any possible embodiment of the first aspect.

[0064] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement a method as described in the first aspect or any possible embodiment of the first aspect.

[0065] In an embodiment of the present invention, a cross-reference table of a PDF document is obtained, wherein the cross-reference table includes the positions of multiple document objects in the PDF document; multiple document objects are determined according to the cross-reference table; the graph structure of the PDF document and the node features of each document object are determined according to the multiple document objects; the graph structure and the multiple node features are input into a pre-trained graph neural network to determine the detection result of the PDF document. Through the above method, by inputting the graph structure and the node features into the graph neural network, the PDF document can be accurately detected to determine whether the PDF document has been tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0067] Figure 1 is a flow chart of a method for detecting a PDF document in an embodiment of the present invention;

[0068] Figure 2is a flow chart of a method for determining the graph structure of the PDF document in an embodiment of the present invention;

[0069] Figure 3 is a schematic diagram of a graph structure in an embodiment of the present invention;

[0070] Figure 4 is a flow chart of a method for pre-training a graph neural network in an embodiment of the present invention;

[0071] Figure 5 is a schematic diagram of a device for PDF document detection in an embodiment of the present invention;

[0072] Figure 6 is a schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The present application is described below based on embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, some specific details are described in detail. It is possible for those skilled in the art to fully understand the present application without the description of these details. In order to avoid confusing the essence of the present application, known methods, processes, flows, components and circuits are not described in detail.

[0074] In addition, persons of ordinary skill in the art will appreciate that the drawings provided herein are for illustration purposes and are not necessarily drawn to scale.

[0075] Unless the context clearly requires otherwise, the words "include", "comprising" and similar words throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, the meaning is "including but not limited to".

[0076] In the description of this application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0077] In the prior art, after the digital signature function is added to the PDF standard, the digital signature technology is used to encrypt the PDF document. The signer first embeds the digital signature in the PDF document. After the recipient receives the encrypted PDF document, the digital signature can be used to verify whether the PDF document is created or permitted by a specific subject and has not been tampered with, that is, the source, integrity and authenticity of the PDF document are authenticated through the digital signature. Ideally, any modification to the PDF document will cause the digital signature to become invalid; however, there are security vulnerabilities in the digital signature in the PDF software, which can change the content in the PDF document without causing an exception or error prompt of the digital signature. In addition, on various information, social, publishing, scientific and other platforms, a large number of PDF documents published do not embed digital signatures as auxiliary authentication information, and it is impossible to inform users that the content in the PDF has been modified through an exception or error prompt of the digital signature. Users can only infer whether it has been tampered with by analyzing the structure, association and other characteristics of the PDF document. Not only is the judgment efficiency low, but it is also impossible to accurately judge whether the PDF document has been tampered with. Therefore, how to accurately detect PDF documents and judge whether PDF documents have been tampered with is a problem that needs to be solved at present.

[0078] In order to solve the above problems, a method for detecting PDF documents is proposed in the embodiment of the present invention. Figure 1 As shown, the method includes:

[0079] Step S101: Obtain a cross-reference table of a PDF document, wherein the cross-reference table includes positions of multiple document objects in the PDF document.

[0080] Specifically, the cross-reference table is an important component of the PDF document. The information contained in the cross-reference table allows random access to document objects (also called indirect objects or indirect reference objects) within the PDF document, and any specific object can be located without reading the entire PDF document; each document object includes an entry in the cross-reference table, specifying the position of the document object in the main body of the PDF document; the cross-reference table is the only part of the PDF document with a fixed format, and consists of one or more cross-reference parts.

[0081] Step S102: Determine a plurality of document objects according to the cross-reference table.

[0082] Specifically, the document object is a part of a PDF document, and the document object contains all elements in the PDF document, such as text, images, hyperlinks, etc.; the PDF document is composed of a series of document objects, and the document objects can be basic objects or composite objects. The basic objects are strings, numbers, names, arrays, dictionaries, streams, etc., and the composite objects are pages, fonts, color spaces, etc.

[0083] In a possible implementation, the multiple document objects can be directly located according to the cross-reference table.

[0084] Step S103: determining the graph structure of the PDF document and the node features of each of the document objects according to the multiple document objects.

[0085] Specifically, the flowchart of determining the graph structure of the PDF document according to the multiple document objects is as follows: Figure 2 As shown, specifically including:

[0086] Step S201: Obtain an indirect reference object of each document object.

[0087] Step S202: Determine an indirect reference relationship according to the indirect reference object.

[0088] Specifically, the indirect reference relationship shown refers to the relationship between a document object and an indirect reference object indirectly referenced by it. The indirect reference is a way to optimize the storage and processing of PDF files. In the PDF document, a document object can be indirectly referenced instead of being directly included in the PDF document. For example, a binary stream exists in the PDF document but is not displayed in the PDF editor. The indirect reference uses a unique object encoding ID.

[0089] Step S203: Generate a graph structure of the PDF document according to the indirect reference relationship and the multiple document objects.

[0090] Specifically, the indirect reference relationship is determined as an edge of the graph structure, and the multiple document objects are determined as nodes in the graph structure; and the graph structure is generated according to the edges and the nodes.

[0091] In a possible implementation, the graph structure includes a tree structure and nodes outside the tree structure. Figure 3The figure shows a schematic diagram of a graph structure, including a tree structure and three nodes outside the tree structure, wherein the tree structure includes node 1, node 2, node 3, node 4, node 5, node 6, node 7, node 8, node 9 and node 10, and edges between node 1, node 2, node 3, node 4, node 5, node 6, node 7, node 8, node 9 and node 10, and the three nodes outside the tree structure are node 11, node 12 and node 13, which are only illustrative here and will be determined according to actual conditions.

[0092] In the embodiment of the present invention, determining the node feature of each document object according to the multiple document objects specifically includes: inputting the document object into a natural language model to generate the node feature of the document object.

[0093] In an embodiment of the present invention, the main task of the natural language model (LM) is to calculate the probability or representation of a given sequence, wherein the given sequence is a word, a sentence or a text; in natural language processing (NLP), the language model is widely used in various tasks, such as speech recognition, machine translation, text generation, etc.; by learning a large amount of text data, the natural language model can understand the structure and pattern of the language, thereby predicting the next word or character.

[0094] In a possible implementation, other natural language models such as BERT and miniLM may be used to generate the node features of the document object, or the node features of the document may be directly generated without using a natural language model.

[0095] Step S104: input the graph structure and the plurality of node features into a pre-trained graph neural network to determine a detection result of the PDF document.

[0096] Specifically, the Graph Neural Networks (GNN) is a deep learning model for processing graph data; the GNN can learn the representation of nodes, edges and the entire graph structure, and is suitable for various tasks, such as social network analysis, chemical molecular structure analysis, recommendation systems, etc.

[0097] In a possible implementation, in addition to the above-mentioned graph neural network GNN, a graph convolutional network (GCN), a graph attention network (GAT) or RevGAT can also be used, depending on the actual situation.

[0098] In a possible implementation, the step of inputting the graph structure and the multiple node features into a pre-trained graph neural network to determine the detection result of the PDF document specifically includes: inputting the graph structure and the multiple node features into a pre-trained graph neural network, classifying the graph structure and each of the node features, and determining a first classification result of the graph structure and a second classification result of each of the node features; and determining the detection result of the PDF document based on the first classification result and / or the second classification result.

[0099] In the embodiment of the present invention, the detection result of the PDF document is determined according to the first classification result and / or the second classification result, which is specifically divided into three cases, respectively as follows:

[0100] Case 1: Determining the detection result of the PDF document based on the first classification result.

[0101] Specifically, in response to the first classification result being tampered with, the detection result of the PDF document is determined to be tampered with; or, in response to the first classification result being not tampered with, the detection result of the PDF document is determined to be not tampered with.

[0102] In an embodiment of the present invention, the graph neural network can perform binary classification on the graph structure, that is, the first classification result can be divided into two situations: tampered and not tampered with. If the first classification result is tampered, it can be determined that the detection result of the PDF document is tampered with, or, if the first classification result is not tampered with, it can be determined that the detection result of the PDF document is not tampered with.

[0103] Case 2: determining the detection result of the PDF document according to the second classification result.

[0104] Specifically, in response to the second classification result being tampered with, the detection result of the PDF document is determined to be tampered with; or, in response to the second classification result being not tampered with, the detection result of the PDF document is determined to be not tampered with.

[0105] In an embodiment of the present invention, the graph neural network can perform binary classification on each of the node features, that is, the second classification result of the node feature can be divided into two situations: tampered and not tampered; if the second classification result is tampered, then it can be determined that the corresponding node is tampered, and then the detection result of the PDF document is determined to be tampered; or, if the first classification result is not tampered, it can be determined that each corresponding node has not been tampered with, and then the detection result of the PDF document can be determined to be not tampered with.

[0106] Case 3: determining the detection result of the PDF document according to the first classification result and the second classification result.

[0107] Specifically, in response to the first classification result being tampered, the detection result of the PDF document is determined to be tampered; and according to the document object corresponding to the node feature whose second classification result is tampered, the tampered area in the PDF document is determined.

[0108] In an embodiment of the present invention, the graph neural network can perform binary classification on each of the graph structures and the node features, that is, the first classification result of the graph structure and the second classification result of the node features can be divided into two situations: tampered and not tampered; if the first classification result is tampered, then the detection result of the PDF document is determined to be tampered, and then, based on the second classification result being tampered, the node corresponding to the tampered node feature can be determined, and then the tampered area in the PDF document can be located.

[0109] In a possible implementation, the PDF document detection method may be executed by a server or by other terminals, depending on actual conditions.

[0110] Through the above embodiment, the PDF document is graph-structured, and representing the PDF document as a graph structure can better learn the tampering trace features, and a natural language model is used to represent each PDF document object, and node features are generated so that the PDF document object can be machine-learned; the graph structure and the node features are input into a graph neural network, and document tampering detection and tampering location are realized through the graph neural network.

[0111] In one possible implementation, the processing of the pre-trained graph neural network is as follows: Figure 4 The steps included are as follows:

[0112] Step S401: Obtain a PDF document dataset.

[0113] Wherein, the PDF document dataset includes multiple groups of historical PDF documents and corresponding historical detection results;

[0114] Specifically, the PDF document dataset includes historical PDF documents and their corresponding historical detection results of being tampered, and specific tampered areas, that is, tampered document objects; and historical PDF documents and their corresponding historical detection results of not being tampered.

[0115] Step S402: training parameters in the graph neural network according to the PDF document dataset;

[0116] Specifically, the historical graph structure and multiple historical node features of each historical PDF document are determined according to the PDF document data set, and multiple parameters in the graph neural network are trained according to the historical graph structure, multiple historical node features and the historical detection results.

[0117] Step S403: Determine the pre-trained graph neural network according to the parameters.

[0118] Specifically, the parameters are saved, and the pre-trained graph neural network is determined according to the parameters.

[0119] In one possible implementation, the pre-trained graph neural network can perform tampering detection on PDF documents.

[0120] In an embodiment of the present invention, a device for detecting a PDF document is provided. Figure 5 As shown, it specifically includes: an acquisition unit 501, a first determination unit 502, a second determination unit 503 and a third determination unit 504; wherein the acquisition unit 501 is used to obtain a cross-reference table of a PDF document, wherein the cross-reference table includes the positions of multiple document objects in the PDF document; the first determination unit 502 is used to determine multiple document objects according to the cross-reference table; the second determination unit 503 is used to determine the graph structure of the PDF document and the node features of each of the document objects according to the multiple document objects; the third determination unit 504 is used to input the graph structure and the multiple node features into a pre-trained graph neural network to determine the detection result of the PDF document.

[0121] Furthermore, the second determining unit is specifically configured to:

[0122] Obtain an indirect reference object of each document object;

[0123] Determining an indirect reference relationship according to the indirect reference object;

[0124] A graph structure of the PDF document is generated according to the indirect reference relationship and the plurality of document objects.

[0125] Furthermore, the second determining unit is specifically configured to:

[0126] Determining the indirect reference relationship as an edge of the graph structure, and determining the plurality of document objects as nodes in the graph structure;

[0127] The graph structure is generated according to the edges and the nodes.

[0128] Furthermore, the second determining unit is specifically configured to:

[0129] The document object is input into a natural language model to generate node features of the document object.

[0130] Furthermore, the third determining unit is specifically configured to:

[0131] Inputting the graph structure and the plurality of node features into a pre-trained graph neural network, classifying the graph structure and each of the node features, and determining a first classification result of the graph structure and a second classification result of each of the node features;

[0132] A detection result of the PDF document is determined according to the first classification result and / or the second classification result.

[0133] Furthermore, the third determining unit is further configured to:

[0134] In response to the first classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0135] In response to the first classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0136] Furthermore, the third determining unit is further configured to:

[0137] In response to the second classification result being tampered with, determining that the detection result of the PDF document is tampered with; or,

[0138] In response to the second classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

[0139] Furthermore, the third determining unit is further configured to:

[0140] In response to the first classification result being tampered, determining the detection result of the PDF document as tampered; and determining the tampered area in the PDF document according to the document object corresponding to the node feature whose second classification result is tampered.

[0141] Furthermore, during the processing of the pre-trained graph neural network, the acquisition unit is further used to:

[0142] Obtain a PDF document dataset, wherein the PDF document dataset includes historical PDF documents and corresponding historical detection results;

[0143] The device also includes: a training unit, used to train parameters in the graph neural network according to the PDF document data set; and a fourth determination unit, used to determine the pre-trained graph neural network according to the parameters.

[0144] Figure 6 Schematic diagram of the structure of the electronic device in the embodiment of the present invention. Figure 6 As shown, it includes a general computer hardware structure, which at least includes a processor 601 and a memory 602. The processor 601 and the memory 602 are connected via a bus 603. The memory 602 is suitable for storing instructions or programs executable by the processor 601. The processor 601 can be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 601 executes the instructions stored in the memory 602, thereby executing the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 603 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 604 and the display device and the input / output (I / O) device 605. The input / output (I / O) device 605 can be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, the input / output device 605 is connected to the system through an input / output (I / O) controller 606.

[0145] Among them, the instructions stored in the memory 602 are executed by at least one processor 601 to implement: obtaining a cross-reference table of a PDF document, wherein the cross-reference table includes the positions of multiple document objects in the PDF document; determining multiple document objects according to the cross-reference table; determining a graph structure of the PDF document and node features of each of the document objects according to the multiple document objects; inputting the graph structure and the multiple node features into a pre-trained graph neural network to determine the detection result of the PDF document.

[0146] Specifically, the electronic device includes: one or more processors 601 and a memory 602, Figure 6 Take a processor 601 as an example. The processor 601 and the memory 602 may be connected via a bus or other means. Figure 6 The bus connection is taken as an example. The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The processor 601 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions and modules stored in the memory 602, that is, the above-mentioned method for determining PDF document detection is implemented.

[0147] The memory 602 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store a list of options, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 602 may optionally include a memory remotely arranged relative to the processor 601, and these remote memories may be connected to an external device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0148] One or more modules are stored in the memory 602 , and when executed by one or more processors 601 , the PDF document detection method in any of the above method embodiments is executed.

[0149] As will be appreciated by those skilled in the art, various aspects of the embodiments of the present invention may be implemented as a system, method or computer program product. Therefore, various aspects of the embodiments of the present invention may take the form of a complete hardware implementation, a complete software implementation (including firmware, resident software, microcode, etc.), or an implementation that combines software aspects with hardware aspects, which may generally be referred to herein as a "circuit," "module," or "system." In addition, various aspects of the embodiments of the present invention may take the form of a computer program product implemented in one or more computer-readable media having a computer-readable program code implemented thereon.

[0150] Any combination of one or more computer-readable media can be utilized. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, (but not limited to) electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or apparatuses, or any suitable combination of the foregoing. More specific examples (non-exhaustive enumeration) of computer-readable storage media will include the following: an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of an embodiment of the present invention, a computer-readable storage medium can be any tangible medium that can contain or store a program used by an instruction execution system, device or apparatus or a program used in conjunction with an instruction execution system, device or apparatus.

[0151] A computer readable signal medium may include a propagated digital signal having a computer readable program code implemented therein, such as in baseband or as part of a carrier wave. Such propagated signals may take any of a variety of forms, including but not limited to electromagnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any of the following computer readable media: not a computer readable storage medium, and may communicate, propagate, or transmit a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0152] Program code embodied on a computer readable medium may be transmitted using any appropriate medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0153] The computer program code for performing operations for various aspects of the embodiments of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, etc., and conventional process programming languages ​​such as "C" programming language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer as a stand-alone software package; partially on the user's computer and partially on a remote computer; or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., by using the Internet of an Internet service provider).

[0154] The flowchart legend and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present invention described above describe various aspects of the embodiment of the present invention.It will be understood that each block of the flowchart legend and / or block diagram and the combination of the blocks in the flowchart legend and / or block diagram can be implemented by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that the instructions (executed by the processor of the computer or other programmable data processing device) create a device for implementing the function / action specified in the flowchart and / or block diagram block or block.

[0155] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing device, or other apparatus to operate in a particular manner, so that the instructions stored in the computer-readable medium produce an article of manufacture including instructions for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0156] The computer program instructions may also be loaded onto a computer, other programmable data processing device or other apparatus so that a series of operable steps are performed on the computer, other programmable device or other apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the functions / actions specified in the flowchart and / or block diagram block or blocks.

[0157] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0158] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. Users' refusal to process personal information other than the necessary information required for basic functions will not affect the user's use of basic functions.

Claims

1. A method for detecting a PDF document, characterized in that: The method comprises: Obtain a cross-reference table of a PDF document, wherein the cross-reference table includes positions of a plurality of document objects in the PDF document; determining a plurality of document objects according to the cross-reference table; Determine a graph structure of the PDF document and a node feature of each of the document objects according to the plurality of document objects; The graph structure and the plurality of node features are input into a pre-trained graph neural network to determine a detection result of the PDF document.

2. The method according to claim 1, characterized in that: Determining the graph structure of the PDF document according to the multiple document objects specifically includes: Obtain an indirect reference object of each document object; Determining an indirect reference relationship according to the indirect reference object; A graph structure of the PDF document is generated according to the indirect reference relationship and the plurality of document objects.

3. The method according to claim 2, characterized in that The step of generating the graph structure of the PDF document according to the indirect reference relationship and the plurality of document objects specifically includes: Determining the indirect reference relationship as an edge of the graph structure, and determining the plurality of document objects as nodes in the graph structure; The graph structure is generated according to the edges and the nodes.

4. The method according to claim 1, characterized in that The determining the node feature of each of the document objects according to the multiple document objects specifically includes: The document object is input into a natural language model to generate node features of the document object.

5. The method according to claim 1, characterized in that: The step of inputting the graph structure and the plurality of node features into a pre-trained graph neural network to determine the detection result of the PDF document specifically includes: Inputting the graph structure and the plurality of node features into a pre-trained graph neural network, classifying the graph structure and each of the node features, and determining a first classification result of the graph structure and a second classification result of each of the node features; A detection result of the PDF document is determined according to the first classification result and / or the second classification result.

6. The method according to claim 5, characterized in that Determining the detection result of the PDF document according to the first classification result specifically includes: In response to the first classification result being tampered with, determining that the detection result of the PDF document is tampered with; or, In response to the first classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

7. The method according to claim 5, characterized in that Determining the detection result of the PDF document according to the second classification result specifically includes: In response to the second classification result being tampered with, determining that the detection result of the PDF document is tampered with; or, In response to the second classification result being not tampered with, it is determined that the detection result of the PDF document is not tampered with.

8. The method according to claim 5, characterized in that Determining the detection result of the PDF document according to the first classification result and the second classification result specifically includes: In response to the first classification result being tampered, the detection result of the PDF document is determined to be tampered; and according to the document object corresponding to the node feature whose second classification result is tampered, the tampered area in the PDF document is determined.

9. The method according to claim 1, characterized in that: The processing of the pre-trained graph neural network includes: Obtain a PDF document dataset, wherein the PDF document dataset includes historical PDF documents and corresponding historical detection results; Training parameters in the graph neural network according to the PDF document dataset; The pre-trained graph neural network is determined according to the parameters.

10. A device for detecting a PDF document, characterized in that: The device comprises: An acquisition unit, configured to acquire a cross-reference table of a PDF document, wherein the cross-reference table includes positions of a plurality of document objects in the PDF document; A first determining unit, configured to determine a plurality of document objects according to the cross-reference table; A second determining unit, configured to determine a graph structure of the PDF document and a node feature of each of the document objects according to the plurality of document objects; The third determination unit is used to input the graph structure and the multiple node features into a pre-trained graph neural network to determine the detection result of the PDF document.

11. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images